Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs

Microsoft released a Patch Tuesday bundle addressing 80 security flaws across its software, eight rated Critical and 72 Important, with notable attention on privilege escalation and SMB-related issues. Among the disclosures, CVE-2025-55234, an SMB privilege escalation flaw with a CVSS of 8.8, has been publicly flagged, and Microsoft said SMB Server could be susceptible to relay attacks depending on configuration.

The vulnerability with the highest CVSS this month is CVE-2025-54914 (CVSS 10.0), a cloud-related privilege escalation impacting Azure Networking, which requires no customer action. The update also patches a remote code execution flaw in HPC Pack (CVE-2025-55232, CVSS 9.8) and a Windows NTLM elevation issue (CVE-2025-54918, CVSS 8.8) that could allow SYSTEM privileges, according to quoted experts.

As part of the patch notes, Microsoft notes auditing enhancements for SMB signing and EPA to help administrators assess environments before hardening, a point echoed by Adam Barnett of Rapid7 and by STORM researchers Netanel Ben Simon and Alon Leviev.