September 2025 Patch Tuesday: 2 Zero-Days (CVE-2025-55234 & CVE-2024-21907), 81 Microsoft Flaws

September 2025 Patch Tuesday fixes two publicly disclosed zero-days and 81 Microsoft flaws, including CVE-2025-55234 and CVE-2024-21907. According to SOCRadar, CVE-2025-55234 is a privilege escalation flaw in the Windows SMB protocol that can be exploited via relay attacks, while CVE-2024-21907 is a DoS issue in Newtonsoft.Json used by SQL Server and other .NET applications.

The article notes eight vulnerabilities are rated as Critical, affecting components such as NTLM, Office, Hyper-V and various Windows graphics subsystems. In addition to the Microsoft fixes, SAP published patches for NetWeaver and S/4HANA, highlighting CVE-2025-42944 (CVSS 10.0) which could allow unauthenticated remote command execution, alongside other high-severity SAP CVEs.

The piece also flags vulnerabilities deemed more likely to be exploited, including several Windows kernel and Hyper-V flaws, and urges rapid patching and continued visibility into exposed assets via ASM. It emphasises prioritising updates for high-exploitability flaws and notes that Microsoft republished five non-Microsoft CVEs this month.