Microsoft Releases September 2025 Patch Tuesday Updates

Key Takeaways:

Microsoft patched 80 security flaws across Windows, Office, Azure, and more.
Several critical vulnerabilities were addressed, including remote code execution risks.
Important changes are coming in October that organizations must prepare for.

Microsoft has released the September 2025 Patch Tuesday updates for Windows 11 and Windows 10. This month, the company has fixed 80 vulnerabilities in Windows, Office, Microsoft Edge, Azure, Hyper-V, and other components.

This month’s Patch Tuesday serves as a reminder for organizations to prepare for two key changes coming in October: the end-of-support for Windows 10 and the next phase of mandatory multifactor authentication (MFA) for Azure. Security teams should begin planning now, and those unable to complete their Windows 10 migration in time should consider enrolling in Microsoft’s Extended Security Updates program.

September 2025 Patch Tuesday updates fix 80 vulnerabilities

As noted by the Zero Day Initiative, Microsoft has fixed eight critical vulnerabilities, while the rest are rated as important. Fortunately, none of these flaws is currently being actively exploited. Here’s a look at some of the most important vulnerabilities patched this month:

CVE-2025-55234: This is a zero-day EoP vulnerability in Windows Server Message Block (SMB) that could be exploited by an attacker to gain the privileges of the legitimate user. This bug enables hackers to launch SMB relay attacks to escalate privileges on the target system.
CVE-2024-21907: This is a high-severity flaw affecting the popular .NET library Newtonsoft.Json (also known as Json.NET), specifically versions prior to 13.0.1. This vulnerability could be exploited to cause resource exhaustion (CPU/RAM) or a complete service outage.
CVE-2025-55232: This is an RCE vulnerability in the Microsoft High Performance Compute (HPC) Pack. This flaw could allow remote code execution over the enterprise network.
CVE-2025-54916: This is another remote code execution vulnerability in Windows NTFS. It could be triggered by an unauthenticated user from a local machine.
CVE-2025-54910: This is a critical remote code execution vulnerability in Microsoft Office. An attacker can exploit this flaw by crafting a malicious Office document that, when opened, causes memory corruption and enables code execution.

You can find the full list of CVEs for September 2025 below:

