Analysis of Microsoft Patch Tuesday updates - July 2025

Executive Summary

On Tuesday, July 08, 2025, Microsoft released its monthly security patch addressing 130 vulnerabilities across its products.

By severity:

• Important - 116;
• Critical - 12;
• Low - 1;
• Moderate - 1.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following vulnerability. Fixing it is the highest priority:

• CVE-2025-49719 (CVSS 7.5; Important) - Microsoft SQL Server Information Disclosure Vulnerability (Information Disclosure). A vulnerability in Microsoft SQL Server related to improper input validation allows an unauthenticated attacker to disclose sensitive information over the network. Successful exploitation may lead to data leakage, including credentials, database structure, or other sensitive details. The vulnerability has been publicly disclosed, increasing the risk of active exploitation.

General Overview and trends

Microsoft’s July 2025 Patch Tuesday includes fixes for 130 vulnerabilities, which is significantly higher than the number addressed in June (66). This month is characterized by an especially large update that requires increased attention from IT administrators and cybersecurity professionals. Key trends observed this month include:

• Mass patching of RRAS RCEs: The most notable feature of this update is a large... in this service and requires immediate patch deployment.
• High concentration of elevation-of-privilege vulnerabilities (EoP): A significant number of fixes are focused on privilege escalation issues in various Windows components. This indicates ongoing efforts... to strengthen the security of the Windows kernel and related components.
• Critical vulnerabilities in key products: This month, critical vulnerabilities were found across a wide range of Microsoft products, including SPNEGO, Office, SharePoint, Hyper-V, and SQL Server. This highlights the need for a comprehensive approach to vulnerability management.
• Publicly disclosed SQL Server vulnerability: The presence of a publicly disclosed vulnerability (CVE-2025-49719) in Microsoft SQL Server significantly increases the risk of exploitation. Attackers can quickly develop exploits for this vulnerability, so applying the fix should be prioritized.
• BitLocker security feature bypass vulnerabilities: The discovery of security feature bypass vulnerabilities in BitLocker raises concerns about the integrity of disk encryption. Although these vulnerabilities are not critical, they should be considered as part of risk assessments.

Full List of Vulnerabilities

Below is a table of all vulnerabilities fixed this month.

Conclusion

Microsoft’s July Patch Tuesday is one of the largest updates in recent times, covering 130 vulnerabilities. This volume requires IT administrators to plan carefully and deploy updates promptly. Priority should be given to immediately installing patches for critical vulnerabilities, especially CVE-2025-47981 (SPNEGO, RCE) and the publicly disclosed CVE-2025-49719 (SQL Server, Information Disclosure). Vulnerabilities in the Windows Routing and Remote Access Service (RRAS) also demand top priority due to their high number and potentially serious impact. It is recommended to prioritize updates for Office, SharePoint, SQL Server and Hyper-V, given their critical role in corporate infrastructure and the high likelihood of exploitation. You should not overlook the need to update BitLocker to eliminate security feature bypass vulnerabilities. With the continuously growing number of vulnerabilities, timely patching and proactive vulnerability management remain key elements of a cybersecurity strategy. Delaying updates creates an unjustified risk to infrastructure security.