Microsoft Patch Tuesday September 2025: 81 Vulnerabilities Fixed

Microsoft has released its September 2025 Patch Tuesday updates , addressing a total of 81 security across vulnerabilities its products. The security updates cover a variety of software, including Windows, Microsoft Office, Azure , and SQL Server.

Among the fixes are 22 vulnerabilities that could allow remote code execution (RCE), making this update important for system administrators. Of the 81 vulnerabilities, 8 are rated Critical, while the remaining 73 are rated Important.

The vulnerabilities cover several categories, with Remote Code Execution (RCE), Elevation of Privilege (EoP), and Information Disclosure being the most common types in this month's release.

See also: Adobe Commerce bug allows account takeover

Patch Tuesday: RCE vulnerabilities

Critical RCE vulnerabilities could allow attackers to execute arbitrary code on affected systems. Among the most serious are those found in the Graphics Kernel (CVE-2025-55226, CVE-2025-55236) and the Windows Graphics Component (CVE-2025-55228).

Microsoft Office also received a critical fix for a heap-based buffer overflow vulnerability (CVE-2025-54910) that could allow local code execution. In addition, a critical RCE vulnerability in Windows Hyper-V (CVE-2025-55224) was fixed. This flaw, which results from a race condition, could allow a local attacker to execute arbitrary code. These types of vulnerabilities are particularly dangerous because they can often be used for initial access or lateral movement within a network.

Privilege Elevation

A significant portion of the September update is dedicated to fixing Elevation of Privilege in the Windows ecosystem. A critical EoP vulnerability in Windows NTLM (CVE-2025-54918) could allow an authorized attacker to elevate their privileges over the network. Other significant EoP vulnerabilities were fixed in PowerShell Direct (CVE-2025-49734), Windows Ancillary Function Driver for WinSock (CVE-2025-54099) , and Windows Kernel (CVE-2025-54110).

Disclosure of information

The update also addresses numerous information disclosure, particularly in the Windows Routing and Remote Access Service (RRAS), with six different CVEs (CVE-2025-53797, CVE-2025-53798, CVE-2025-54095, CVE-2025-54096, CVE-2025-54097, CVE-2025-55225) related to buffer over-read and out-of-bounds read issues. While not as severe as RCEs, these vulnerabilities can leak sensitive memory information that helps attackers create more complex exploits.

See also: Critical vulnerabilities in Ivanti Endpoint Manager allow RCE

Microsoft Patch Tuesday: Other fixes

Beyond the core operating system, Microsoft has patched critical and important vulnerabilities in its enterprise and productivity software. A critical RCE vulnerability in Microsoft SharePoint (CVE-2025-54897), which could be exploited by an authorized attacker over the network via deserialization of untrusted data.

Microsoft Excel has received a set of fixes for seven different RCE vulnerabilities (CVE-2025-54896, CVE-2025-54898, CVE-2025-54899, CVE-2025-54900, CVE-2025-54902, CVE-2025-54903, CVE-2025-54904). These vulnerabilities (mainly use-after-free and out-of-bounds read issues) allow an attacker to execute code locally if a user opens a specially crafted file.

Several Elevation of Privilege vulnerabilities were also fixed in Azure, including Azure Arc (CVE-2025-55316) and Azure Connected Machine Agent (CVE-2025-49692).

Microsoft urges all customers to immediately apply the September 2025 Patch Tuesday to protect their systems from potential exploitation. Administrators should prioritize patching critical RCE and Elevation of Privilege vulnerabilities to mitigate the most severe risks.

See also: SessionReaper vulnerability threatens thousands of online stores

Of the 81 vulnerabilities addressed in Microsoft's update, none were reported as zero-day.