Tag	CVE	Base Score	Exploitability	FAQs?	Workarounds?	Mitigations?
SQL Server	CVE-2025-47997	6.5	Exploitation Less Likely	Yes	No	No
Azure Windows Virtual Machine Agent	CVE-2025-49692	7.8	Exploitation Unlikely	Yes	No	No
Windows PowerShell	CVE-2025-49734	7	Exploitation Less Likely	Yes	No	No
Microsoft Edge (Chromium-based)	CVE-2025-53791	4.7	Exploitation Less Likely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-53796	6.5	Exploitation Unlikely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-53797	6.5	Exploitation Unlikely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-53798	6.5	Exploitation Unlikely	Yes	No	No
Windows Imaging Component	CVE-2025-53799	5.5	Exploitation Unlikely	Yes	No	No
Microsoft Graphics Component	CVE-2025-53800	7.8	Exploitation Less Likely	Yes	No	No
Windows DWM	CVE-2025-53801	7.8	Exploitation Less Likely	Yes	No	No
Windows Bluetooth Service	CVE-2025-53802	7	Exploitation Less Likely	Yes	No	No
Windows Kernel	CVE-2025-53803	5.5	Exploitation More Likely	Yes	No	No
Windows Kernel	CVE-2025-53804	5.5	Exploitation More Likely	Yes	No	No
Windows Internet Information Services	CVE-2025-53805	7.5	Exploitation Unlikely	No	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-53806	6.5	Exploitation Unlikely	Yes	No	No
Microsoft Graphics Component	CVE-2025-53807	7	Exploitation Less Likely	Yes	No	No
Windows Defender Firewall Service	CVE-2025-53808	6.7	Exploitation Less Likely	Yes	No	No
Windows Local Security Authority Subsystem Service (LSASS)	CVE-2025-53809	6.5	Exploitation Less Likely	No	No	No
Windows Defender Firewall Service	CVE-2025-53810	6.7	Exploitation Less Likely	Yes	No	No
Role: Windows Hyper-V	CVE-2025-54091	7.8	Exploitation Less Likely	Yes	No	No
Role: Windows Hyper-V	CVE-2025-54092	7.8	Exploitation Less Likely	Yes	No	No
Windows TCP/IP	CVE-2025-54093	7	Exploitation More Likely	Yes	No	No
Windows Defender Firewall Service	CVE-2025-54094	6.7	Exploitation Unlikely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-54095	6.5	Exploitation Unlikely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-54096	6.5	Exploitation Unlikely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-54097	6.5	Exploitation Unlikely	Yes	No	No
Role: Windows Hyper-V	CVE-2025-54098	7.8	Exploitation More Likely	Yes	No	No
Windows Ancillary Function Driver for WinSock	CVE-2025-54099	7	Exploitation Less Likely	Yes	No	No
Windows SMBv3 Client	CVE-2025-54101	4.8	Exploitation Less Likely	Yes	No	No
Windows Connected Devices Platform Service	CVE-2025-54102	7.8	Exploitation Less Likely	Yes	No	No
Windows Management Services	CVE-2025-54103	7.4	Exploitation Less Likely	Yes	No	No
Windows Defender Firewall Service	CVE-2025-54104	6.7	Exploitation Less Likely	Yes	No	No
Microsoft Brokering File System	CVE-2025-54105	7	Exploitation Less Likely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-54106	8.8	Exploitation Less Likely	Yes	No	No
Windows MapUrlToZone	CVE-2025-54107	4.3	Exploitation Less Likely	Yes	No	No
Capability Access Management Service (camsvc)	CVE-2025-54108	7	Exploitation Unlikely	Yes	No	No
Windows Defender Firewall Service	CVE-2025-54109	6.7	Exploitation Less Likely	Yes	No	No
Windows Kernel	CVE-2025-54110	8.8	Exploitation More Likely	Yes	No	No
Windows UI XAML Phone DatePickerFlyout	CVE-2025-54111	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Virtual Hard Drive	CVE-2025-54112	7	Exploitation Unlikely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-54113	8.8	Exploitation Unlikely	Yes	No	No
Windows Connected Devices Platform Service	CVE-2025-54114	7	Exploitation Less Likely	Yes	No	No
Role: Windows Hyper-V	CVE-2025-54115	7	Exploitation Less Likely	Yes	No	No
Windows MultiPoint Services	CVE-2025-54116	7.3	Exploitation Unlikely	Yes	No	No
Windows Local Security Authority Subsystem Service (LSASS)	CVE-2025-54894	7.8	Exploitation Less Likely	Yes	No	No
Windows SPNEGO Extended Negotiation	CVE-2025-54895	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Excel	CVE-2025-54896	7.8	Exploitation Unlikely	Yes	No	No
Microsoft Office SharePoint	CVE-2025-54897	8.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Excel	CVE-2025-54898	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Excel	CVE-2025-54899	7.8	Exploitation Unlikely	Yes	No	No
Microsoft Office Excel	CVE-2025-54900	7.8	Exploitation Unlikely	Yes	No	No
Microsoft Office Excel	CVE-2025-54901	5.5	Exploitation Less Likely	Yes	No	No
Microsoft Office Excel	CVE-2025-54902	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Excel	CVE-2025-54903	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Excel	CVE-2025-54904	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Word	CVE-2025-54905	7.1	Exploitation Less Likely	Yes	No	No
Microsoft Office	CVE-2025-54906	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office Visio	CVE-2025-54907	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office PowerPoint	CVE-2025-54908	7.8	Exploitation Less Likely	Yes	No	No
Microsoft Office	CVE-2025-54910	8.4	Exploitation Less Likely	Yes	No	No
Windows BitLocker	CVE-2025-54911	7.3	Exploitation Less Likely	Yes	No	No
Windows BitLocker	CVE-2025-54912	7.8	Exploitation Less Likely	No	No	No
Windows UI XAML Maps MapControlSettings	CVE-2025-54913	7.8	Exploitation Unlikely	Yes	No	No
Windows Defender Firewall Service	CVE-2025-54915	6.7	Exploitation Unlikely	Yes	No	No
Windows NTFS	CVE-2025-54916	7.8	Exploitation More Likely	Yes	No	No
Windows MapUrlToZone	CVE-2025-54917	4.3	Exploitation Less Likely	Yes	No	No
Windows NTLM	CVE-2025-54918	8.8	Exploitation More Likely	Yes	No	No
Windows Win32K – GRFX	CVE-2025-54919	7.5	Exploitation Less Likely	Yes	No	No
Graphics Kernel	CVE-2025-55223	7	Exploitation Less Likely	Yes	No	No
Windows Win32K – GRFX	CVE-2025-55224	7.8	Exploitation Less Likely	Yes	No	No
Windows Routing and Remote Access Service (RRAS)	CVE-2025-55225	6.5	Exploitation Less Likely	Yes	No	No
Graphics Kernel	CVE-2025-55226	6.7	Exploitation Less Likely	Yes	No	No
SQL Server	CVE-2025-55227	8.8	Exploitation Less Likely	Yes	No	No
Windows Win32K – GRFX	CVE-2025-55228	7.8	Exploitation Less Likely	Yes	No	No
Microsoft High Performance Compute Pack (HPC)	CVE-2025-55232	9.8	Exploitation Less Likely	Yes	No	Yes
Windows SMB	CVE-2025-55234	8.8	Exploitation More Likely	Yes	No	No
Graphics Kernel	CVE-2025-55236	7.3	Exploitation Less Likely	Yes	No	No
Microsoft Office	CVE-2025-55243	7.5	Exploitation Less Likely	No	No	No
Xbox	CVE-2025-55245	7.8	Exploitation Less Likely	Yes	No	No
Azure Arc	CVE-2025-55316	7.8	Exploitation Unlikely	Yes	No	No
Microsoft AutoUpdate (MAU)	CVE-2025-55317	7.8	Exploitation Unlikely	Yes	No	No

