IRONSMITHINTEL
CRITICALCVSS8.8
|
Actively Exploited
|CISA KEV|CVE-2025-32701|Auth: multiple — see individual cves|Reboot: required|Est. 30–60 minutes including reboot|Manual only

KB5058385: Windows Server 2022 Cumulative Update (May 2025)

The May 2025 cumulative update for Windows Server 2022 bundles fixes for five zero-days exploited in the wild (three privilege-escalation chains in CLFS / WinSock / DWM, one Scripting Engine memory-corruption RCE) plus two CVSS 8.8 Remote Desktop heap-overflow RCEs. Apply within the operator's standard 7-day SLA — exploitation is active.

Published May 13, 2025 · Updated May 15, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A local attacker who already has unprivileged code execution on the host can chain any of the four EoP zero-days to gain SYSTEM. The Scripting Engine flaw and the two Remote Desktop heap overflows extend the attack surface to network-reachable code execution where the prerequisite conditions apply (a user opens a malicious page / connects out to a malicious RDP server / a vulnerable RDS gateway is reachable).

How the attack worksNo clicks needed

KB5058385 rolls up every security fix for Windows Server 2022 since the April 2025 cumulative update (KB5055526). Five of the bundled fixes address exploited-in-the-wild zero-days: CVE-2025-32701 and CVE-2025-32706 are use-after-free / EoP issues in the Common Log File System driver; CVE-2025-32709 is an EoP in the Ancillary Function Driver for WinSock; CVE-2025-30400 is an EoP in the Desktop Window Manager Core Library; CVE-2025-30397 is a Scripting Engine memory-corruption flaw that allows remote code execution. Two additional critical fixes address heap-based buffer overflows in Remote Desktop client (CVE-2025-29966) and Remote Desktop Gateway Service (CVE-2025-29967).

Am I affected?Quick check

Probably yes if any of these apply:

All Windows Server 2022 systems
Windows Server 2022 hosts initiating outbound RDP
Internet-facing Remote Desktop Gateway servers
Hosts where unprivileged users can execute code
Running Windows Server 2022 prior to OS Build 20348.3692 (KB5058385)

Affected OS versions

Windows Server 2022
Fixed inKB5058385 (OS Build 20348.3692)
Real-world incidentsWhat we've seen

Microsoft confirmed exploitation of all four EoP zero-days and the Scripting Engine RCE prior to the May 13 2025 release. CrowdStrike Counter Adversary Operations reported CVE-2025-32706 to Microsoft. Tenable categorised this Patch Tuesday as one of the most actively exploited in 2025 — the CLFS driver alone received its third in-the-wild EoP fix of the year (after CVE-2025-29824 in April).

How to patch

Manual download

For air-gapped servers or out-of-band deployment. Microsoft Update Catalog returns every OS-version variant of this update.

↗ Microsoft Update CatalogKB5058385

Manual remediation steps

30–60 minutes including reboot

Check if KB5058385 is Installed

Get-HotFix -Id KB5058385
# No output = patch not installed
# Or check OS build:
[System.Environment]::OSVersion.Version
# Build number 20348.3692 or higher = patched

Apply via Windows Update

1
Open Settings → Windows Update
2
Click "Check for updates"
3
Install all available updates
4
Restart when prompted

Apply Manually (Disconnected Hosts)

1
Download KB5058385 from https://catalog.update.microsoft.com
2
Run the MSU installer as Administrator:
wusa.exe windows10.0-kb5058385-x64.msu /quiet /norestart
3
Restart the server

Apply via WSUS / SCCM / Intune

Approve KB5058385 in your patch management console. The update is classified as a Security Update for Windows Server 2022.

Verify After Reboot

Get-HotFix -Id KB5058385
# InstalledOn date must appear

# Or verify OS build:
Get-ComputerInfo | Select-Object WindowsVersion, OsBuildNumber
# OsBuildNumber must be 20348.3692 or higher
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

CVEs in this update7 fixes · Patch-to-CVE mapping
Patch IDCVE IDVulnerability Name / TypeCVSSReference
KB5058385CVE-2025-32701Elevation of Privilege — Windows Common Log File System Driver7.8NVD ↗
KB5058385CVE-2025-32706Elevation of Privilege — Windows Common Log File System Driver7.8NVD ↗
KB5058385CVE-2025-32709Elevation of Privilege — Windows Ancillary Function Driver for WinSock7.8NVD ↗
KB5058385CVE-2025-30400Elevation of Privilege — Microsoft DWM Core Library7.8NVD ↗
KB5058385CVE-2025-30397Remote Code Execution — Microsoft Scripting Engine (memory corruption)7.5NVD ↗
KB5058385CVE-2025-29966Remote Code Execution — Windows Remote Desktop (heap buffer overflow)8.8NVD ↗
KB5058385CVE-2025-29967Remote Code Execution — Remote Desktop Gateway Service (heap overflow)8.8NVD ↗