Microsoft Patch Tuesday – July 2025

⚡ TL;DR | Go Straight to the July 2025 Patch Tuesday Audit Report

Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The July 2025 edition of Patch Tuesday brings us 137 new fixes, with 14 rated as critical. We’ve listed the most important changes below.

Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2025-49717, is a heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. It has a CVSS base score of 8.5 but is “unlikely” to be exploited according to Microsoft.

The main reason that Microsoft most likely came to the unlikely exploitation is that the complexity to exploit the vulnerability is listed as high. It would require an attacker to take additional actions prior to exploitation to prepare the target environment.

On the vulenrability’s page, Microsoft has added additional guidance for GDR and/or CU (Cumulative Update) updates.

Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability

CVE-2025-49735 is a Remote Code Execution vulnerability in the Windows KDC Proxy Service. The Windows KDC Proxy Service enables Kerberos authentication to work over HTTPS, allowing remote clients to securely obtain tickets from a domain controller across network boundaries like firewalls.

Not all servers are vulnerable, there is a specific requirement. This vulnerability only affects Windows Servers that are configured as a [MS-KKDCP]: Kerberos Key Distribution Center (KDC) Proxy Protocol server. Domain controllers are not affected.

Microsoft SharePoint Remote Code Execution Vulnerability

The last highlight of this month is CVE-2025-49704, a RCE vulnerability in SharePoint with a CVSS base score of 8.8.

According to Microsoft exploitation is “more likely” and exploitation does not require admin or other elevated privileges, meaning the attack complexity is low.

Run the Patch Tuesday July 2025 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday report is automatically added to your Lansweeper Site. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one report, automatically added every patch Tuesday!

