Report Name: Microsoft Patch Tuesday, August 2025
Generated: 2025-08-13 19:25:59

Product Name	Prevalence	U	C	H	M	L	A	Comment
Windows Kernel	0.9			2			2	Windows Kernel
Windows NTLM	0.9			1			1	A suite of security protocols to authenticate users' identity and protect the integrity and confidentiality of their activity
Windows Win32k	0.9			3			3	The Win32k.sys driver is the kernel side of some core parts of the Windows subsystem. Its main functionality is the GUI of Windows; it's responsible for window management.
Chromium	0.8		1		13		14	Chromium is a free and open-source web browser project, mainly developed and maintained by Google
Desktop Windows Manager	0.8			1	1		2	Windows component
DirectX Graphics Kernel	0.8			2	1		3	DirectX Graphics Kernel
GDI+	0.8			1			1	GDI+
Kernel Streaming WOW Thunk Service Driver	0.8				1		1	Windows component
Microsoft Exchange	0.8			1	3		4	Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft
Microsoft Office	0.8			3			3	Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer
Microsoft Windows File Explorer	0.8				1		1	Windows component
Windows Ancillary Function Driver for WinSock	0.8				7		7	Windows component
Windows Cloud Files Mini Filter Driver	0.8				1		1	Windows component
Windows Connected Devices Platform Service	0.8				1		1	Windows component
Windows Distributed Transaction Coordinator (MSDTC)	0.8			1			1	Windows component
Windows Graphics Component	0.8			1	1		2	Windows component
Windows Installer	0.8				1		1	Windows component
Windows Kerberos	0.8			1			1	Windows component
Windows Kernel Transaction Manager	0.8				1		1	Windows component
Windows Media	0.8			1			1	Windows component
Windows NTFS	0.8			1			1	The default file system of the Windows NT family
Windows PrintWorkflowUserSvc	0.8				1		1	Windows component
Windows Push Notifications Apps	0.8			4			4	Windows component
Windows Remote Desktop Services Denial of Service Vulnerability	0.8			1			1	Windows component
Windows Routing and Remote Access Service (RRAS)	0.8			12			12	Windows component
Windows SMB	0.8			1			1	Windows component
Windows Security App	0.8				1		1	Windows component
Windows StateRepository API Server file	0.8				1		1	Windows component
Windows Storage Port Driver	0.8				1		1	Windows component
Windows Subsystem for Linux (WSL2) Kernel	0.8				1		1	Windows component
Microsoft SharePoint	0.7			1	1		2	Microsoft SharePoint
Microsoft Excel	0.6			2	3		5	MS Office product
Microsoft Office Visio	0.6				2		2	Microsoft Visio
Microsoft PowerPoint	0.6				1		1	Microsoft PowerPoint
Microsoft Word	0.6			1	3		4	Microsoft Word is a widely used commercial word processor developed by Microsoft. It is a component of the Microsoft Office suite of productivity software but can also be purchased as a standalone product.
Windows Hyper-V	0.6				5		5	Hardware virtualization component of the client editions of Windows NT
Azure DevOps Server	0.5			1			1	Azure DevOps Server
Azure Machine Learning	0.5				3		3	Azure Machine Learning
Azure OpenAI	0.5				1		1	Azure OpenAI
Azure Portal	0.5				1		1	Azure Portal
Azure Stack Hub	0.5				2		2	Azure Stack Hub
Azure Virtual Machines	0.5				2		2	Azure Virtual Machines
GitHub Copilot and Visual Studio	0.5			1			1	GitHub Copilot and Visual Studio
Local Security Authority Subsystem Service (LSASS)	0.5				1		1	Local Security Authority Subsystem Service (LSASS)
Microsoft 365 Copilot BizChat	0.5				2		2	Microsoft 365 Copilot BizChat
Microsoft Azure File Sync	0.5				1		1	Microsoft Azure File Sync
Microsoft Brokering File System	0.5				1		1	Microsoft Brokering File System
Microsoft Dynamics 365 (On-Premises)	0.5				1		1	Microsoft Dynamics 365 (On-Premises)
Microsoft Dynamics 365 (on-premises)	0.5				1		1	Microsoft Dynamics 365 (on-premises)
Microsoft Edge (Chromium-based) for Android	0.5				2		2	Microsoft Edge (Chromium-based) for Android
Microsoft Exchange Server Hybrid Deployment	0.5				1		1	Microsoft Exchange Server Hybrid Deployment
Microsoft Message Queuing (MSMQ)	0.5			3	1		4	Microsoft Message Queuing (MSMQ)
Microsoft SQL Server	0.5				5		5	Microsoft SQL Server
Microsoft SharePoint Server	0.5	1	1				2	Microsoft SharePoint Server
Microsoft Teams	0.5				1		1	Microsoft Teams
NT OS Kernel	0.5				1		1	NT OS Kernel
Remote Access Point-to-Point Protocol (PPP) EAP-TLS	0.5				1		1	Remote Access Point-to-Point Protocol (PPP) EAP-TLS
Remote Desktop	0.5				1		1	Remote Desktop
Web Deploy	0.5			1			1	Web Deploy
Microsoft Purview	0.3				1		1	Microsoft Purview is a comprehensive set of solutions that can help your organization govern, protect, and manage data, wherever it lives