Quality and experience updates

Microsoft has released the KB5065431 and KB5065426 updates for Windows 11 versions 23H2 and 24H2, respectively. The KB5065431 patch brings several new capabilities for Copilot+ PCs, including Windows Recall enhancements, Click to Do improvements, and support for Agent in Settings for AMD and Intel-powered Copilot+ PCs.

Additionally, Microsoft has fixed an issue that caused non-admin users to encounter unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These updates also add auditing capabilities to help organizations detect devices or software that may not be compatible with SMB Server signing or Extended Protection for Authentication (EPA).

On Windows 10, the KB5065429 patch brings stability fixes, accessibility improvements, and two new features for enterprise customers. Microsoft has added a new networking control that lets organizations block outbound traffic for the keyless Commercial ESU solution. This capability allows administrators to enhance security and compliance in managed environments. This update also introduces Windows Backup for Organizations, which is a cloud-based enterprise feature designed to simplify device transitions.

Windows Update testing and best practices

Organizations looking to deploy this month’s patches should conduct thorough testing before deploying them widely on production systems. That said, applying the patches widely shouldn’t be delayed longer than necessary as hackers start to work out how to weaponize newly reported vulnerabilities.

A best practice is to make sure you have backed up systems before applying updates. Every month, users experience issues with Windows updates that lead to systems not booting, application and hardware compatibility issues, or even data loss in extreme cases.

There are backup tools built into Windows and Windows Server that you can use to restore systems in the event a patch causes a problem. The backup features in Windows can be used to restore an entire system, or files and folders on a granular basis.

Rabia Noureen News Editor

Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...

Microsoft Releases September 2025 Patch Tuesday Updates With Critical Bug Fixes

September 2025 Patch Tuesday updates fix 80 vulnerabilities

Quality and experience updates

Windows Update testing and best practices

SHARE ARTICLE

Related Articles