Microsoft Patch Tuesday security updates for September 2025 fixed two zero-day flaws

Microsoft Patch Tuesday for September 2025 fixed 80 vulnerabilities across Windows and components, Office, Edge, Azure, Hyper-V, SQL Server, Defender Firewall Service and Xbox. The updates include two publicly disclosed zero-day flaws, CVE-2025-55234 (CVSS 8.8) and CVE-2024-21907 (CVSS 7.5), neither of which has been actively exploited in the wild.

CVE-2025-55232, rated CVSS 9.8, is a Microsoft HPC Pack Remote Code Execution Vulnerability that could allow remote, unauthenticated code execution and potentially be wormable; Microsoft urges securing HPC clusters, blocking TCP port 5999, and prioritising patching.

CVE-2025-55234 affects Windows SMB Server, enabling relay attacks that could escalate privileges, with Windows guidance to enable SMB signing and EPA, though legacy compatibility issues may arise and auditing features have been added in the September 2025 updates. CVE-2024-21907, disclosed in 2024, affects Newtonsoft.Json in SQL Server and could trigger a StackOverflow and denial of service, now fixed in updated libraries.