For the primary time in 2025, Microsoft’s Patch Tuesday updates didn’t bundle fixes for exploited safety vulnerabilities, however acknowledged one of many addressed flaws had been publicly identified.
The patches resolve a whopping 130 vulnerabilities, together with 10 different non-Microsoft CVEs that have an effect on Visible Studio, AMD, and its Chromium-based Edge browser. Of those 10 are rated Essential and the remaining are all rated Necessary in severity.
“The 11-month streak of patching not less than one zero-day that was exploited within the wild ended this month,” Satnam Narang, Senior Workers Analysis Engineer at Tenable, stated.
Fifty-three of those shortcomings are categorised as privilege escalation bugs adopted by 42 as distant code execution, 17 as info disclosure, and eight as safety characteristic bypasses. These patches are along with two different flaws addressed by the corporate within the Edge browser because the launch of final month’s Patch Tuesday replace.
The vulnerability that is listed as publicly identified is an info disclosure flaw in Microsoft SQL Server (CVE-2025-49719, CVSS rating: 7.5) that would allow an unauthorized attacker to leak uninitialized reminiscence.
“An attacker would possibly effectively study nothing of any worth, however with luck, persistence, or some very artful massaging of the exploit, the prize could possibly be cryptographic key materials or different crown jewels from the SQL Server,” Adam Barnett, Lead Software program Engineer at Rapid7, stated in an announcement.
Mike Walters, President and Co-Founding father of Action1, stated the flaw seemingly is the results of improper enter validation in SQL Server’s reminiscence administration, permitting entry to uninitialized reminiscence.
“Consequently, attackers may retrieve remnants of delicate knowledge, equivalent to credentials or connection strings,” Walters added. “It impacts each the SQL Server engine and purposes utilizing OLE DB drivers.”
Probably the most important flaw patched by Microsoft as a part of this month’s updates considerations a case of distant code execution impacting SPNEGO Prolonged Negotiation (NEGOEX). Tracked as CVE-2025-47981, it carries a CVSS rating of 9.8 out of 10.0.
“Heap-based buffer overflow in Home windows SPNEGO Prolonged Negotiation permits an unauthorized attacker to execute code over a community,” Microsoft stated in an advisory. “An attacker may exploit this vulnerability by sending a malicious message to the server, probably resulting in distant code execution.”
An nameless researcher and Yuki Chen have been credited with discovering and repairing the flaw. Microsoft famous that the difficulty solely impacts Home windows consumer machines working Home windows 10, model 1607 and above because of the “Community safety: Enable PKU2U authentication requests to this pc to make use of on-line identities” Group Coverage Object (GPO) being enabled by default.
“As all the time, Distant Code Execution is dangerous, however early evaluation is suggesting that this vulnerability could also be ‘wormable’ – the type of vulnerability that could possibly be leveraged in self-propagating malware and make many revisit trauma from the WannaCry incident,” watchTowr founder and CEO Benjamin Harris stated.
“Microsoft is obvious on pre-requisites right here: no authentication required, simply community entry, and Microsoft themselves imagine exploitation is ‘Extra Possible.’ We should not idiot ourselves – if the personal trade has observed this vulnerability, it’s actually already on the radar of each attacker with an oz. of malice. Defenders must drop all the things, patch quickly, and seek out uncovered methods.”
Different vulnerabilities of significance embrace distant code execution flaws impacting Home windows KDC Proxy Service (CVE-2025-49735, CVSS rating: 8.1), Home windows Hyper-V (CVE-2025-48822, CVSS rating: 8.6), and Microsoft Workplace (CVE-2025-49695, CVE-2025-496966, and CVE-2025-49697, CVSS scores: 8.4).
“What makes CVE-2025-49735 important is the community publicity mixed with no required privileges or person interplay. Regardless of its excessive assault complexity, the vulnerability opens the door to pre-auth distant compromise, significantly enticing to APTs and nation-state actors,” Ben McCarthy, Lead Cyber Safety Engineer at Immersive, stated.
“The attacker should win a race situation – a timing flaw the place reminiscence is freed and reallocated in a selected window – that means reliability is low for now. Nonetheless, such points could be weaponized with strategies like heap grooming, making eventual exploitation possible.”
Elsewhere, the replace closes out 5 safety characteristic bypasses in Bitlocker (CVE-2025-48001, CVE-2025-48003, CVE-2025-48800, CVE-2025-48804, and CVE-2025-48818, CVSS scores: 6.8) that would permit an attacker with bodily entry the machine to pay money for encrypted knowledge.
“An attacker may exploit this vulnerability by loading a WinRE.wim file whereas the OS quantity is unlocked, granting entry to BitLocker encrypted knowledge,” Microsoft stated about CVE-2025-48804.
Researchers Netanel Ben Simon and Alon Leviev with Microsoft Offensive Analysis and Safety Engineering (MORSE) have been acknowledged for reporting the 5 points within the built-in disk encryption software.
“If exploited, these flaws may expose delicate recordsdata, credentials, or permit tampering with system integrity,” Jacob Ashdown, Cyber Safety Engineer at Immersive, stated. “This poses a selected danger, particularly for organizations the place gadgets could also be misplaced or stolen, as attackers with hands-on entry may probably bypass encryption and extract delicate knowledge.”
It is also price noting that July 8, 2025, formally marks the tip of the street for SQL Server 2012, which is able to now not obtain any future safety patches within the listing of the Prolonged Safety Replace (ESU) program coming to an in depth.
Software program Patches from Different Distributors
Along with Microsoft, safety updates have additionally been launched by different distributors over the previous couple of weeks to rectify a number of vulnerabilities, together with —
- Adobe
- AMD
- Atlassian
- Bitdefender
- Broadcom (together with VMware)
- Cisco
- Citrix
- D-Hyperlink
- Dell
- Drupal
- F5
- Fortinet
- Fortra
- Gigabyte
- GitLab
- Google Chrome
- Google Cloud
- Grafana
- Hikvision
- Hitachi Vitality
- HP
- HP Enterprise (together with Aruba Networking)
- IBM
- Intel
- Ivanti
- Jenkins
- Juniper Networks
- Lenovo
- Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Purple Hat, Rocky Linux, SUSE, and Ubuntu
- MediaTek
- Mitsubishi Electrical
- MongoDB
- Moxa
- Mozilla Thunderbird
- NVIDIA
- OPPO
- Palo Alto Networks
- Progress Software program
- Qualcomm
- Ricoh
- Rsync
- Ruckus Wi-fi
- Samsung
- SAP
- Schneider Electrical
- Siemens
- Splunk
- Supermicro
- Veeam
- WordPress
- Zimbra, and
- Zoom