Patch Tuesday July 2025 CVE Codes & Titles

CVE Number	CVE Title
CVE-2025-49760	Windows Storage Spoofing Vulnerability
CVE-2025-49756	Office Developer Platform Security Feature Bypass Vulnerability
CVE-2025-49753	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49744	Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2025-49742	Windows Graphics Component Remote Code Execution Vulnerability
CVE-2025-49740	Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2025-49739	Visual Studio Elevation of Privilege Vulnerability
CVE-2025-49738	Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2025-49737	Microsoft Teams Elevation of Privilege Vulnerability
CVE-2025-49735	Windows KDC Proxy Service (KPSSVC) Remote Code Execution Vulnerability
CVE-2025-49733	Win32k Elevation of Privilege Vulnerability
CVE-2025-49732	Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2025-49731	Microsoft Teams Elevation of Privilege Vulnerability
CVE-2025-49730	Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability
CVE-2025-49729	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49727	Win32k Elevation of Privilege Vulnerability
CVE-2025-49726	Windows Notification Elevation of Privilege Vulnerability
CVE-2025-49725	Windows Notification Elevation of Privilege Vulnerability
CVE-2025-49724	Windows Connected Devices Platform Service Remote Code Execution Vulnerability
CVE-2025-49723	Windows StateRepository API Server file Tampering Vulnerability
CVE-2025-49722	Windows Print Spooler Denial of Service Vulnerability
CVE-2025-49721	Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
CVE-2025-49719	Microsoft SQL Server Information Disclosure Vulnerability
CVE-2025-49718	Microsoft SQL Server Information Disclosure Vulnerability
CVE-2025-49717	Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2025-49716	Windows Netlogon Denial of Service Vulnerability
CVE-2025-49714	Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2025-49711	Microsoft Excel Remote Code Execution Vulnerability
CVE-2025-49706	Microsoft SharePoint Server Spoofing Vulnerability
CVE-2025-49705	Microsoft PowerPoint Remote Code Execution Vulnerability
CVE-2025-49704	Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2025-49703	Microsoft Word Remote Code Execution Vulnerability
CVE-2025-49702	Microsoft Office Remote Code Execution Vulnerability
CVE-2025-49701	Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2025-49700	Microsoft Word Remote Code Execution Vulnerability
CVE-2025-49699	Microsoft Office Remote Code Execution Vulnerability
CVE-2025-49698	Microsoft Word Remote Code Execution Vulnerability
CVE-2025-49697	Microsoft Office Remote Code Execution Vulnerability
CVE-2025-49696	Microsoft Office Remote Code Execution Vulnerability
CVE-2025-49695	Microsoft Office Remote Code Execution Vulnerability
CVE-2025-49694	Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2025-49693	Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2025-49691	Windows Miracast Wireless Display Remote Code Execution Vulnerability
CVE-2025-49690	Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability
CVE-2025-49689	Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
CVE-2025-49688	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49687	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability
CVE-2025-49686	Windows TCP/IP Driver Elevation of Privilege Vulnerability
CVE-2025-49685	Windows Search Service Elevation of Privilege Vulnerability
CVE-2025-49684	Windows Storage Port Driver Information Disclosure Vulnerability
CVE-2025-49683	Microsoft Virtual Hard Disk Remote Code Execution Vulnerability
CVE-2025-49682	Windows Media Elevation of Privilege Vulnerability
CVE-2025-49681	Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
CVE-2025-49680	Windows Performance Recorder (WPR) Denial of Service Vulnerability
CVE-2025-49679	Windows Shell Elevation of Privilege Vulnerability
CVE-2025-49678	NTFS Elevation of Privilege Vulnerability
CVE-2025-49677	Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2025-49676	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49675	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
CVE-2025-49674	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49673	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49672	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49671	Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
CVE-2025-49670	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49669	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49668	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49667	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2025-49666	Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerability
CVE-2025-49665	Workspace Broker Elevation of Privilege Vulnerability
CVE-2025-49664	Windows User-Mode Driver Framework Host Information Disclosure Vulnerability
CVE-2025-49663	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-49661	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2025-49660	Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2025-49659	Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege Vulnerability
CVE-2025-49658	Windows Transport Driver Interface (TDI) Translation Driver Information Disclosure Vulnerability
CVE-2025-49657	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-48824	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-48823	Windows Cryptographic Services Information Disclosure Vulnerability
CVE-2025-48822	Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution Vulnerability
CVE-2025-48821	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
CVE-2025-48820	Windows AppX Deployment Service Elevation of Privilege Vulnerability
CVE-2025-48819	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability
CVE-2025-48818	BitLocker Security Feature Bypass Vulnerability
CVE-2025-48817	Remote Desktop Client Remote Code Execution Vulnerability
CVE-2025-48816	HID Class Driver Elevation of Privilege Vulnerability
CVE-2025-48815	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability
CVE-2025-48814	Remote Desktop Licensing Service Security Feature Bypass Vulnerability
CVE-2025-48812	Microsoft Excel Information Disclosure Vulnerability
CVE-2025-48811	Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2025-48810	Windows Secure Kernel Mode Information Disclosure Vulnerability
CVE-2025-48809	Windows Secure Kernel Mode Information Disclosure Vulnerability
CVE-2025-48808	Windows Kernel Information Disclosure Vulnerability
CVE-2025-48806	Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability
CVE-2025-48805	Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability
CVE-2025-48804	BitLocker Security Feature Bypass Vulnerability
CVE-2025-48803	Windows Virtualization-Based Security (VBS) Elevation of Privilege Vulnerability
CVE-2025-48802	Windows SMB Server Spoofing Vulnerability
CVE-2025-48800	BitLocker Security Feature Bypass Vulnerability
CVE-2025-48799	Windows Update Service Elevation of Privilege Vulnerability
CVE-2025-48386	MITRE: CVE-2025-48386 Git Credential Helper Vulnerability
CVE-2025-48385	MITRE: CVE-2025-48385 Git Protocol Injection Vulnerability
CVE-2025-48384	MITRE: CVE-2025-48384 Git Symlink Vulnerability
CVE-2025-48003	BitLocker Security Feature Bypass Vulnerability
CVE-2025-48002	Windows Hyper-V Information Disclosure Vulnerability
CVE-2025-48001	BitLocker Security Feature Bypass Vulnerability
CVE-2025-48000	Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
CVE-2025-47999	Windows Hyper-V Denial of Service Vulnerability
CVE-2025-47998	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2025-47996	Windows MBT Transport Driver Elevation of Privilege Vulnerability
CVE-2025-47994	Microsoft Office Elevation of Privilege Vulnerability
CVE-2025-47993	Microsoft PC Manager Elevation of Privilege Vulnerability
CVE-2025-47991	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability
CVE-2025-47988	Azure Monitor Agent Remote Code Execution Vulnerability
CVE-2025-47987	Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability
CVE-2025-47986	Universal Print Management Service Elevation of Privilege Vulnerability
CVE-2025-47985	Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2025-47984	Windows GDI Information Disclosure Vulnerability
CVE-2025-47982	Windows Storage VSP Driver Elevation of Privilege Vulnerability
CVE-2025-47981	SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
CVE-2025-47980	Windows Imaging Component Information Disclosure Vulnerability
CVE-2025-47978	Windows Kerberos Denial of Service Vulnerability
CVE-2025-47976	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability
CVE-2025-47975	Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability
CVE-2025-47973	Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
CVE-2025-47972	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability
CVE-2025-47971	Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability
CVE-2025-47178	Microsoft Configuration Manager Remote Code Execution Vulnerability
CVE-2025-47161	Microsoft Defender for Endpoint Elevation of Privilege Vulnerability
CVE-2025-47159	Windows Virtualization-Based Security (VBS) Elevation of Privilege Vulnerability
CVE-2025-46835	MITRE: CVE-2025-46835 Git File Overwrite Vulnerability
CVE-2025-46334	MITRE: CVE-2025-46334 Git Malicious Shell Vulnerability
CVE-2025-36357	AMD: CVE-2025-36357 Transient Scheduler Attack in L1 Data Queue
CVE-2025-36350	AMD: CVE-2024-36350 Transient Scheduler Attack in Store Queue
CVE-2025-33054	Remote Desktop Spoofing Vulnerability
CVE-2025-30399	.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2025-27614	MITRE: CVE-2025-27614 Gitk Arbitrary Code Execution Vulnerability
CVE-2025-27613	MITRE: CVE-2025-27613 Gitk Arguments Vulnerability
CVE-2025-26684	Microsoft Defender Elevation of Privilege Vulnerability
CVE-2025-26636	Windows Kernel Information Disclosure Vulnerability
CVE-2025-21195	Azure Service Fabric Runtime Elevation of Privilege Vulnerability
CVE-2024-49000	SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-43614	Microsoft Defender for Endpoint for Linux Spoofing Vulnerability
CVE-2022-33637	Microsoft Defender for Endpoint Tampering Vulnerability
CVE-2022-23278	Microsoft Defender for Endpoint Spoofing Vulnerability