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	1		24	11		36
Security Feature Bypass	0.9		1		2		3
Elevation of Privilege	0.85			12	37		49
Information Disclosure	0.83			9	9		18
Cross Site Scripting	0.8				4		4
Denial of Service	0.7			2	2		4
Incorrect Calculation	0.5				1		1
Memory Corruption	0.5				6		6
Spoofing	0.4		1		9		10
Tampering	0.3				1		1

Source	U	C	H	M	L	A
MS PT Extended	1	2	1	21		25
Qualys			10	11		21
Tenable			6	1		7
Rapid7			4			4
ZDI			5			5

Urgent (1)

1. Remote Code Execution - Microsoft SharePoint Server (CVE-2025-53770) - Urgent [916]

Description: Microsoft SharePoint Server Remote Code Execution Vulnerability

MS PT Extended: CVE-2025-53770 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

Critical (2)

2. Spoofing - Microsoft SharePoint Server (CVE-2025-53771) - Critical [761]

Description: Microsoft SharePoint Server Spoofing Vulnerability

MS PT Extended: CVE-2025-53771 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

3. Security Feature Bypass - Chromium (CVE-2025-6558) - Critical [698]

Description: Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

MS PT Extended: CVE-2025-6558 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

High (47)

4. Elevation of Privilege - Windows Kerberos (CVE-2025-53779) - High [525]

Description: Windows Kerberos Elevation of Privilege Vulnerability

Qualys: CVE-2025-53779: Windows Kerberos Elevation of Privilege Vulnerability Kerberos is a robust network authentication protocol widely used in Windows environments, particularly within Active Directory (AD) domains. Its primary purpose is to verify the identity of users and services securely and efficiently, preventing unauthorized access and safeguarding sensitive data.  The path traversal vulnerability in Windows Kerberos may allow an authenticated attacker to elevate privileges over a network. Upon successful exploitation, an attacker could gain domain administrator privileges. 

Tenable: Microsoft’s August 2025 Patch Tuesday Addresses 107 CVEs (CVE-2025-53779)

Tenable: CVE-2025-53779 | Windows Kerberos Elevation of Privilege Vulnerability

Tenable: CVE-2025-53779 is an EoP vulnerability in Windows Kerberos. It was assigned a CVSSv3 score of 7.2 and is rated moderate. An authenticated attacker with access to a user account with specific permissions in active directory (AD) and at least one domain controller in the domain running Windows Server 2025 could exploit this vulnerability to achieve full domain, and then forest compromise in an AD environment.

Rapid7: What do attackers want in a Windows context? Domain admin! When do they want it? Now! Today’s lone zero-day vulnerability might be just what they need to break through the final layers of protection and swipe the crown jewels. CVE-2025-53779 is an elevation of privilege (EoP) vulnerability in the Windows implementation of Kerberos, which is enabled via abuse of dMSA configuration. The advisory FAQ provides more clues as to the nature of the attack than many comparable Microsoft advisories, but misses a golden opportunity for clarity, since it never sets out what it means by dMSA, leaving us scouring for contextual clues. Ultimately, we can determine from context that today’s hot topic is the Delegated Managed Service Account, rather than the Defender Microservices Architecture or some other piece of Microsoft paraphernalia with matching initials. Microsoft’s motivation is unimpeachable: the dMSA supports automated rotation of credentials for service accounts, and is specifically designed to prevent credential harvesting using Kerberoasting. Indeed, CISA has described Kerberoasting as one of the most time-efficient ways to elevate privileges and move laterally throughout an organization’s network.

Rapid7: The good news here is that successful exploitation of CVE-2025-53779 requires an attacker to have pre-existing control of two attributes of the hopefully well protected dMSA: msds-groupMSAMembership, which determines which users may use credentials for the managed service account, and msds-ManagedAccountPrecededByLink, which contains a list of users on whose behalf the dMSA can act. However, abuse of CVE-2025-53779 is certainly plausible as the final link of a multi-exploit chain which stretches from no access to total pwnage. Finally, it’s important to note that Microsoft is only publishing patches for Windows Server 2025, and that’s because msds-ManagedAccountPrecededByLink was first implemented in Server 2025. Migrating to newer operating systems sooner rather than later remains good advice, but so is remediation of zero-day vulnerabilities which could give an attacker total control of your estate.

Rapid7: The publication of any pre-authentication RCE in Windows will naturally spark discussion. Of course, not all pre-auth RCEs are created equal, and while CVE-2025-50165 has a hefty CVSSv3 base score of 9.8, and is certainly a cause for concern, it is not the worst of the worst, since it presumably isn’t wormable. Despite that, a degree of alarm is amply justified, since the advisory FAQ mentions — twice! — that user interaction isn’t required. Exploitation is via a malicious JPEG file, which could be delivered within an Office document or other means; perhaps even visiting a website would be sufficient, or receiving an email within Outlook, although the advisory doesn’t explicitly confirm or deny these other possible attack routes. The malformed JPEG tricks the Windows Graphics Component into code execution via an untrusted pointer dereference. The context of execution isn’t specified, so in the standard spirit of caution, we’ll assume SYSTEM. This is hardly a new class of problem: we can cast our minds back a dozen years, for instance, and consider the broadly similar MS13-096. However, the specific flaw underlying CVE-2025-50165 is presumably a recent introduction, since only Windows 11 24H2 and Server 2025 receive patches. Patch this one sooner rather than later, since it could provide a skilled attacker with a valuable foothold from which to launch further attacks, including perhaps even today’s CVE-2025-53779.

