Microsoft's September 2025 Patch Tuesday patches 81 vulnerabilities, 13 critical, two publicly disclosed

Microsoft has released its September 2025 Patch Tuesday security updates, addressing 81 security vulnerabilities. This patch fixes critical flaws in Windows operating systems, Microsoft Office applications, Azure cloud services, SQL Server, and other enterprise software components. 

Zero-day vulnerabilities that were publicly disclosed before official patches became available:

• CVE-2025-55234 - Windows SMB Elevation of Privilege Vulnerability. This flaw enables attackers to perform authentication relay attacks by exploiting improper validation in SMB sessions when SMB signing and Extended Protection for Authentication are not correctly configured. The vulnerability allows unauthenticated attackers to elevate privileges through man-in-the-middle relay attacks, potentially compromising user credentials and gaining unauthorized network access.
• CVE-2024-21907 - Improper Handling of Exceptional Conditions in Newtonsoft.Json. It affects Microsoft SQL Server through a vulnerability in the included Newtonsoft.Json library. This vulnerability addresses mishandling of exceptional conditions in Newtonsoft.Json before version 13.0.1, where crafted data passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service

Critical vulnerabilities

• CVE-2025-55236 - Graphics Kernel Remote Code Execution Vulnerability
• CVE-2025-55226 - Graphics Kernel Remote Code Execution Vulnerability
• CVE-2025-55228 - Windows Graphics Component Remote Code Execution Vulnerability
• CVE-2025-54910 - Microsoft Office Remote Code Execution Vulnerability
• CVE-2025-55224 - Windows Hyper-V Remote Code Execution Vulnerability
• CVE-2025-54914 - Azure Networking Elevation of Privilege Vulnerability
• CVE-2025-55244 - Azure Bot Service Elevation of Privilege Vulnerability
• CVE-2025-55241 - Azure Entra Elevation of Privilege Vulnerability
• CVE-2025-53800 - Windows Graphics Component Elevation of Privilege Vulnerability
• CVE-2025-54918 - Windows NTLM Elevation of Privilege Vulnerability
• CVE-2025-55238 - Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
• CVE-2025-53799 - Windows Imaging Component Information Disclosure Vulnerability
• CVE-2025-55242 - Xbox Certification Bug Copilot Djando Information Disclosure Vulnerability

Other patches in the Microsoft's September 2025 Patch Tuesday are of 68 "Important" severity vulnerabilities spanning multiple product categories. The largest segment involved elevation of privilege flaws affecting core Windows components, Windows Defender Firewall Service, Windows Hyper-V virtualization platform, Windows Routing and Remote Access Service (RRAS), and various kernel-mode drivers. Remote code execution vulnerabilities were addressed in Windows NTFS file system, multiple Microsoft Office applications including PowerPoint and Visio, and Windows SMBv3 Client. The update also included important information disclosure flaws affecting Windows kernel components, Local Security Authority Subsystem Service (LSASS), and various Windows networking services that could potentially leak sensitive system information to attackers.

Full patch list