For the primary time in 2025, Microsoft’s Patch Tuesday updates didn’t bundle fixes for exploited safety vulnerabilities, however acknowledged one of many addressed flaws had been publicly recognized.
The patches resolve a whopping 130 vulnerabilities, together with 10 different non-Microsoft CVEs that have an effect on Visible Studio, AMD, and its Chromium-based Edge browser. Of those 10 are rated Important and the remaining are all rated Essential in severity.
“The 11-month streak of patching at the very least one zero-day that was exploited within the wild ended this month,” Satnam Narang, Senior Workers Analysis Engineer at Tenable, stated.
Fifty-three of those shortcomings are categorized as privilege escalation bugs adopted by 42 as distant code execution, 17 as data disclosure, and eight as safety characteristic bypasses. These patches are along with two different flaws addressed by the corporate within the Edge browser for the reason that launch of final month’s Patch Tuesday replace.
The vulnerability that is listed as publicly recognized is an data disclosure flaw in Microsoft SQL Server (CVE-2025-49719, CVSS rating: 7.5) that might allow an unauthorized attacker to leak uninitialized reminiscence.
“An attacker would possibly effectively study nothing of any worth, however with luck, persistence, or some very artful massaging of the exploit, the prize might be cryptographic key materials or different crown jewels from the SQL Server,” Adam Barnett, Lead Software program Engineer at Rapid7, stated in a press release.
Mike Walters, President and Co-Founding father of Action1, stated the flaw probably is the results of improper enter validation in SQL Server’s reminiscence administration, permitting entry to uninitialized reminiscence.
“In consequence, attackers might retrieve remnants of delicate information, akin to credentials or connection strings,” Walters added. “It impacts each the SQL Server engine and functions utilizing OLE DB drivers.”
Probably the most essential flaw patched by Microsoft as a part of this month’s updates considerations a case of distant code execution impacting SPNEGO Prolonged Negotiation (NEGOEX). Tracked as CVE-2025-47981, it carries a CVSS rating of 9.8 out of 10.0.
“Heap-based buffer overflow in Home windows SPNEGO Prolonged Negotiation permits an unauthorized attacker to execute code over a community,” Microsoft stated in an advisory. “An attacker might exploit this vulnerability by sending a malicious message to the server, probably resulting in distant code execution.”
An nameless researcher and Yuki Chen have been credited with discovering and repairing the flaw. Microsoft famous that the difficulty solely impacts Home windows shopper machines working Home windows 10, model 1607 and above as a result of “Community safety: Enable PKU2U authentication requests to this pc to make use of on-line identities” Group Coverage Object (GPO) being enabled by default.
“As all the time, Distant Code Execution is unhealthy, however early evaluation is suggesting that this vulnerability could also be ‘wormable’ – the form of vulnerability that might be leveraged in self-propagating malware and make many revisit trauma from the WannaCry incident,” watchTowr founder and CEO Benjamin Harris stated.
“Microsoft is obvious on pre-requisites right here: no authentication required, simply community entry, and Microsoft themselves imagine exploitation is ‘Extra Doubtless.’ We should not idiot ourselves – if the non-public trade has seen this vulnerability, it’s definitely already on the radar of each attacker with an oz of malice. Defenders have to drop all the things, patch quickly, and search out uncovered programs.”
Different vulnerabilities of significance embrace distant code execution flaws impacting Home windows KDC Proxy Service (CVE-2025-49735, CVSS rating: 8.1), Home windows Hyper-V (CVE-2025-48822, CVSS rating: 8.6), and Microsoft Workplace (CVE-2025-49695, CVE-2025-496966, and CVE-2025-49697, CVSS scores: 8.4).
“What makes CVE-2025-49735 important is the community publicity mixed with no required privileges or person interplay. Regardless of its excessive assault complexity, the vulnerability opens the door to pre-auth distant compromise, notably enticing to APTs and nation-state actors,” Ben McCarthy, Lead Cyber Safety Engineer at Immersive, stated.
“The attacker should win a race situation – a timing flaw the place reminiscence is freed and reallocated in a particular window – that means reliability is low for now. Nonetheless, such points could be weaponized with strategies like heap grooming, making eventual exploitation possible.”
Elsewhere, the replace closes out 5 safety characteristic bypasses in Bitlocker (CVE-2025-48001, CVE-2025-48003, CVE-2025-48800, CVE-2025-48804, and CVE-2025-48818, CVSS scores: 6.8) that might permit an attacker with bodily entry the machine to pay money for encrypted information.
“An attacker might exploit this vulnerability by loading a WinRE.wim file whereas the OS quantity is unlocked, granting entry to BitLocker encrypted information,” Microsoft stated about CVE-2025-48804.
Researchers Netanel Ben Simon and Alon Leviev with Microsoft Offensive Analysis and Safety Engineering (MORSE) have been acknowledged for reporting the 5 points within the built-in disk encryption device.
“If exploited, these flaws might expose delicate information, credentials, or permit tampering with system integrity,” Jacob Ashdown, Cyber Safety Engineer at Immersive, stated. “This poses a specific danger, particularly for organizations the place units could also be misplaced or stolen, as attackers with hands-on entry might probably bypass encryption and extract delicate information.”
It is also price noting that July 8, 2025, formally marks the top of the highway for SQL Server 2012, which can not obtain any future safety patches within the checklist of the Prolonged Safety Replace (ESU) program coming to a detailed.
Software program Patches from Different Distributors
Along with Microsoft, safety updates have additionally been launched by different distributors over the previous couple of weeks to rectify a number of vulnerabilities, together with —
Adobe
AMD
Atlassian
Bitdefender
Broadcom (together with VMware)
Cisco
Citrix
D-Hyperlink
Dell
Drupal
F5
Fortinet
Fortra
Gigabyte
GitLab
Google Chrome
Google Cloud
Grafana
Hikvision
Hitachi Vitality
HP
HP Enterprise (together with Aruba Networking)
IBM
Intel
Ivanti
Jenkins
Juniper Networks
Lenovo
Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Crimson Hat, Rocky Linux, SUSE, and Ubuntu
MediaTek
Mitsubishi Electrical
MongoDB
Moxa
Mozilla Thunderbird
NVIDIA
OPPO
Palo Alto Networks
Progress Software program
Qualcomm
Ricoh
Rsync
Ruckus Wi-fi
Samsung
SAP
Schneider Electrical
Siemens
Splunk
Supermicro
Veeam
WordPress
Zimbra, and
Zoom
Discovered this text attention-grabbing? Comply with us on Twitter and LinkedIn to learn extra unique content material we submit.