5. Remote Code Execution - Windows Graphics Component (CVE-2025-50165) - High [490]

Description: Windows Graphics Component Remote Code Execution Vulnerability

Qualys: CVE-2025-50165: Windows Graphics Component Remote Code Execution Vulnerability An untrusted pointer dereference flaw in the Microsoft Graphics Component may allow an unauthenticated attacker to achieve remote code execution.

Rapid7: The publication of any pre-authentication RCE in Windows will naturally spark discussion. Of course, not all pre-auth RCEs are created equal, and while CVE-2025-50165 has a hefty CVSSv3 base score of 9.8, and is certainly a cause for concern, it is not the worst of the worst, since it presumably isn’t wormable. Despite that, a degree of alarm is amply justified, since the advisory FAQ mentions — twice! — that user interaction isn’t required. Exploitation is via a malicious JPEG file, which could be delivered within an Office document or other means; perhaps even visiting a website would be sufficient, or receiving an email within Outlook, although the advisory doesn’t explicitly confirm or deny these other possible attack routes. The malformed JPEG tricks the Windows Graphics Component into code execution via an untrusted pointer dereference. The context of execution isn’t specified, so in the standard spirit of caution, we’ll assume SYSTEM. This is hardly a new class of problem: we can cast our minds back a dozen years, for instance, and consider the broadly similar MS13-096. However, the specific flaw underlying CVE-2025-50165 is presumably a recent introduction, since only Windows 11 24H2 and Server 2025 receive patches. Patch this one sooner rather than later, since it could provide a skilled attacker with a valuable foothold from which to launch further attacks, including perhaps even today’s CVE-2025-53779.

Rapid7: The Windows GDI+ (Graphics Device Interface Plus) is at the center of how almost all two-dimensional graphics are rendered on Windows assets. CVE-2025-53766 is a critical RCE in how GDI+ interprets metafiles, which are often used to store vector graphics. An attacker can achieve code execution via buffer overflow without privileges or user interaction. As with today’s CVE-2025-50165, it’s unlikely that this vulnerability could be wormable, but the most alarming path to exploitation involved simply uploading a malicious metafile to a Windows machine running unspecified web services. There is no mention of SharePoint, Exchange, Office, or other non-Windows products in the Security Updates section of the advisory, but that still leaves an essentially limitless potential attack surface; for example, anyone running a custom ASP.NET application offering file uploads could find themselves vulnerable to an attacker wielding a dodgy WMF file. On the bright side, the Preview Pane is not a vector in this case. A patch is available for Server 2008, but not Server 2012, a curious and possibly concerning pattern that we see from time to time with RCEs which affect the full historic range of Windows products.

ZDI: CVE-2025-50165 - Windows Graphics Component Remote Code Execution Vulnerability. Speaking of browse-and-own, that's exactly what this bug allows as well. Rating a CVSS 9.8, this could lead to code execution by viewing a specially crafted image. Browse-and-own bugs always gain attention from researchers, so even though this is listed as “exploitation less likely”, I would treat this as a critical patch for deployment.

6. Remote Code Execution - Microsoft SharePoint (CVE-2025-49712) - High [485]

Description: Microsoft SharePoint Remote Code Execution Vulnerability

Tenable: CVE-2025-49712 | Microsoft SharePoint Remote Code Execution Vulnerability

Tenable: CVE-2025-49712 is a RCE vulnerability in Microsoft SharePoint. It was assigned a CVSSv3 score of 8.8 and is rated important. An attacker would need to be authenticated with Site Owner privileges at minimum. Once authenticated, an attacker could either write arbitrary code or use code injection to execute code on a vulnerable SharePoint Server to gain RCE.

ZDI: CVE-2025-49712 - Microsoft SharePoint Remote Code Execution Vulnerability. SharePoint has definitely been a hot topic over the last month, with exploits hitting several U.S. government targets. While this bug is not listed as under active attack, it is the same type of bug used in the second stage of existing exploits. The first stage is an authentication bypass, as this vulnerability does require authentication. However, several auth bypasses are publicly known (and patched). Be sure you are up-to-date with ALL of your SharePoint patches and reconsider having them be internet accessible.

7. Remote Code Execution - GDI+ (CVE-2025-53766) - High [466]

Description: GDI+ Remote Code Execution Vulnerability

Qualys: CVE-2025-53766: GDI+ Remote Code Execution Vulnerability A heap-based buffer overflow vulnerability in Windows GDI+ may allow an unauthenticated attacker to achieve remote code execution.

