Microsoft Fixes 80 Flaws — Together with SMB PrivEsc and Azure CVSS 10.0 Bugs

September 11, 2025

2

Microsoft Fixes 80 Flaws — Together with SMB PrivEsc and Azure CVSS 10.0 Bugs

Microsoft on Tuesday addressed a set of 80 safety flaws in its software program, together with one vulnerability that has been disclosed as publicly recognized on the time of launch.

Of the 80 vulnerabilities, eight are rated Important and 72 are rated Essential in severity. Not one of the shortcomings has been exploited within the wild as a zero-day. Like final month, 38 of the disclosed flaws are associated to privilege escalation, adopted by distant code execution (22), info disclosure (14), and denial-of-service (3).

“For the third time this 12 months, Microsoft patched extra elevation of privilege vulnerabilities than distant code execution flaws,” Satnam Narang, senior workers analysis engineer at Tenable, stated. “Practically 50% (47.5%) of all bugs this month are privilege escalation vulnerabilities.”

The patches are along with 12 vulnerabilities addressed in Microsoft’s Chromium-based Edge browser for the reason that launch of August 2025’s Patch Tuesday replace, together with a safety bypass bug (CVE-2025-53791, CVSS rating: 4.7) that has been patched in model 140.0.3485.54 of the browser.

The vulnerability that has been flagged as publicly recognized is CVE-2025-55234 (CVSS rating: 8.8), a case of privilege escalation in Home windows SMB.

“SMB Server is likely to be vulnerable to relay assaults relying on the configuration,” Microsoft stated. “An attacker who efficiently exploited these vulnerabilities may carry out relay assaults and make the customers topic to elevation of privilege assaults.”

The Home windows maker stated the replace allows help for auditing SMB consumer compatibility for SMB Server signing in addition to SMB Server EPA, permitting clients to evaluate their setting and detect any potential gadget or software program incompatibility points earlier than deploying acceptable hardening measures.

“The important thing takeaway from the CVE-2025-55234 advisory, apart from the reason of the well-known assault floor round SMB authentication, is that that is a type of occasions the place merely patching is not sufficient; in reality, the patches present directors with extra auditing choices to find out whether or not their SMB Server is interacting with shoppers that will not help the beneficial hardening choices,” Adam Barnett, lead software program engineer at Rapid7, stated.

Mike Walters, president and co-founder of Motion, stated the vulnerability stems from the truth that SMB classes could be established with out correctly validating the authentication context when key hardening measures, comparable to SMB signing and Prolonged Safety for Authentication, are usually not in place.

“This hole opens the door to man-in-the-middle relay assaults, the place attackers can seize and ahead authentication materials to realize unauthorized entry,” Walters added. “It will possibly simply turn into half of a bigger marketing campaign, shifting from phishing to SMB relay, credential theft, lateral motion, and finally knowledge exfiltration.”

The CVE with the very best CVSS rating for this month is CVE-2025-54914 (CVSS rating: 10.0), a crucial flaw impacting Azure Networking that would lead to privilege escalation. It requires no buyer motion, provided that it is a cloud-related vulnerability.

Two different shortcomings that advantage consideration embrace a distant code execution flaw in Microsoft Excessive Efficiency Compute (HPC) Pack (CVE-2025-55232, CVSS rating: 9.8) and an elevation of privilege challenge affecting Home windows NTLM (CVE-2025-54918, CVSS rating: 8.8) that would enable an attacker to realize SYSTEM privileges.

“From Microsoft’s restricted description, it seems that if an attacker is ready to ship specifically crafted packets over the community to the goal gadget, they might have the flexibility to realize SYSTEM-level privileges on the goal machine,” Kev Breen, senior director of risk analysis at Immersive, stated.

“The patch notes for this vulnerability state that ‘Improper authentication in Home windows NTLM permits a certified attacker to raise privileges over a community,’ suggesting an attacker might already must have entry to the NTLM hash or the consumer’s credentials.”

Lastly, the replace additionally remediates a safety flaw (CVE-2024-21907, CVSS rating: 7.5) in Newtonsoft.Json, a third-party part utilized in SQL Server, that could possibly be exploited to set off a denial-of-service situation, in addition to two privilege escalation vulnerabilities in Home windows BitLocker (CVE-2025-54911, CVSS rating: 7.3, and CVE-2025-54912, CVSS rating: 7.8).

Microsoft’s Hussein Alrubaye has been credited with discovering and reporting each the BitLocker flaws. The 2 flaws add to 4 different vulnerabilities (collectively referred to as BitUnlocker) within the full-disk encryption function that have been patched by Microsoft in July 2025 –

CVE-2025-48003 (CVSS rating: 6.8) – BitLocker Safety Characteristic Bypass Vulnerability by way of WinRE Apps Scheduled Operation
CVE-2025-48800 (CVSS rating: 6.8) – BitLocker Safety Characteristic Bypass Vulnerability by Focusing on ReAgent.xml Parsing
CVE-2025-48804 (CVSS rating: 6.8) – BitLocker Safety Characteristic Bypass Vulnerability by Focusing on Boot.sdi Parsing
CVE-2025-48818 (CVSS rating: 6.8) – BitLocker Safety Characteristic Bypass Vulnerability by Focusing on Boot Configuration Knowledge (BCD) Parsing

Profitable exploitation of any of the above 4 flaws may enable an attacker with bodily entry to the goal to bypass BitLocker protections and acquire entry to encrypted knowledge.

“To additional improve the safety of BitLocker, we suggest enabling TPM+PIN for pre-boot authentication,” Safety Testing and Offensive Analysis at Microsoft (STORM) researchers Netanel Ben Simon and Alon Leviev stated in a report final month. “This considerably reduces the BitLocker assault surfaces by limiting publicity to solely the TPM.”

“To mitigate BitLocker downgrade assaults, we advise enabling the REVISE mitigation. This mechanism enforces safe versioning throughout crucial boot elements, stopping downgrades that would reintroduce recognized vulnerabilities in BitLocker and Safe Boot.”

The disclosure comes as Purple Crew detailed a brand new lateral motion method dubbed BitLockMove that includes the distant manipulation of BitLocker registry keys by way of Home windows Administration Instrumentation (WMI) to hijack particular COM objects of BitLocker.

BitLockMove, developed by safety researcher Fabian Mosch, works by initiating a distant connection to the goal host via WMI and copying a malicious DLL to the goal over SMB. Within the subsequent section, the attacker writes a brand new registry key that specifies the DLL path, in the end inflicting BitLocker to load the copied DLL by hijacking its COM objects.

“The aim of the BitLocker COM Hijacking is to execute code below the context of the interactive consumer on a goal host,” Purple Crew stated. “Within the occasion that the interactive consumer has extreme privileges (i.e., area administrator), this might additionally result in area escalation.”

Software program Patches from Different Distributors

Along with Microsoft, safety updates have additionally been launched by different distributors over the previous a number of weeks to rectify a number of vulnerabilities, together with —