Analysis of Microsoft Patch Tuesday updates - August 2025

Executive Summary

On Tuesday, 12.08.2025, Microsoft released its monthly security update, addressing 111 vulnerabilities across its products.

By severity:

• Important - 91;
• Critical - 17;
• Moderate - 2;
• Low - 1.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following issue. Fixing it is the highest priority:

• CVE-2025-53779 (CVSS 7.2; Moderate) - Windows Kerberos Elevation of Privilege Vulnerability (Elevation of Privilege). This CWE-23 (Relative Path Traversal) vulnerability can allow an attacker to elevate privileges up to a domain administrator.

Overview and trends

Microsoft’s August 2025 Patch Tuesday continues the trend of large releases, fixing 111 vulnerabilities. This total is comparable to the sizeable July release (130) and significantly higher than June (66), indicating Microsoft continues to discover and patch vulnerabilities at a high pace across its products. Key trends observed this month include:

• Focus on Elevation of Privilege (EoP) vulnerabilities: The overwhelming majority of fixes (over 40) target elevation-of-privilege issues. This affects a wide range of components, including the Windows kernel, drivers, Hyper-V, and SQL Server, pointing to Microsoft’s systematic efforts to harden core security mechanisms.
• Vulnerabilities in cloud and AI products: A standout feature this month is the presence of critical vulnerabilities in modern cloud and AI services. Of particular note is the CVE-2025-53767 vulnerability in Azure OpenAI with the maximum rating of CVSS 10.0, as well as vulnerabilities in Azure Portal, Microsoft 365 Copilot, and GitHub Copilot. This highlights the shift of attack vectors toward new, rapidly evolving technologies.
• Multiple RCEs in key applications: A significant number of remote code execution (RCE) vulnerabilities were fixed in business-critical applications such as Microsoft Office (Word, Excel, Visio), Microsoft Message Queuing (MSMQ), and Windows Routing and Remote Access Service (RRAS). This confirms that these products remain attractive targets for attackers.
• Publicly disclosed Kerberos vulnerability: The presence of a publicly disclosed—albeit moderately rated—vulnerability CVE-2025-53779 in Windows Kerberos increases the risk of exploitation. Attackers can use this information to develop exploits aimed at gaining elevated privileges in domain environments.
• High number of critical vulnerabilities: This month, 17 critical vulnerabilities were fixed. They affect a wide range of products, including Azure, Office, SQL Server, and Hyper-V, requiring a comprehensive and well-planned patch deployment process.

Full List of Vulnerabilities

Below is a table with all vulnerabilities fixed this month.

Retrospective analysis of vulnerabilities

Starting this month, we will add this section to our monthly Microsoft Patch Tuesday analysis. Here, we will provide information about vulnerabilities that, at the time the fix was released, had no public exploit and no evidence of use in malicious campaigns.

