EoP Flaws Again Lead Microsoft Patch Day

In September 2025, Microsoft’s monthly security update again saw elevation of privilege (EoP) bugs outnumbering other vulnerability types, with 81 unique CVEs disclosed across its product portfolio. According to Microsoft, 38 of these vulnerabilities enable attackers to escalate privileges after gaining initial access. The update includes a publicly disclosed EoP flaw in Windows Server Message Block (SMB), CVE-2025-55234, rated CVSS 8.8, which can be exploited to escalate privileges via SMB relay attacks.

Two other high-priority EoP flaws are CVE-2025-54918 in NTLM, also CVSS 8.8, and two additional CVEs in the Windows UI XAML area (CVE-2025-54111 and CVE-2025-54913). On the RCE front, CVE-2025-55232 in the HPC Pack carries a CVSS score of 9.8, while CVE-2025-54916 in Windows NTFS is CVSS 7.8 and can be triggered by authenticated users. Microsoft noted that none of the disclosed CVEs were actively exploited at the time, with some vulnerabilities remaining a priority for risk reduction.