Monthly Fallout Report

May 2025 Fallout

Five zero-days exploited in the wild. HP devices hit with BitLocker recovery loops. SharePoint chaos looms.

Damage Rating
72
Vulnerabilities
5
Zero-Days
6
Critical RCEs
3
KB Updates

Fallout Timeline

Initial Release — Patch Tuesday Day 0

May 2025 addresses 72 vulnerabilities with 5 actively exploited zero-days — a rough month. SharePoint Server RCE, Windows CLFS Driver EoP, and a Mark of the Web bypass are the headliners. Two zero-days were publicly disclosed before patching, raising the urgency. Enterprise admins running SharePoint or Hyper-V need to act immediately.

CVE-2025-29851 CVSS 8.8

SharePoint Server Remote Code Execution — actively exploited, high urgency for SharePoint admins.

CVE-2025-29849 CVSS 7.8

Windows CLFS Driver Elevation of Privilege — actively exploited.

CVE-2025-29852 CVSS 6.5

Windows Mark of the Web Security Feature Bypass — actively exploited, publicly disclosed pre-patch.

CVE-2025-29854 CVSS 7.8

Windows DWM Core Library Elevation of Privilege — actively exploited.

CVE-2025-29855 CVSS 6.5

MSHTML Platform Security Feature Bypass — actively exploited, publicly disclosed pre-patch.

Sources: r/sysadmin · BleepingComputer · MSRC

72 Hours Out +3 Days Issues Active

Three days in and HP users on Windows 10 22H2 are having a terrible time. KB5058379 is triggering BitLocker recovery prompts on HP models including 650 G10 and ZBook G9/G10/G11A — often rolling back after key entry. BSODs tied to Intel TXT settings (error 0xc0290122) are also hitting HP devices. Workaround: disable TXT or OS Kernel DMA Support in BIOS (with caution). Slow installs of 20-30 minutes are common. Windows 11 taskbar glitches can be fixed by restarting explorer.exe.

Sources: r/sysadmin · BleepingComputer

2 Weeks Out +14 Days Largely Resolved

Two weeks out, Microsoft released out-of-band update KB5061768 which fixes both the BitLocker recovery loop and the BSOD issues on HP devices running Windows 10 22H2. Apply it immediately if you haven't already. Non-HP and Windows 11 systems are stable. The SharePoint and zero-day risks remain as patching urgencies but no new widespread operational issues have surfaced.

Sources: r/sysadmin · BleepingComputer

Resources