Rapid7: The Windows GDI+ (Graphics Device Interface Plus) is at the center of how almost all two-dimensional graphics are rendered on Windows assets. CVE-2025-53766 is a critical RCE in how GDI+ interprets metafiles, which are often used to store vector graphics. An attacker can achieve code execution via buffer overflow without privileges or user interaction. As with today’s CVE-2025-50165, it’s unlikely that this vulnerability could be wormable, but the most alarming path to exploitation involved simply uploading a malicious metafile to a Windows machine running unspecified web services. There is no mention of SharePoint, Exchange, Office, or other non-Windows products in the Security Updates section of the advisory, but that still leaves an essentially limitless potential attack surface; for example, anyone running a custom ASP.NET application offering file uploads could find themselves vulnerable to an attacker wielding a dodgy WMF file. On the bright side, the Preview Pane is not a vector in this case. A patch is available for Server 2008, but not Server 2012, a curious and possibly concerning pattern that we see from time to time with RCEs which affect the full historic range of Windows products.

ZDI: CVE-2025-53766 - GDI+ Remote Code Execution Vulnerability. As mentioned, this bug is a CVSS 9.8 as it allows for code execution just by browsing to a malicious webpage. An attacker could also embed a specially crafted metafile into a document and have the target open the file. A worst-case scenario would be an attacker uploading something through an ad network that is served up to users. Ad blockers are just to remove annoyances; they also protect for malicious ads. They’re rare, but they have occurred in the past. Since GDI+ touches so many different components (and users tend to click on anything), test and deploy this one quickly.

8. Information Disclosure - Windows NTFS (CVE-2025-50158) - High [457]

Description: Windows NTFS Information Disclosure Vulnerability

9. Remote Code Execution - Web Deploy (CVE-2025-53772) - High [452]

Description: Web Deploy Remote Code Execution Vulnerability

10. Denial of Service - Windows Remote Desktop Services Denial of Service Vulnerability (CVE-2025-53722) - High [448]

Description: Windows Remote Desktop Services Denial of Service Vulnerability

11. Elevation of Privilege - Azure DevOps Server (CVE-2025-47158) - High [447]

Description: Azure DevOps Server Elevation of Privilege Vulnerability

MS PT Extended: CVE-2025-47158 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

12. Elevation of Privilege - Windows Win32k (CVE-2025-50168) - High [444]

Description: Win32k Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-53786 is an elevation of privilege vulnerability in Microsoft Exchange Server Hybrid Deployment. Successful exploitation of the vulnerability could allow an attacker to escalate privileges within the organization’s connected cloud environment. CVE-2025-49743 is an elevation of privilege vulnerability in Windows Graphics Component. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-50167 is an elevation of privilege vulnerability in Windows Hyper-V. Upon successful exploitation, an attacker could gain SYSTEM privileges. CVE-2025-50168 is an elevation of privilege vulnerability in Win32k. A type confusion flaw in Windows Win32K – ICOMP may allow an authorized attacker to gain SYSTEM privileges. CVE-2025-53132 is an elevation of privilege vulnerability in Win32k. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-53147 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2025-53156 is an information disclosure vulnerability in the Windows Storage Port Driver. Successful exploitation of the vulnerability could allow the disclosure of certain kernel memory content.

13. Remote Code Execution - DirectX Graphics Kernel (CVE-2025-50176) - High [442]

Description: DirectX Graphics Kernel Remote Code Execution Vulnerability

Qualys: CVE-2025-50176: DirectX Graphics Kernel Remote Code Execution Vulnerability  A type confusion vulnerability in the Graphics Kernel may allow an authenticated attacker to execute code locally. An authenticated attacker could trigger this vulnerability without admin or other elevated privileges.

Rapid7: Today is certainly a good day for fans of critical RCE vulnerabilities which target weaknesses in how Windows interprets graphics. Exploitation of CVE-2025-50176, a flaw in the DirectX graphics kernel, could lead to execution in a kernel context. Microsoft considers exploitation more likely, which may be why the advisory doesn’t provide a great deal of information about the means of exploitation, beyond a terse statement that type confusion is involved. Type confusion is where the kernel receives a pointer which it expects to be for one type of object, but is in fact for another, which is a bit like asking someone to read out loud from a restaurant menu, but then handing them their secret diary and hoping they won’t notice the difference. Most people will not be fooled, but under the right circumstances, anything is possible.

14. Remote Code Execution - Windows Media (CVE-2025-53131) - High [442]

Description: Windows Media Remote Code Execution Vulnerability

15. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2025-49757) - High [442]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

16. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2025-50163) - High [442]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

17. Denial of Service - DirectX Graphics Kernel (CVE-2025-50172) - High [436]

Description: DirectX Graphics Kernel Denial of Service Vulnerability

18. Elevation of Privilege - Windows NTLM (CVE-2025-53778) - High [432]

Description: Windows NTLM Elevation of Privilege Vulnerability

Qualys: CVE-2025-53778: Windows NTLM Elevation of Privilege Vulnerability NTLM (Windows NT LAN Manager) is an authentication protocol used in Windows networks to verify the identity of users and computers. It’s a challenge-response mechanism where a client proves its knowledge of a password to a server or domain controller. An improper authentication flaw in Windows NTLM may allow an authenticated attacker to elevate privileges over a network. Upon successful exploitation, an attacker could gain SYSTEM privileges. 

Tenable: CVE-2025-53778 | Windows NTLM Elevation of Privilege Vulnerability

Tenable: CVE-2025-53778 is an EoP vulnerability affecting Windows New Technology LAN Manager (NTLM). It was assigned a CVSSv3 score of 8.8 and is rated as critical. According to the advisory, successful exploitation would allow an attacker to elevate their privileges to SYSTEM. This flaw was assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index.

