Microsoft Patch Tuesday security updates for September 2025 fixed two zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-21907 | Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. NVD description · AI analysis pending | 7.5 | 33% | PoC ×4 |
| — | |
| CVE-2025-55232 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2025-55234 | SMB Relay Elevation of Privilege in Microsoft Windows SMB Server CVE-2025-55234 is an improper authentication flaw (CWE-287) in the Microsoft SMB Server that leaves systems susceptible to credential relay attacks when SMB signing and Extended Protection for Authentication (EPA) are not enforced. It is configuration-dependent: an attacker who can induce an authenticated SMB connection, for example by tricking a user or machine into connecting to attacker-controlled resources, can relay the credentials to another host and authenticate as that user. Successful relaying grants the attacker the privileges of the relayed user, up to elevation of privilege on target systems, with high impact on confidentiality, integrity and availability. Affected systems span Windows 10 (1507 through 22H2), Windows 11 (22H2 through 24H2), and Windows Server 2008, 2012, 2016 and 2019, although only environments without SMB signing/EPA hardening are practically exploitable. As of the September 2025 Patch Tuesday release there is no known in-the-wild exploitation or public proof of concept, but EPSS assigns a 20.1% probability of exploitation within the next 30 days (97th percentile). Do: Install the September 2025 (or later) Microsoft security updates, which add SMB Server Hardening audit capabilities, and use the new audit events to identify clients, servers or legacy software that would break if SMB signing and EPA are enforced. After remediating incompatibilities, enable SMB Server signing and Extended Protection for Authentication on SMB servers to close the relay exposure, prioritizing domain controllers and file servers. Note that systems already enforcing both signing and EPA are not practically exposed. | 9.8 | 20% |
| masshundreds of millions of Windows 10/11 devices plus millions of Windows Server instances are potentially exposed, though only those lacking SMB signing/EPA… |
Full article278 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 10, 2025
Microsoft Patch Tuesday security updates for September 2025 fixed 80 vulnerabilities, including two publicly disclosed zero-day flaws.
Microsoft Patch Tuesday security updates for September 2025 addressed 80 vulnerabilities in Windows and Windows Components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, Hyper-V, SQL Server, Defender Firewall Service, and Xbox (yup – Xbox!).
Eight of the flaws fixed by Microsoft are rated Critical in severity, and the rest are rated Important.
Two of these vulnerabilities are publicly disclosed zero-day flaws, and neither has been actively exploited in the wild. All vulnerabilities are rated as “exploitation less likely” or “exploitation unlikely.”
The two publicly disclosed zero-days are CVE-2025-55234 (CVSS score of 8.8) and CVE-2024-21907 (CVSS score of 7.5). CVE-2025-55234 affects Windows SMB Server, enabling relay attacks that could escalate privileges; Microsoft advises enabling SMB signing and EPA, though they may cause legacy compatibility issues, and has added auditing features in the Sept 2025 updates. CVE-2024-21907, disclosed in 2024, impacts Newtonsoft.Json in SQL Server, where crafted data can trigger a StackOverflow exception and denial of service, now fixed in updated libraries.
The most severe flaw, tracked as CVE-2025-55232 (CVSS score of 9.8), is a Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability. It resides in Microsoft HPC Pack and allows remote, unauthenticated code execution without user interaction, making it potentially wormable. Microsoft urges deploying clusters in secure enclaves, blocking TCP port 5999, and prioritizing patching.
“An attacker who successfully exploits this vulnerability could achieve remote code execution without user interaction.” reads the advisory published by Microsoft,
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Patch Tuesday)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/182045/security/microsoft-patch-tuesday-security-updates-for-september-2025-fixed-two-zero-day-flaws.html