Microsoft's security release of 8 July 2025
Patch Tuesday, July 2025
As of , CISA lists two of the 128 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-49704, Microsoft SharePoint Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2025-49704Microsoft SharePoint Remote Code Execution. Listed by CISA on 22 July 2025, 14 days after the release
- CVE-2025-49706Microsoft SharePoint Server Spoofing. Listed by CISA on 22 July 2025, 14 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 128 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 126 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 6 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-49704Microsoft SharePoint Remote Code Execution | Active | Patch this weekListed | 8.8 High | 0.99 |
| 2 | CVE-2025-49706Microsoft SharePoint Server Spoofing | Active | Patch this weekListed | 6.5 Medium | 0.99 |
| 3 | CVE-2025-47981SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.41 |
| 4 | CVE-2025-47984Windows GDI Information Disclosure | None | Not on CISA's list | 7.5 High | 0.23 |
| 5 | CVE-2025-49719Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 7.5 High | 0.15 |
| 6 | CVE-2025-49724Windows Connected Devices Platform Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.10 |
| 7 | CVE-2025-49718Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 7.5 High | 0.04 |
| 8 | CVE-2025-47178Microsoft Configuration Manager Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.03 |
| 9 | CVE-2025-47994Microsoft Office Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 10 | CVE-2025-47987Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 11 | CVE-2025-49683Microsoft Virtual Hard Disk Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 12 | CVE-2025-49716Windows Netlogon Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 13 | CVE-2025-47978Windows Kerberos Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 14 | CVE-2025-47998Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 15 | CVE-2025-48817Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 16 | CVE-2025-48824Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2025-49657Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2025-49663Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2025-49668Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2025-49669Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 21 | CVE-2025-49672Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 22 | CVE-2025-49673Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 23 | CVE-2025-49674Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 24 | CVE-2025-49676Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 25 | CVE-2025-49688Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 26 | CVE-2025-49701Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 27 | CVE-2025-49729Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 28 | CVE-2025-49739Visual Studio Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 29 | CVE-2025-49740Windows SmartScreen Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.01 |
| 30 | CVE-2025-49753Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 31 | CVE-2025-48822Windows Hyper-V Discrete Device Assignment (DDA) Remote Code Execution | None | Not on CISA's list | 8.6 High | 0.01 |
| 32 | CVE-2025-49717Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 8.5 High | 0.01 |
| 33 | CVE-2025-49695Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 34 | CVE-2025-49696Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 35 | CVE-2025-49697Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 36 | CVE-2025-33054Remote Desktop Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 37 | CVE-2025-49735Windows KDC Proxy Service (KPSSVC) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 38 | CVE-2025-47972Windows Input Method Editor (IME) Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 39 | CVE-2025-49691Windows Miracast Wireless Display Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 40 | CVE-2025-47971Microsoft Virtual Hard Disk Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 41 | CVE-2025-47973Microsoft Virtual Hard Disk Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 42 | CVE-2025-48799Windows Update Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 43 | CVE-2025-49667Windows Win32 Kernel Subsystem Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 44 | CVE-2025-49689Microsoft Virtual Hard Disk Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 45 | CVE-2025-49698Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 46 | CVE-2025-49702Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 47 | CVE-2025-49703Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 48 | CVE-2025-49711Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 49 | CVE-2025-49721Windows Fast FAT File System Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 50 | CVE-2025-49730Microsoft Windows QoS Scheduler Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 51 | CVE-2025-47988Azure Monitor Agent Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 52 | CVE-2025-48814Remote Desktop Licensing Service Security Feature Bypass | None | Not on CISA's list | 7.5 High | 0.01 |
| 53 | CVE-2025-49680Windows Performance Recorder (WPR) Denial of Service | None | Not on CISA's list | 7.3 High | 0.01 |
| 54 | CVE-2025-49682Windows Media Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 55 | CVE-2025-49666Windows Server Setup and Boot Event Collection Remote Code Execution | None | Not on CISA's list | 7.2 High | 0.01 |
| 56 | CVE-2025-48821Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.01 |
| 57 | CVE-2025-49677Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 58 | CVE-2025-49744Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 59 | CVE-2025-48003Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 60 | CVE-2025-48800Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 61 | CVE-2025-48804Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 62 | CVE-2025-48818Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 63 | CVE-2025-48802Windows SMB Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 64 | CVE-2025-49670Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 65 | CVE-2025-49671Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 66 | CVE-2025-49681Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 67 | CVE-2025-47980Windows Imaging Component Information Disclosure | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 68 | CVE-2025-48823Windows Cryptographic Services Information Disclosure | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 69 | CVE-2025-48002Windows Hyper-V Information Disclosure | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 70 | CVE-2025-49722Windows Print Spooler Denial of Service | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 71 | CVE-2025-48808Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 72 | CVE-2025-48809Windows Secure Kernel Mode Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 73 | CVE-2025-48810Windows Secure Kernel Mode Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 74 | CVE-2025-48812Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 75 | CVE-2025-49658Windows Transport Driver Interface (TDI) Translation Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 76 | CVE-2025-49664Windows User-Mode Driver Framework Host Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 77 | CVE-2025-49684Windows Storage Port Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 78 | CVE-2025-49760Windows Storage Spoofing | None | Not on CISA's list | 3.5 Low | 0.01 |
| 79 | CVE-2025-47986Universal Print Management Service Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 80 | CVE-2025-49687Windows Input Method Editor (IME) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 81 | CVE-2025-49723Windows StateRepository API Server file Tampering | None | Not on CISA's list | 8.8 High | 0.00 |
| 82 | CVE-2025-47159Windows Virtualization-Based Security (VBS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 83 | CVE-2025-47976Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 84 | CVE-2025-47982Windows Storage VSP Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 85 | CVE-2025-47985Windows Event Tracing Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 86 | CVE-2025-47991Windows Input Method Editor (IME) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 87 | CVE-2025-47993Microsoft PC Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 88 | CVE-2025-47996Windows MBT Transport Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 89 | CVE-2025-48000Windows Connected Devices Platform Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 90 | CVE-2025-48805Microsoft MPEG-2 Video Extension Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 91 | CVE-2025-48806Microsoft MPEG-2 Video Extension Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 92 | CVE-2025-48815Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 93 | CVE-2025-48816HID Class Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 94 | CVE-2025-48820Windows AppX Deployment Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 95 | CVE-2025-49659Windows Transport Driver Interface (TDI) Translation Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 96 | CVE-2025-49660Windows Event Tracing Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 97 | CVE-2025-49661Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 98 | CVE-2025-49665Workspace Broker Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 99 | CVE-2025-49675Kernel Streaming WOW Thunk Service Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 100 | CVE-2025-49679Windows Shell Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 8 July 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.