19. Remote Code Execution - Microsoft Office (CVE-2025-53732) - High [430]

Description: Microsoft Office Remote Code Execution Vulnerability

20. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2025-50160) - High [430]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

21. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2025-50162) - High [430]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

22. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2025-50164) - High [430]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

23. Remote Code Execution - Windows Routing and Remote Access Service (RRAS) (CVE-2025-53720) - High [430]

Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

24. Remote Code Execution - Windows SMB (CVE-2025-50169) - High [430]

Description: Windows SMB Remote Code Execution Vulnerability

25. Remote Code Execution - GitHub Copilot and Visual Studio (CVE-2025-53773) - High [428]

Description: GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

26. Remote Code Execution - Microsoft Message Queuing (MSMQ) (CVE-2025-53143) - High [428]

Description: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 are RCE vulnerabilities in Microsoft Message Queuing (MSMQ). While three of these four CVEs (CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145) were assigned CVSSv3 scores of 8.8 and rated as important, CVE-2025-50177 was assigned a CVSSv3 score of 8.1 and rated as critical. Similarly, CVE-2025-50177 was assessed as “Exploitation More Likely,” while the other three were assessed as “Exploitation Less Likely.”

27. Remote Code Execution - Microsoft Message Queuing (MSMQ) (CVE-2025-53144) - High [428]

Description: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 are RCE vulnerabilities in Microsoft Message Queuing (MSMQ). While three of these four CVEs (CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145) were assigned CVSSv3 scores of 8.8 and rated as important, CVE-2025-50177 was assigned a CVSSv3 score of 8.1 and rated as critical. Similarly, CVE-2025-50177 was assessed as “Exploitation More Likely,” while the other three were assessed as “Exploitation Less Likely.”

28. Remote Code Execution - Microsoft Message Queuing (MSMQ) (CVE-2025-53145) - High [428]

Description: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 are RCE vulnerabilities in Microsoft Message Queuing (MSMQ). While three of these four CVEs (CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145) were assigned CVSSv3 scores of 8.8 and rated as important, CVE-2025-50177 was assigned a CVSSv3 score of 8.1 and rated as critical. Similarly, CVE-2025-50177 was assessed as “Exploitation More Likely,” while the other three were assessed as “Exploitation Less Likely.”

29. Elevation of Privilege - Windows Win32k (CVE-2025-53132) - High [420]

Description: Win32k Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-53786 is an elevation of privilege vulnerability in Microsoft Exchange Server Hybrid Deployment. Successful exploitation of the vulnerability could allow an attacker to escalate privileges within the organization’s connected cloud environment. CVE-2025-49743 is an elevation of privilege vulnerability in Windows Graphics Component. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-50167 is an elevation of privilege vulnerability in Windows Hyper-V. Upon successful exploitation, an attacker could gain SYSTEM privileges. CVE-2025-50168 is an elevation of privilege vulnerability in Win32k. A type confusion flaw in Windows Win32K – ICOMP may allow an authorized attacker to gain SYSTEM privileges. CVE-2025-53132 is an elevation of privilege vulnerability in Win32k. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-53147 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2025-53156 is an information disclosure vulnerability in the Windows Storage Port Driver. Successful exploitation of the vulnerability could allow the disclosure of certain kernel memory content.

30. Remote Code Execution - Desktop Windows Manager (CVE-2025-53152) - High [419]

Description: Desktop Windows Manager Remote Code Execution Vulnerability

31. Remote Code Execution - Microsoft Office (CVE-2025-53731) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: CVE-2025-53731 & CVE-2025-53740: Microsoft Office Remote Code Execution Vulnerability A use-after-free vulnerability in Microsoft Office allows an unauthenticated attacker to achieve remote code execution.

ZDI: CVE-2025-53731/ CVE-2025-53740 - Microsoft Office Remote Code Execution Vulnerability. This is the seventh month in a row where at least one Office component allowed code execution through the Preview Pane. With so many different components impacted, I doubt these are all patch bypasses. Instead, it appears attackers are mining code that hasn’t been looked at much and finding some gems. Perhaps it’s time to consider disabling the Preview Pane for a bit while the security gnomes in Redmond sort this out.

32. Remote Code Execution - Microsoft Office (CVE-2025-53740) - High [419]

Description: Microsoft Office Remote Code Execution Vulnerability

Qualys: CVE-2025-53731 & CVE-2025-53740: Microsoft Office Remote Code Execution Vulnerability A use-after-free vulnerability in Microsoft Office allows an unauthenticated attacker to achieve remote code execution.

ZDI: CVE-2025-53731/ CVE-2025-53740 - Microsoft Office Remote Code Execution Vulnerability. This is the seventh month in a row where at least one Office component allowed code execution through the Preview Pane. With so many different components impacted, I doubt these are all patch bypasses. Instead, it appears attackers are mining code that hasn’t been looked at much and finding some gems. Perhaps it’s time to consider disabling the Preview Pane for a bit while the security gnomes in Redmond sort this out.

