Microsoft July 2025 Security Updates

NICK_ADSL_UK

This release consists of the following 130 Microsoft CVEs:
Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?

https://msrc.microsoft.com/update-guide/releaseNote/2025-Jul

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 11, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-49717
Title: Microsoft SQL Server Remote Code Execution Vulnerability
Version: 1.2
Reason for revision: Updated the severity of the products in the Security Updates table. This is an informational change only.
Originally released: July 8, 2025
Last updated: July 11, 2025
Aggregate CVE severity rating: Important
Customer action required: Yes

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 15, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-49735
Title: Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
Version: 1.1
Reason for revision: Information published. This CVE was addressed by updates that were released in June 2025, but the CVE was inadvertently omitted from the June 2025 Security Updates. This is an informational change only. Customers who have already installed the June 2025 updates do not need to take any further action.
Originally released: July 8, 2025
Last updated: July 14, 2025
Aggregate CVE severity rating: Critical
Customer action required: Yes

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 16, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2024-29187
Title: GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
Version: 6.0
Reason for revision: In the Security Updates table, added Windows HLK, Version 1607 because this developer kits is also affected by this vulnerability. Microsoft strongly recommends that customers using Windows HLK, Version 1607 install the update to be fully protected from the vulnerability. See the FAQs section of this vulnerability for more information.
Originally released: June 11, 2024
Last updated: July 15, 2025
Aggregate CVE severity rating: Important
Customer action required: Yes
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29187

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 16, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2024-36350
Title: AMD: CVE-2024-36350 Transient Scheduler Attack in Store Queue
Version: 1.1
Reason for revision: Corrected CVE number. This is an informational change only.
Originally released: July 8, 2025
Last updated: July 16, 2025
Aggregate CVE severity rating: Important
Customer action required: Yes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-36350

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 18, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-47158
Title: Azure DevOps Server Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: July 18, 2025
Last updated: July 18, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-47995
Title: Azure Machine Learning Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: July 18, 2025
Last updated: July 18, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-49735
Title: Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
Version: 1.3
Reason for revision: Corrected Download and Article links in the Security Updates table. This is an informational change only.
Originally released: July 8, 2025
Last updated: July 17, 2025
Aggregate CVE severity rating: Critical
Customer action required: Yes

CVE-2025-49746
Title: Azure Machine Learning Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: July 18, 2025
Last updated: July 18, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-49747
Title: Azure Machine Learning Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: July 18, 2025
Last updated: July 18, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-53762
Title: Microsoft Purview Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: July 18, 2025
Last updated: July 18, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 20, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-53770
Title: Microsoft SharePoint Server Remote Code Execution Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: July 19, 2025
Last updated: July 19, 2025
Aggregate CVE severity rating: Critical
Customer action required: Yes

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 21, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-53770
Title: Microsoft SharePoint Server Remote Code Execution Vulnerability
Version: 3.0
Reason for revision: The security update is avaialble for Microsoft SharePoint Server 2019. Microsoft strongly encourages customers running this version of SharePoint to install this update as soon as possible.
Originally released: July 19, 2025
Last updated: July 20, 2025
Aggregate CVE severity rating: Critical
Customer action required: Yes

CVE-2025-53771
Title: Microsoft SharePoint Server Spoofing Vulnerability
Version: 2.0
Reason for revision: The security update is avaialble for Microsoft SharePoint Server 2019. Microsoft strongly encourages customers running this version of SharePoint to install this update as soon as possible.
Originally released: July 20, 2025
Last updated: July 20, 2025
Aggregate CVE severity rating: Important
Customer action required: Yes

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 21, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

antdude

So many CVEs even on the weekend. 😮

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 22, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2022-41089
Title: .NET Framework Remote Code Execution Vulnerability
Version: 3.0
Reason for revision: To address a known issue when after installing the December 13, 2022, updates for .NET Framework and .NET, users may have experienced issues with how WPF-based applications render XPS documents, Microsoft has released the June 2023 security updates for .NET Framework and for .NET. We recommend that customers install the June 2023 updates. Please note that if you used any workaround or mitigations for this issue, they are no longer needed, and we recommend you remove them. To remove either of the workarounds see the instructions for removal in the “Alternative Workaround” section of KB5022083 Change in how WPF-based applications render XPS documents.
Originally released: December 13, 2022
Last updated: June 30, 2023
Aggregate CVE severity rating: Important
Customer action required: Yes

CVE-2022-47211
Title: Microsoft Office Graphics Remote Code Execution Vulnerability
Version: 1.2
Reason for revision: Added FAQ information. This is an informational change only.
Originally released: December 13, 2022
Last updated: March 23, 2023
Aggregate CVE severity rating: Important
Customer action required: Yes

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
July 25, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2024-36357
Title: AMD: CVE-2025-36357 Transient Scheduler Attack in L1 Data Queue
Version: 1.1
Reason for revision: Corrected CVE number. This is an informational change only.
Originally released: July 8, 2025
Last updated: July 23, 2025
Aggregate CVE severity rating: Important
Customer action required: Yes

px_eliezer_

On multiple machines (both Win 10 and Win 11) these current updates have taken HOURS even with good wired connections.

Much longer than usual.

redwolfe_98

px_eliezer_ for the past few months, i have noticed times when the updates were very slow to download. i have heard others mention experiencing slow downloads, too, on occasion. i think there is a problem with one-or-more of microsoft’s servers.

px_eliezer_

redwolfe_98 i think there is a problem with one-or-more of microsoft’s servers.

Maybe servers are busier because:

1) Windows 10 people who can’t go to Windows 11, or who choose not to, are trying to grab updates while they still can.

2) Likewise, busy with Windows 10 people who ARE trying to do the upgrade to Windows 11 as the end of support approaches.

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
August 6, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-53786
Title: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: August 6, 2025
Last updated: August 6, 2025
Aggregate CVE severity rating: Important
Customer action required: Yes

NICK_ADSL_UK

CVEs have been published or revised in the Security Update Guide
August 7, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-53767
Title: Azure OpenAI Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: August 7, 2025
Last updated: August 7, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-53774
Title: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: August 7, 2025
Last updated: August 7, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-53787
Title: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: August 7, 2025
Last updated: August 7, 2025
Aggregate CVE severity rating: Critical
Customer action required: No

CVE-2025-53792
Title: Azure Portal Elevation of Privilege Vulnerability
Version: 1.0
Reason for revision: Information published.
Originally released: August 7, 2025
Last updated: August 7, 2025
Aggregate CVE severity rating: Critical
Customer action required: No