CSIRT Panamá Aviso 2025-Nov-12 Actualizaciones de seguridad de Microsoft para Noviembre 2025.
Gravedad: Alta
Fecha de publicación: noviembre 12, 2025
Última revisión: noviembre 12, 2025
https://msrc.microsoft.com/update-guide/releaseNote/2025-Nov
Sistemas Afectados:
Azure Monitor Agent
Customer Experience Improvement Program (CEIP)
Dynamics 365 Field Service (online)
GitHub Copilot and Visual Studio Code
Host Process for Windows Tasks
Microsoft Configuration Manager
Microsoft Dynamics 365 (on-premises)
Microsoft Graphics Component
Microsoft Office
Microsoft Office Excel
Microsoft Office SharePoint
Microsoft Office Word
Microsoft Streaming Service
Microsoft Wireless Provisioning System
Multimedia Class Scheduler Service (MMCSS)
Nuance PowerScribe
OneDrive for Android
Role: Windows Hyper-V
SQL Server
Storvsp.sys Driver
Visual Studio
Visual Studio Code CoPilot Chat Extension
Windows Administrator Protection
Windows Ancillary Function Driver for WinSock
Windows Bluetooth RFCOM Protocol Driver
Windows Broadcast DVR User Service
Windows Client-Side Caching (CSC) Service
Windows Common Log File System Driver
Windows DirectX
Windows Kerberos
Windows Kernel
Windows License Manager
Windows OLE
Windows Remote Desktop
Windows Routing and Remote Access Service (RRAS)
Windows Smart Card
Windows Speech
Windows Subsystem for Linux GUI
Windows TDX.sys
Windows WLAN Service
I. Descripción
Microsoft ha liberado sus actualizaciones de seguridad correspondientes al mes de noviembre de 2025.
Este conjunto de actualizaciones remedia 63 fallas y 1 día cero.
II. Detalle
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| Azure Monitor Agent | CVE-2025-59504 | Azure Monitor Agent Remote Code Execution Vulnerability | Important |
| Customer Experience Improvement Program (CEIP) | CVE-2025-59512 | Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability | Important |
| Dynamics 365 Field Service (online) | CVE-2025-62211 | Dynamics 365 Field Service (online) Spoofing Vulnerability | Important |
| Dynamics 365 Field Service (online) | CVE-2025-62210 | Dynamics 365 Field Service (online) Spoofing Vulnerability | Important |
| GitHub Copilot and Visual Studio Code | CVE-2025-62453 | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | Important |
| Host Process for Windows Tasks | CVE-2025-60710 | Host Process for Windows Tasks Elevation of Privilege Vulnerability | Important |
| Microsoft Configuration Manager | CVE-2025-47179 | Configuration Manager Elevation of Privilege Vulnerability | Important |
| Microsoft Dynamics 365 (on-premises) | CVE-2025-62206 | Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability | Important |
| Microsoft Graphics Component | CVE-2025-60724 | GDI+ Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2025-62216 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Office | CVE-2025-62199 | Microsoft Office Remote Code Execution Vulnerability | Critical |
| Microsoft Office Excel | CVE-2025-62200 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62201 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-60726 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62203 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-62202 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-60727 | Microsoft Excel Remote Code Execution Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-60728 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2025-59240 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office SharePoint | CVE-2025-62204 | Microsoft SharePoint Remote Code Execution Vulnerability | Important |
| Microsoft Office Word | CVE-2025-62205 | Microsoft Office Remote Code Execution Vulnerability | Important |
| Microsoft Streaming Service | CVE-2025-59514 | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | Important |
| Microsoft Wireless Provisioning System | CVE-2025-62218 | Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability | Important |
| Microsoft Wireless Provisioning System | CVE-2025-62219 | Microsoft Wireless Provisioning System Elevation of Privilege Vulnerability | Important |
| Multimedia Class Scheduler Service (MMCSS) | CVE-2025-60707 | Multimedia Class Scheduler Service (MMCSS) Driver Elevation of Privilege Vulnerability | Important |
| Nuance PowerScribe | CVE-2025-30398 | Nuance PowerScribe 360 Information Disclosure Vulnerability | Critical |