33. Elevation of Privilege - Windows Push Notifications Apps (CVE-2025-50155) - High [416]

Description: Windows Push Notifications Apps Elevation of Privilege Vulnerability

34. Elevation of Privilege - Windows Push Notifications Apps (CVE-2025-53724) - High [416]

Description: Windows Push Notifications Apps Elevation of Privilege Vulnerability

35. Elevation of Privilege - Windows Push Notifications Apps (CVE-2025-53725) - High [416]

Description: Windows Push Notifications Apps Elevation of Privilege Vulnerability

36. Elevation of Privilege - Windows Push Notifications Apps (CVE-2025-53726) - High [416]

Description: Windows Push Notifications Apps Elevation of Privilege Vulnerability

37. Remote Code Execution - Microsoft Excel (CVE-2025-53739) - High [409]

Description: Microsoft Excel Remote Code Execution Vulnerability

38. Remote Code Execution - Microsoft Excel (CVE-2025-53759) - High [409]

Description: Microsoft Excel Remote Code Execution Vulnerability

39. Remote Code Execution - Microsoft Word (CVE-2025-53733) - High [409]

Description: Microsoft Word Remote Code Execution Vulnerability

Qualys: CVE-2025-53733: Microsoft Word Remote Code Execution Vulnerability Successful exploitation of the vulnerability may allow an unauthenticated attacker to achieve remote code execution.

40. Elevation of Privilege - Windows Kernel (CVE-2025-49761) - High [408]

Description: Windows Kernel Elevation of Privilege Vulnerability

41. Elevation of Privilege - Windows Kernel (CVE-2025-53151) - High [408]

Description: Windows Kernel Elevation of Privilege Vulnerability

42. Elevation of Privilege - Windows Win32k (CVE-2025-50161) - High [408]

Description: Win32k Elevation of Privilege Vulnerability

43. Information Disclosure - Microsoft Exchange (CVE-2025-33051) - High [400]

Description: Microsoft Exchange Server Information Disclosure Vulnerability

44. Information Disclosure - Windows Distributed Transaction Coordinator (MSDTC) (CVE-2025-50166) - High [400]

Description: Windows Distributed Transaction Coordinator (MSDTC) Information Disclosure Vulnerability

45. Information Disclosure - Windows Routing and Remote Access Service (RRAS) (CVE-2025-50156) - High [400]

Description: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

46. Information Disclosure - Windows Routing and Remote Access Service (RRAS) (CVE-2025-50157) - High [400]

Description: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

47. Information Disclosure - Windows Routing and Remote Access Service (RRAS) (CVE-2025-53138) - High [400]

Description: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

48. Information Disclosure - Windows Routing and Remote Access Service (RRAS) (CVE-2025-53148) - High [400]

Description: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

49. Information Disclosure - Windows Routing and Remote Access Service (RRAS) (CVE-2025-53153) - High [400]

Description: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

50. Information Disclosure - Windows Routing and Remote Access Service (RRAS) (CVE-2025-53719) - High [400]

Description: Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

Medium (82)

51. Remote Code Execution - Microsoft Excel (CVE-2025-53735) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

52. Remote Code Execution - Microsoft Excel (CVE-2025-53737) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

53. Remote Code Execution - Microsoft Excel (CVE-2025-53741) - Medium [397]

Description: Microsoft Excel Remote Code Execution Vulnerability

54. Remote Code Execution - Microsoft Office Visio (CVE-2025-53730) - Medium [397]

Description: Microsoft Office Visio Remote Code Execution Vulnerability

55. Remote Code Execution - Microsoft Office Visio (CVE-2025-53734) - Medium [397]

Description: Microsoft Office Visio Remote Code Execution Vulnerability

56. Remote Code Execution - Microsoft PowerPoint (CVE-2025-53761) - Medium [397]

Description: Microsoft PowerPoint Remote Code Execution Vulnerability

57. Remote Code Execution - Microsoft Word (CVE-2025-53738) - Medium [397]

Description: Microsoft Word Remote Code Execution Vulnerability

58. Elevation of Privilege - Desktop Windows Manager (CVE-2025-50153) - Medium [392]

Description: Desktop Windows Manager Elevation of Privilege Vulnerability

59. Elevation of Privilege - Kernel Streaming WOW Thunk Service Driver (CVE-2025-53149) - Medium [392]

Description: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

60. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-53134) - Medium [392]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

61. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-53141) - Medium [392]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

62. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-53154) - Medium [392]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

63. Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2025-50170) - Medium [392]

Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

64. Elevation of Privilege - Windows Installer (CVE-2025-50173) - Medium [392]

Description: Windows Installer Elevation of Privilege Vulnerability

65. Elevation of Privilege - Windows PrintWorkflowUserSvc (CVE-2025-53133) - Medium [392]

Description: Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability

66. Elevation of Privilege - Windows StateRepository API Server file (CVE-2025-53789) - Medium [392]

Description: Windows StateRepository API Server file Elevation of Privilege Vulnerability

67. Remote Code Execution - Microsoft Word (CVE-2025-53784) - Medium [385]

Description: Microsoft Word Remote Code Execution Vulnerability

Qualys: CVE-2025-53784: Microsoft Word Remote Code Execution Vulnerability A use-after-free vulnerability in Microsoft Office Word may allow an unauthenticated attacker to achieve remote code execution.