• CVE-2025-27737 - Windows Security Zone Mapping Security Feature Bypass Vulnerability (Security Feature Bypass). This vulnerability is used by the LOTUXorg trojan to elevate privileges and establish persistence, and it was fixed in April 2025.
• CVE-2025-21204 - Windows Process Activation Elevation of Privilege Vulnerability (Elevation of Privilege). A logic flaw that allows abuse of an inaccuracy in the IIS service installation process in Windows (based on the description in the discovered PoC). This vulnerability was fixed in April 2025.
• CVE-2025-32711 - M365 Copilot Information Disclosure Vulnerability (Information Disclosure). Researchers at Aim Labs published details of an exploit chain dubbed "EchoLeak". This is a zero-click attack that allows attackers to automatically extract sensitive information from Copilot context without any user interaction. The attack is carried out by sending a specially crafted email to the victim that bypasses existing protection mechanisms. The technique, called "LLM Scope Violation", leverages the AI agent’s internal mechanics to access privileged data such as chat history, files, and other organizational information. The vulnerability was fixed in June 2025.
• CVE-2025-32710 - Windows Remote Desktop Services Remote Code Execution Vulnerability (Remote Code Execution). A PoC is available on GitHub called RDP Auto-Pwn. The vulnerability was fixed in June 2025.
• CVE-2025-47175 - Microsoft PowerPoint Remote Code Execution Vulnerability (Remote Code Execution). A vulnerability in Microsoft PowerPoint that allows an attacker to execute arbitrary code by tricking a user into opening a specially crafted PPTX file. PoC A PoC is available on GitHub and generates a malicious PPTX file to trigger the vulnerability. Fixed in June 2025.
• CVE-2025-47176 - Microsoft Outlook Remote Code Execution Vulnerability (Remote Code Execution). A PoC is available on GitHub for this vulnerability. PoC The PoC demonstrates exploitation by adding a malicious mail item to Outlook containing a special synchronization path that triggers the vulnerability during mailbox scanning. Fixed in June 2025.
• CVE-2025-53770, CVE-2025-49704, CVE-2025-49706, CVE-2025-53771 - vulnerabilities in Microsoft SharePoint Server that allow remote code execution (Remote Code Execution). Exploitation is a "zero-day" attack that has been actively used by attackers worldwide since at least July 18, 2025.
• CVE-2025-47178 - Microsoft Configuration Manager Remote Code Execution Vulnerability (Remote Code Execution). The issue is an authenticated SQL injection in the WMI method UpdateClassicDeployment. An authenticated attacker can inject an arbitrary SQL query via the OfferID parameter, which ultimately can lead to remote code execution (RCE) on the database server used by Configuration Manager. A public PoC. The vulnerability was fixed in July 2025.
• CVE-2025-48799 - Windows Update Service Elevation of Privilege Vulnerability (Elevation of Privilege). Exploitation is possible by changing Storage Sense settings so new apps are saved to an additional, non-system drive. When installing an app (for example, via winget from msstore), the update service creates a temporary cache folder on that drive (WUDownloadCache) and then deletes it. The vulnerability is that the deletion process improperly handles symbolic links, allowing the system service’s delete operation to be redirected to an arbitrary folder on the system. A PoC has been published on GitHub PoC for this vulnerability. It was fixed in July 2025.
• CVE-2025-49683 - Microsoft Virtual Hard Disk Remote Code Execution Vulnerability (Remote Code Execution). The vulnerability is related to improper handling of corrupted virtual disk files (VHDX). The published PoC PoC demonstrates exploitation of the vulnerability. It was fixed in July 2025.
• CVE-2025-49721 - Windows Fast FAT File System Driver Elevation of Privilege Vulnerability (Elevation of Privilege). A heap buffer overflow that allows a user to elevate privileges to SYSTEM. The discovered PoC PoC notes that this may be only part of an exploit for this vulnerability. Fixed in July 2025.

Conclusion

Microsoft’s August 2025 security update is another large and critically important release, containing 111 fixes, 17 of which are rated "Critical". This volume requires IT administrators to respond quickly and carefully plan patch deployment. Priority should be given to the immediate installation of updates for the following vulnerabilities:

• The publicly disclosed CVE-2025-53779 (Windows Kerberos, EoP), to minimize the risks associated with its public disclosure.
• The critical vulnerability CVE-2025-53767 (Azure OpenAI, EoP) with a CVSS 10.0 rating, as it represents the maximum level of threat.

It is recommended to prioritize updating servers running Microsoft Office, SQL Server, MSMQ and RRAS due to the large number of RCE vulnerabilities. Particular attention should be paid to cloud services such as Azure and Microsoft 365 Copilot, as they are becoming an increasingly frequent target for attacks. Timely patching remains a key element of protecting corporate infrastructure. Delaying updates—especially for publicly disclosed vulnerabilities and those with the highest CVSS scores—creates an unacceptable level of risk. It is also worth paying attention to the publicly disclosed vulnerabilities described in the Retrospective analysis of vulnerabilities section: the likelihood of their exploitation has increased dramatically, and if you still have not installed previous security updates, now is the right time.