Skip to main content

Microsoft Releases September 2025 Security Updates

Scheduled updates for Microsoft products address 81 vulnerabilities, of which two have been reported as publicly disclosed

Threat ID:
CC-4698
Threat Severity:
Medium
Published:
10 September 2025 10:13 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Scheduled updates for Microsoft products address 81 vulnerabilities, of which two have been reported as publicly disclosed

The following platforms are also known to be affected:

39 other Microsoft platforms

Threat details

Windows 10 Approaching End-of-Support

From October 2025, Microsoft will no longer provide updates, including security patches, for Windows 10 systems.

To ensure the continued security and efficiency of NHS digital systems, as well as protect patient data, all NHS Trusts and Integrated Care Boards (ICBs) must transition to Windows 11.

For more details please visit the Windows 10 end of support October 2025 page.

Introduction

Microsoft has released security updates to address 81 vulnerabilities in 43 Microsoft products. 14 vulnerabilities are highlighted below, of which 2 are publicly disclosed.

Publicly disclosed exploits for CVE-2025-55234 and CVE-2024-21907

Microsoft has reported CVE-2025-55234 and CVE-2024-21907 as publicly disclosed, suggesting technical details or a proof-of-concept exploit are available.

The NHS England National CSOC assesses future exploitation of these vulnerabilities as more likely.

Vulnerability details

Publicly disclosed vulnerabilities:

  • CVE-2025-55234 - Windows SMB Elevation of Privilege Vulnerability - CVSSv3 score: 8.8
  • CVE-2024-21907 - Improper Handling of Exceptional Conditions in Newtonsoft.Json (affecting Microsoft SQL Server) - CVSSv3 score: 7.5

12 other vulnerabilities considered critical by Microsoft:

  • CVE-2025-54914 - Azure Networking Elevation of Privilege Vulnerability - CVSSv3 score: 10.0
  • CVE-2025-55244 - Azure Bot Service Elevation of Privilege Vulnerability - CVSSv3 score: 9.0
  • CVE-2025-55241 - Azure Entra Elevation of Privilege Vulnerability - CVSSv3 score: 9.0
  • CVE-2025-54918 - Windows NTLM Elevation of Privilege Vulnerability - CVSSv3 score: 8.8
  • CVE-2025-54910 - Microsoft Office Remote Code Execution Vulnerability - CVSSv3 score: 8.4
  • CVE-2025-55224 - Windows Hyper-V Remote Code Execution Vulnerability - CVSSv3 score: 7.8
  • CVE-2025-55228 - Windows Graphics Component Remote Code Execution Vulnerability - CVSSv3 score: 7.8
  • CVE-2025-53800 - Windows Graphics Component Elevation of Privilege Vulnerability - CVSSv3 score: 7.8
  • CVE-2025-55238 - Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability - CVSSv3 score: 7.5
  • CVE-2025-55236 - Graphics Kernel Remote Code Execution Vulnerability - CVSSv3 score: 7.3
  • CVE-2025-55226 - Graphics Kernel Remote Code Execution Vulnerability - CVSSv3 score: 6.7
  • CVE-2025-53799 - Windows Imaging Component Information Disclosure Vulnerability - CVSSv3 score: 5.1

Remediation advice

Affected organisations are encouraged to review Microsoft's September 2025 Security Updates and apply the relevant updates as soon as possible.

CVE Vulnerabilities

Status Published

CVE-2025-55234

SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. The SMB Server already supports mechanisms for hardening against relay attacks: SMB Server signing SMB Server Extended Protection for Authentication (EPA) Microsoft is releasing this CVE to provide customers with audit capabilities to help them to assess their environment and to identify any potential device or software incompatibility issues before deploying SMB Server hardening measures that protect against relay attacks. If you have not already enabled SMB Server hardening measures, we advise customers to take the following actions to be protected from these relay attacks: Assess your environment by utilizing the audit capabilities that we are exposing in the September 2025 security updates. See Support for Audit Events to deploy SMB Server Hardening—SMB Server Signing & SMB Server EPA. Adopt appropriate SMB Server hardening measures.
Status Published

CVE-2024-21907

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.
Status Published

CVE-2025-54914

Azure Networking Elevation of Privilege Vulnerability
Status Published

CVE-2025-55244

Azure Bot Service Elevation of Privilege Vulnerability
Status Published

CVE-2025-55241

Azure Entra Elevation of Privilege Vulnerability
Status Published

CVE-2025-55238

Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability
Status Published

CVE-2025-55236

Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally.
Status Published

CVE-2025-55226

Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to execute code locally.
Status Published

CVE-2025-53800

Incorrect initialization of resource in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Status Published

CVE-2025-54910

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Status Published

CVE-2025-53799

Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
Status Published

CVE-2025-54918

Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
Status Published

CVE-2025-55224

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
Status Published

CVE-2025-55228

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

Last edited: 10 September 2025 10:13 am