68. Remote Code Execution - Windows Hyper-V (CVE-2025-48807) - Medium [385]

Description: Windows Hyper-V Remote Code Execution Vulnerability

Qualys: CVE-2025-48807: Windows Hyper-V Remote Code Execution Vulnerability Improper restriction of the communication channel to intended endpoints in Windows Hyper-V could allow an authenticated attacker to achieve remote code execution.

69. Elevation of Privilege - Windows Hyper-V (CVE-2025-53723) - Medium [382]

Description: Windows Hyper-V Elevation of Privilege Vulnerability

70. Elevation of Privilege - DirectX Graphics Kernel (CVE-2025-53135) - Medium [380]

Description: DirectX Graphics Kernel Elevation of Privilege Vulnerability

71. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-49762) - Medium [380]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

72. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-53137) - Medium [380]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

73. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-53147) - Medium [380]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-53786 is an elevation of privilege vulnerability in Microsoft Exchange Server Hybrid Deployment. Successful exploitation of the vulnerability could allow an attacker to escalate privileges within the organization’s connected cloud environment. CVE-2025-49743 is an elevation of privilege vulnerability in Windows Graphics Component. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-50167 is an elevation of privilege vulnerability in Windows Hyper-V. Upon successful exploitation, an attacker could gain SYSTEM privileges. CVE-2025-50168 is an elevation of privilege vulnerability in Win32k. A type confusion flaw in Windows Win32K – ICOMP may allow an authorized attacker to gain SYSTEM privileges. CVE-2025-53132 is an elevation of privilege vulnerability in Win32k. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-53147 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2025-53156 is an information disclosure vulnerability in the Windows Storage Port Driver. Successful exploitation of the vulnerability could allow the disclosure of certain kernel memory content.

74. Elevation of Privilege - Windows Ancillary Function Driver for WinSock (CVE-2025-53718) - Medium [380]

Description: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

75. Elevation of Privilege - Windows Connected Devices Platform Service (CVE-2025-53721) - Medium [380]

Description: Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

76. Elevation of Privilege - Windows Graphics Component (CVE-2025-49743) - Medium [380]

Description: Windows Graphics Component Elevation of Privilege Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-53786 is an elevation of privilege vulnerability in Microsoft Exchange Server Hybrid Deployment. Successful exploitation of the vulnerability could allow an attacker to escalate privileges within the organization’s connected cloud environment. CVE-2025-49743 is an elevation of privilege vulnerability in Windows Graphics Component. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-50167 is an elevation of privilege vulnerability in Windows Hyper-V. Upon successful exploitation, an attacker could gain SYSTEM privileges. CVE-2025-50168 is an elevation of privilege vulnerability in Win32k. A type confusion flaw in Windows Win32K – ICOMP may allow an authorized attacker to gain SYSTEM privileges. CVE-2025-53132 is an elevation of privilege vulnerability in Win32k. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-53147 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2025-53156 is an information disclosure vulnerability in the Windows Storage Port Driver. Successful exploitation of the vulnerability could allow the disclosure of certain kernel memory content.

77. Elevation of Privilege - Windows Kernel Transaction Manager (CVE-2025-53140) - Medium [380]

Description: Windows Kernel Transaction Manager Elevation of Privilege Vulnerability

78. Elevation of Privilege - Windows Subsystem for Linux (WSL2) Kernel (CVE-2025-53788) - Medium [380]

Description: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability

79. Remote Code Execution - Microsoft Message Queuing (MSMQ) (CVE-2025-50177) - Medium [380]

Description: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Qualys: CVE-2025-50177: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing is a messaging infrastructure developed by Microsoft that enables applications to communicate asynchronously and reliably, even when they are not running on the same system or are temporarily offline. Use-after-free vulnerability in Windows Message Queuing allows an unauthenticated attacker to achieve remote code execution. Successful exploitation of the vulnerability requires an attacker to win a race condition.

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Tenable: CVE-2025-50177, CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145 are RCE vulnerabilities in Microsoft Message Queuing (MSMQ). While three of these four CVEs (CVE-2025-53143, CVE-2025-53144 and CVE-2025-53145) were assigned CVSSv3 scores of 8.8 and rated as important, CVE-2025-50177 was assigned a CVSSv3 score of 8.1 and rated as critical. Similarly, CVE-2025-50177 was assessed as “Exploitation More Likely,” while the other three were assessed as “Exploitation Less Likely.”

80. Remote Code Execution - Microsoft Teams (CVE-2025-53783) - Medium [380]

Description: Microsoft Teams Remote Code Execution Vulnerability

81. Elevation of Privilege - Azure Machine Learning (CVE-2025-49746) - Medium [377]

Description: Azure Machine Learning Elevation of Privilege Vulnerability

MS PT Extended: CVE-2025-49746 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

82. Elevation of Privilege - Azure Machine Learning (CVE-2025-49747) - Medium [377]

Description: Azure Machine Learning Elevation of Privilege Vulnerability

MS PT Extended: CVE-2025-49747 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

83. Elevation of Privilege - Azure OpenAI (CVE-2025-53767) - Medium [377]

Description: Azure OpenAI Elevation of Privilege Vulnerability

MS PT Extended: CVE-2025-53767 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