| OneDrive for Android | CVE-2025-60722 | Microsoft OneDrive for Android Elevation of Privilege Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2025-60706 | Windows Hyper-V Information Disclosure Vulnerability | Important |
| SQL Server | CVE-2025-59499 | Microsoft SQL Server Elevation of Privilege Vulnerability | Important |
| Storvsp.sys Driver | CVE-2025-60708 | Storvsp.sys Driver Denial of Service Vulnerability | Important |
| Visual Studio | CVE-2025-62214 | Visual Studio Remote Code Execution Vulnerability | Critical |
| Visual Studio Code CoPilot Chat Extension | CVE-2025-62449 | Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability | Important |
| Visual Studio Code CoPilot Chat Extension | CVE-2025-62222 | Agentic AI and Visual Studio Code Remote Code Execution Vulnerability | Important |
| Windows Administrator Protection | CVE-2025-60721 | Windows Administrator Protection Elevation of Privilege Vulnerability | Important |
| Windows Administrator Protection | CVE-2025-60718 | Windows Administrator Protection Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-62217 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-60719 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2025-62213 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Bluetooth RFCOM Protocol Driver | CVE-2025-59513 | Windows Bluetooth RFCOM Protocol Driver Information Disclosure Vulnerability | Important |
| Windows Broadcast DVR User Service | CVE-2025-59515 | Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | Important |
| Windows Broadcast DVR User Service | CVE-2025-60717 | Windows Broadcast DVR User Service Elevation of Privilege Vulnerability | Important |
| Windows Client-Side Caching (CSC) Service | CVE-2025-60705 | Windows Client-Side Caching Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2025-60709 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important |
| Windows DirectX | CVE-2025-59506 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | Important |
| Windows DirectX | CVE-2025-60716 | DirectX Graphics Kernel Elevation of Privilege Vulnerability | Critical |
| Windows DirectX | CVE-2025-60723 | DirectX Graphics Kernel Denial of Service Vulnerability | Important |
| Windows Kerberos | CVE-2025-60704 | Windows Kerberos Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2025-62215 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows License Manager | CVE-2025-62208 | Windows License Manager Information Disclosure Vulnerability | Important |
| Windows License Manager | CVE-2025-62209 | Windows License Manager Information Disclosure Vulnerability | Important |
| Windows OLE | CVE-2025-60714 | Windows OLE Remote Code Execution Vulnerability | Important |
| Windows Remote Desktop | CVE-2025-60703 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-62452 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-59510 | Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-60715 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability | Important |
| Windows Routing and Remote Access Service (RRAS) | CVE-2025-60713 | Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability | Important |
| Windows Smart Card | CVE-2025-59505 | Windows Smart Card Reader Elevation of Privilege Vulnerability | Important |
| Windows Speech | CVE-2025-59507 | Windows Speech Runtime Elevation of Privilege Vulnerability | Important |
| Windows Speech | CVE-2025-59508 | Windows Speech Recognition Elevation of Privilege Vulnerability | Important |
| Windows Speech | CVE-2025-59509 | Windows Speech Recognition Information Disclosure Vulnerability | Important |
| Windows Subsystem for Linux GUI | CVE-2025-62220 | Windows Subsystem for Linux GUI Remote Code Execution Vulnerability | Important |
| Windows TDX.sys | CVE-2025-60720 | Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability | Important |
| Windows WLAN Service | CVE-2025-59511 | Windows WLAN Service Elevation of Privilege Vulnerability | Important |
III. Referencia a soluciones, herramientas e información
Actualizar utilizando Microsoft Windows Update o herramientas de administración de actualizaciones centralizadas.
IV. Información de contacto
CSIRT PANAMA
Computer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
E-Mail: incidentes@cert.pa
E-Mail: info@cert.pa
Phone: +507 520-CERT (2378)
Web: https://cert.pa
Key ID: 16F2B124