Summary4 min read

SANS Stormcast Wednesday, December 10th, 2025: Microsoft, Adobe, Ivanti, Fortinet, and Ruby Patches

Host: Johannes B. Ullrich
Podcast: SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
Date: December 10, 2025

Episode Overview

Today's episode provides a succinct yet thorough rundown of the most important security patches released on this December's Patch Tuesday. Johannes Ullrich highlights updates from major vendors—Microsoft, Adobe, Ivanti, Fortinet, and an open-source Ruby library—focusing on those issues most likely to impact IT professionals and security teams. While this month's cycle is considered somewhat lighter, a few vulnerabilities stand out for their exploitability and severity.

Key Discussion Points and Insights

1. Microsoft Patch Tuesday Breakdown

Summary:
- Total of 57 vulnerabilities addressed.
- Only 3 rated as "critical."
- 1 already exploited (in-the-wild), 2 publicly disclosed.
Privilege Escalation in Cloud Files Mini Filter ([00:51]):
- The exploited vulnerability is a privilege escalation in Microsoft's Cloud Files Mini Filter driver.
- While being used by attackers, it's "only" a privilege escalation rather than remote code execution.
- "Some of those driver issues and yes, that's already being exploited, but again only privilege escalation vulnerability." - Johannes B. Ullrich [01:08]
Publicly Known, Not Yet Exploited Vulnerabilities:
- Invoke-WebRequest PowerShell vulnerability ([01:18]):
  - Potential for code execution if 'useBasicParsing' not specified.
  - Microsoft update now warns users to add this parameter to mitigate risk.
  - "Really just clarified how to use this particular PowerShell function." [01:41]
- AI Copilot Plugin for JetBrains ([01:49]):
  - Risks of AI-powered coding tools.
  - GitHub Copilot plugin updates add new constraints to reduce malicious code execution.
  - "That's sort of where they added some additional constraints. We'll see how well they work to prevent some of these malicious code executions." [02:11]
Critical Vulnerabilities:
- All rated "critical" are found in Microsoft Office and Outlook.
- Described as the "good old Outlook/Office vulnerabilities we have every month." [02:22]
- No major surprises or threats beyond the usual.

Memorable moment:
"I don't really think that this is a terribly exciting patch Tuesday. Even like these three known and already exploited vulnerabilities aren't really that terribly big of a deal." - Johannes B. Ullrich [02:29]

2. Adobe Patch Tuesday Highlights ([02:37])

Five Products Updated:
- Considered “on the lighter side” for Adobe.
Products of Note:
- ColdFusion:
  - Arbitrary code execution via unconstrained file upload.
  - Attackers could upload a webshell; high likelihood of exploitation.
- Acrobat Reader:
  - Code execution vulnerabilities; commonly exploited through malicious PDFs.

"Two of these products are sort of on my watch list of likely to be exploited products. One cold fusion and we do have a big vulnerability here, an arbitrary code execution due to an unconstrained file upload..." [02:48]

3. Ivanti Endpoint Manager ([03:20])

Stored Cross-Site Scripting in Admin Sessions:
- High-risk with a CVSS score of 9.6.
- Allows remote control of an administrator's browser during admin sessions.
- Can lead to significant damage if exploited.

"Certainly something where an attacker could do quite a bit of damage if they can essentially remote control an administrator's browser as part of an admin session." [03:36]

4. Fortinet Authentication Bypass ([03:47])

Vulnerability Details:
- Impacts 40 Cloud Single Sign-On logins.
- Affects any product using 40 Cloud; authentication bypass risk.
- Recommended mitigation: turn off 40 Cloud SSO until devices are updated.
Likely Cause:
- Cryptographic issue, possibly algorithm confusion.

"Looks like some kind of cryptographic issue, maybe algorithm confusion or something like that... that often leads to these type of vulnerabilities." [04:01]

5. Ruby SAML Library Patch ([04:22])

Nature of Vulnerability:
- XML parser discrepancy leading to inconsistent parsing of authentication data.
- Previous similar vulnerability was only partially fixed; this patch aims to completely address it.
- Potential impact: organization authentication systems reliant on SAML.

"Apparently this is sort of one of those parser discrepancy issues where different XML parsers interpret data slightly different and that often leads then to vulnerabilities..." [04:32]

Notable Quotes and Memorable Moments

"Only 57 vulnerabilities being addressed here. Only three of these vulnerabilities were rated as critical." – Johannes B. Ullrich [00:18]
"Really just clarified how to use this particular PowerShell function." [01:41]
"Two of these products are sort of on my watch list of likely to be exploited products." [02:41]
"Certainly something where an attacker could do quite a bit of damage if they can essentially remote control an administrator's browser as part of an admin session." [03:36]
"Looks like some kind of cryptographic issue, maybe algorithm confusion or something like that and that's very common like in these single sign on systems..." [04:01]