84. Memory Corruption - Chromium (CVE-2025-8292) - Medium [377]

Description: Chromium: CVE-2025-8292 Use after free in Media Stream

MS PT Extended: CVE-2025-8292 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

85. Information Disclosure - Windows Storage Port Driver (CVE-2025-53156) - Medium [376]

Description: Windows Storage Port Driver Information Disclosure Vulnerability

Qualys: Other Microsoft Vulnerability Highlights CVE-2025-53786 is an elevation of privilege vulnerability in Microsoft Exchange Server Hybrid Deployment. Successful exploitation of the vulnerability could allow an attacker to escalate privileges within the organization’s connected cloud environment. CVE-2025-49743 is an elevation of privilege vulnerability in Windows Graphics Component. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-50167 is an elevation of privilege vulnerability in Windows Hyper-V. Upon successful exploitation, an attacker could gain SYSTEM privileges. CVE-2025-50168 is an elevation of privilege vulnerability in Win32k. A type confusion flaw in Windows Win32K – ICOMP may allow an authorized attacker to gain SYSTEM privileges. CVE-2025-53132 is an elevation of privilege vulnerability in Win32k. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. CVE-2025-53147 is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock. A use-after-free flaw may allow an authenticated attacker to gain SYSTEM privileges. CVE-2025-53156 is an information disclosure vulnerability in the Windows Storage Port Driver. Successful exploitation of the vulnerability could allow the disclosure of certain kernel memory content.

86. Elevation of Privilege - Azure Portal (CVE-2025-53792) - Medium [366]

Description: Azure Portal Elevation of Privilege Vulnerability

MS PT Extended: CVE-2025-53792 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

87. Elevation of Privilege - Microsoft SQL Server (CVE-2025-24999) - Medium [366]

Description: Microsoft SQL Server Elevation of Privilege Vulnerability

88. Elevation of Privilege - Microsoft SQL Server (CVE-2025-47954) - Medium [366]

Description: Microsoft SQL Server Elevation of Privilege Vulnerability

89. Elevation of Privilege - Microsoft SQL Server (CVE-2025-49758) - Medium [366]

Description: Microsoft SQL Server Elevation of Privilege Vulnerability

90. Elevation of Privilege - Microsoft SQL Server (CVE-2025-49759) - Medium [366]

Description: Microsoft SQL Server Elevation of Privilege Vulnerability

91. Elevation of Privilege - Microsoft SQL Server (CVE-2025-53727) - Medium [366]

Description: Microsoft SQL Server Elevation of Privilege Vulnerability

92. Memory Corruption - Chromium (CVE-2025-7657) - Medium [365]

Description: Chromium: CVE-2025-7657 Use after free in WebRTC

MS PT Extended: CVE-2025-7657 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

93. Memory Corruption - Chromium (CVE-2025-8576) - Medium [365]

Description: Chromium: CVE-2025-8576 Use after free in Extensions

MS PT Extended: CVE-2025-8576 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

94. Memory Corruption - Chromium (CVE-2025-8578) - Medium [365]

Description: Chromium: CVE-2025-8578 Use after free in Cast

MS PT Extended: CVE-2025-8578 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

95. Security Feature Bypass - Chromium (CVE-2025-8582) - Medium [365]

Description: Chromium: CVE-2025-8582 Insufficient validation of untrusted input in DOM

MS PT Extended: CVE-2025-8582 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

96. Elevation of Privilege - Microsoft SharePoint (CVE-2025-53760) - Medium [363]

Description: Microsoft SharePoint Elevation of Privilege Vulnerability

97. Information Disclosure - Azure Stack Hub (CVE-2025-53793) - Medium [362]

Description: Azure Stack Hub Information Disclosure Vulnerability

Qualys: CVE-2025-53793: Azure Stack Hub Information Disclosure Vulnerability An improper authentication flaw in Azure Stack allows an unauthenticated attacker to disclose information over a network.

98. Information Disclosure - Azure Virtual Machines (CVE-2025-53781) - Medium [362]

Description: Azure Virtual Machines Information Disclosure Vulnerability

Qualys: CVE-2025-53781: Azure Virtual Machines Information Disclosure Vulnerability Hyper-V is a virtualization technology developed by Microsoft that allows you to create and run multiple virtual machines (VMs) on a single physical computer. It acts as a hypervisor, providing a layer of abstraction between the hardware and the operating systems running in the VMs. Upon successful exploitation, an attacker could disclose sensitive information. 

99. Elevation of Privilege - Windows Hyper-V (CVE-2025-53155) - Medium [358]

Description: Windows Hyper-V Elevation of Privilege Vulnerability

100. Denial of Service - Windows Hyper-V (CVE-2025-49751) - Medium [355]

Description: Windows Hyper-V Denial of Service Vulnerability

101. Elevation of Privilege - Azure Machine Learning (CVE-2025-47995) - Medium [354]

Description: Azure Machine Learning Elevation of Privilege Vulnerability

MS PT Extended: CVE-2025-47995 was published before August 2025 Patch Tuesday from 2025-07-09 to 2025-08-11

102. Elevation of Privilege - Microsoft Exchange Server Hybrid Deployment (CVE-2025-53786) - Medium [354]

Description: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability