Microsoft, Adobe, SAP deliver critical fixes for September 2025 Patch Tuesday
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2025-42922 | SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file | 9.9 | <1% | ||
| CVE-2025-42944 | Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious… | 10.0 | 3% | ||
| CVE-2025-42958 | Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read… | 9.1 | <1% | ||
| CVE-2025-54236 | Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper) | 9.1 | 95% | KEVPoC ×2 | KEV |
| CVE-2025-54261 | Critical Path Traversal Leading to RCE in Adobe ColdFusion 2025/2023/2021 | 10.0 | 21% | ||
CVE-2025-55234+3 related CVEs | SMB Relay Elevation of Privilege in Microsoft Windows SMB Server | 9.8 group max | 20% | ||
| CVE-2025-55232 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network | 9.8 | 2% |
From the original article
5 min read at helpnetsecurity.com
On September 2025 Patch Tuesday, Microsoft has released patches for 80+ vulnerabilities in its various software products, but the good news is that none of them are actively exploited. Among the critical and important vulnerabilities patched by Microsoft this time around are: CVE-2025-54918 , a remotely exploitable Windows NTLM elevation of privilege vulnerability.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.