Timestamps for Key Segments

00:05 – Introduction and episode theme
00:18 – Microsoft Patch Tuesday summary
00:51 – Exploited privilege escalation vulnerability
01:18 – PowerShell Invoke-WebRequest update
01:49 – AI Copilot plugin and IDE risks
02:22 – Critical Office/Outlook vulnerabilities
02:37 – Adobe patches, focus on ColdFusion and Acrobat Reader
03:20 – Ivanti Endpoint Manager, XSS vulnerability
03:47 – Fortinet SSO authentication bypass
04:22 – Ruby SAML library discrepancy patch

Conclusion

December’s Patch Tuesday is considered lighter but not without important issues, particularly for Adobe ColdFusion, Ivanti Endpoint Manager, and Fortinet SSO implementations. While Microsoft’s critical vulnerabilities tend toward the routine, security teams should pay special attention to the evolving patch for the Ruby SAML library and the potential for exploitation in products with high-value administrative access.

For further details and the latest analysis, listeners are encouraged to visit the SANS Internet Stormcenter website.

Loading summary

Transcript1 lines

[00:05]
A
Hello and welcome to the Wednesday, December 10, 2025 edition of the SANS Internet Storm Centers Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida and this episode is brought to you by the Sans Edu Bachelor's degree program in Applied Cybersecurity. Well, today of course, lots of patches to talk about and first of all, Microsoft's patch Tuesday for December it was a lighter patch Tuesday. Only 57 vulnerabilities being addressed here. Only three of these vulnerabilities were rated as critical. And then we had one vulnerability that's already being exploited and two that are publicly disclosed. Now, about the already being exploited vulnerability, that is a privilege escalation vulnerability in the micro Microsoft Cloud files mini filters driver. Some of those driver issues and yes, that's already being exploited, but again only privilege escalation vulnerability. The publicly known but not yet exploited vulnerabilities. Well, actually the First1Invoke WebRequest, a PowerShell function that's often used maliciously, but of course also in benign scripts. The problem here is that by default you may actually execute code here. So there is this use basic parsing parameter and what they changed here was that if you just use Invoke webrequest you'll actually get a warning telling you that you are here at the risk of actually executing code unless you add the useBasicParsing parameter. So really just clarified how to use this particular PowerShell function. And then the second already known vulnerability, it's really sort of a class of vulnerabilities that we have seen of course quite frequently lately. And that's all these AI copilots as you let them take over your ide, your development environment, you of course run the risk that they'll overstep their bounds and will actually execute code. And of course in some cases an attacker may have some control over the code being executed here and the GitHub Copilot plugin for Jetbrains. So Jetbrains is not Microsoft, but a company that makes a lot of integrated development environments. Then of course Microsoft is responsible for the copilot part that plugs into chatbrains and that's sort of where they added some additional constraints. We'll see how well they work to prevent some of these malicious code executions. Now, none of these vulnerabilities is rated critical. The critical ones are in Office and Outlook. So you're good old Outlook Office vulnerabilities we have every month. And with that, I don't really think that this is a terribly exciting patch Tuesday. Even like these three Known and already exploited vulnerabilities aren't really that terribly big of a deal. Next company to always release updates on Patch Tuesday is Adobe and we got updates for five products, which is on the lighter side for Adobe. But two of these products are sort of on my watch list of likely to be exploited products. One cold fusion and we do have a big vulnerability here, an arbitrary code execution due to an unconstrained file upload, so very likely something where an attacker could upload some kind of web shell. The second product Acrobat Reader also some code execution vulnerabilities being addressed here and then again that's typically being exploited by sending a malicious PDF to the victim. And Ivanti also jumped in here on Patch Tuesday, this time again with an update for Endpoint Manager. One interesting vulnerability here stored cross site scripting in admin sessions and this one rates with a css score of 9.6. Certainly something where an attacker could do quite a bit of damage if they can essentially remote control an administrator's browser as part of an admin session. At Fortinet is warning of an authentication bypass vulnerability that affects its 40 cloud single sign on login. This affects all products that are configured with 40 cloud and the mitigation here is well to turn it off until you update your device. Looks like some kind of cryptographic issue, maybe algorithm confusion or something like that and that's very common like in these single sign on systems if they haven't been dilated properly or if they're using some outdated library and the like that often leads to these type of vulnerabilities. And I have no idea if Fortinet software is written in Ruby, but we also had a patch today for the Ruby SAML library. Apparently this is sort of one of those parser discrepancy issues where different XML parsers parsers interpret data slightly different and that often leads then to vulnerabilities where for example username or claims or such aren't parsed properly or differently in different parsers. They had a similar vulnerability I think a couple months ago and didn't completely fix it. So this is really just an additional fix for this older vulnerability to hopefully this time completely mitigate it. Well, and this is it for today. Thanks for listening and would really appreciate a comment in the Apple Podcasts app. And that's it for today and talk to you again tomorrow. Bye.