Microsoft September 2025 Patch Tuesday – 81 Vulnerabilities and 2 Zero Days Fixed

Microsoft’s September 2025 Patch Tuesday fixes 81 security vulnerabilities across its product portfolio, including two zero-day flaws that are actively being exploited, with 10 rated Critical and 71 rated Important. The updates cover Windows, Microsoft Office, Azure, SQL Server, and Windows Defender.

This month’s zero-days include CVE-2025-55234, an Elevation of Privilege in the Windows SMB protocol, and CVE-2024-21907, a denial-of-service flaw in Newtonsoft.Json that can affect SQL Server installations using the library; according to Microsoft, an attacker could gain elevated privileges or crash the affected application remotely.

Critical remote code execution and privilege escalation bugs also feature prominently, including several in the Windows Graphics Kernel and Windows Graphics Component (CVE-2025-55226, CVE-2025-55228, CVE-2025-55236), a heap-based overflow in Microsoft Office (CVE-2025-54910), a race condition in Windows Hyper-V (CVE-2025-55224), and a critical NTLM Elevation of Privilege (CVE-2025-54918).

None of the addressed flaws were publicly disclosed or actively exploited at the time, and administrators are urged to review the release and apply updates promptly.