For the primary time in 2025, Microsoft’s Patch Tuesday updates didn’t bundle fixes for exploited security vulnerabilities, however acknowledged one of many addressed flaws had been publicly identified.
The patches resolve a whopping 130 vulnerabilities, together with 10 different non-Microsoft CVEs that have an effect on Visible Studio, AMD, and its Chromium-based Edge browser. Of those 10 are rated Vital and the remaining are all rated Essential in severity.
“The 11-month streak of patching at the least one zero-day that was exploited within the wild ended this month,” Satnam Narang, Senior Employees Analysis Engineer at Tenable, mentioned.
Fifty-three of those shortcomings are categorized as privilege escalation bugs adopted by 42 as distant code execution, 17 as info disclosure, and eight as security function bypasses. These patches are along with two different flaws addressed by the corporate within the Edge browser because the launch of final month’s Patch Tuesday replace.
The vulnerability that is listed as publicly identified is an info disclosure flaw in Microsoft SQL Server (CVE-2025-49719, CVSS rating: 7.5) that might allow an unauthorized attacker to leak uninitialized reminiscence.
“An attacker may nicely be taught nothing of any worth, however with luck, persistence, or some very artful massaging of the exploit, the prize could possibly be cryptographic key materials or different crown jewels from the SQL Server,” Adam Barnett, Lead Software program Engineer at Rapid7, mentioned in a press release.
Mike Walters, President and Co-Founding father of Action1, mentioned the flaw probably is the results of improper enter validation in SQL Server’s reminiscence administration, permitting entry to uninitialized reminiscence.
“Because of this, attackers may retrieve remnants of delicate knowledge, corresponding to credentials or connection strings,” Walters added. “It impacts each the SQL Server engine and purposes utilizing OLE DB drivers.”
Essentially the most important flaw patched by Microsoft as a part of this month’s updates issues a case of distant code execution impacting SPNEGO Prolonged Negotiation (NEGOEX). Tracked as CVE-2025-47981, it carries a CVSS rating of 9.8 out of 10.0.
“Heap-based buffer overflow in Home windows SPNEGO Prolonged Negotiation permits an unauthorized attacker to execute code over a community,” Microsoft mentioned in an advisory. “An attacker may exploit this vulnerability by sending a malicious message to the server, probably resulting in distant code execution.”
An nameless researcher and Yuki Chen have been credited with discovering and repairing the flaw. Microsoft famous that the problem solely impacts Home windows shopper machines operating Home windows 10, model 1607 and above because of the “Community security: Permit PKU2U authentication requests to this laptop to make use of on-line identities” Group Coverage Object (GPO) being enabled by default.
“As at all times, Distant Code Execution is unhealthy, however early evaluation is suggesting that this vulnerability could also be ‘wormable’ – the kind of vulnerability that could possibly be leveraged in self-propagating malware and make many revisit trauma from the WannaCry incident,” watchTowr founder and CEO Benjamin Harris mentioned.
“Microsoft is obvious on pre-requisites right here: no authentication required, simply community entry, and Microsoft themselves imagine exploitation is ‘Extra Doubtless.’ We should not idiot ourselves – if the personal trade has seen this vulnerability, it’s actually already on the radar of each attacker with an oz of malice. Defenders must drop every part, patch quickly, and seek out uncovered methods.”
Different vulnerabilities of significance embody distant code execution flaws impacting Home windows KDC Proxy Service (CVE-2025-49735, CVSS rating: 8.1), Home windows Hyper-V (CVE-2025-48822, CVSS rating: 8.6), and Microsoft Workplace (CVE-2025-49695, CVE-2025-496966, and CVE-2025-49697, CVSS scores: 8.4).
“What makes CVE-2025-49735 important is the community publicity mixed with no required privileges or consumer interplay. Regardless of its excessive assault complexity, the vulnerability opens the door to pre-auth distant compromise, notably engaging to APTs and nation-state actors,” Ben McCarthy, Lead Cyber Safety Engineer at Immersive, mentioned.
“The attacker should win a race situation – a timing flaw the place reminiscence is freed and reallocated in a selected window – that means reliability is low for now. Nonetheless, such points will be weaponized with strategies like heap grooming, making eventual exploitation possible.”
Elsewhere, the replace closes out 5 security function bypasses in Bitlocker (CVE-2025-48001, CVE-2025-48003, CVE-2025-48800, CVE-2025-48804, and CVE-2025-48818, CVSS scores: 6.8) that might enable an attacker with bodily entry the machine to pay money for encrypted knowledge.
“An attacker may exploit this vulnerability by loading a WinRE.wim file whereas the OS quantity is unlocked, granting entry to BitLocker encrypted knowledge,” Microsoft mentioned about CVE-2025-48804.
Researchers Netanel Ben Simon and Alon Leviev with Microsoft Offensive Analysis and Safety Engineering (MORSE) have been acknowledged for reporting the 5 points within the built-in disk encryption software.
“If exploited, these flaws may expose delicate recordsdata, credentials, or enable tampering with system integrity,” Jacob Ashdown, Cyber Safety Engineer at Immersive, mentioned. “This poses a specific threat, particularly for organizations the place gadgets could also be misplaced or stolen, as attackers with hands-on entry may probably bypass encryption and extract delicate knowledge.”
It is also price noting that July 8, 2025, formally marks the tip of the highway for SQL Server 2012, which can now not obtain any future security patches within the checklist of the Prolonged Safety Replace (ESU) program coming to an in depth.
Software program Patches from Different Distributors
Along with Microsoft, security updates have additionally been launched by different distributors over the previous couple of weeks to rectify a number of vulnerabilities, together with —
- Adobe
- AMD
- Atlassian
- Bitdefender
- Broadcom (together with VMware)
- Cisco
- Citrix
- D-Hyperlink
- Dell
- Drupal
- F5
- Fortinet
- Fortra
- Gigabyte
- GitLab
- Google Chrome
- Google Cloud
- Grafana
- Hikvision
- Hitachi Vitality
- HP
- HP Enterprise (together with Aruba Networking)
- IBM
- Intel
- Ivanti
- Jenkins
- Juniper Networks
- Lenovo
- Linux distributions AlmaLinux, Alpine Linux, Amazon Linux, Arch Linux, Debian, Gentoo, Oracle Linux, Mageia, Crimson Hat, Rocky Linux, SUSE, and Ubuntu
- MediaTek
- Mitsubishi Electrical
- MongoDB
- Moxa
- Mozilla Thunderbird
- NVIDIA
- OPPO
- Palo Alto Networks
- Progress Software program
- Qualcomm
- Ricoh
- Rsync
- Ruckus Wi-fi
- Samsung
- SAP
- Schneider Electrical
- Siemens
- Splunk
- Supermicro
- Veeam
- WordPress
- Zimbra, and
- Zoom
