Microsoft's security release of 8 July 2025
Patch Tuesday, July 2025, page 2
As of , CISA lists two of the 128 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-49704, Microsoft SharePoint Remote Code Execution.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 101 | CVE-2025-49686Windows TCP/IP Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 102 | CVE-2025-49693Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 103 | CVE-2025-49694Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 104 | CVE-2025-49700Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 105 | CVE-2025-49705Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 106 | CVE-2025-49714Visual Studio Code Python Extension Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 107 | CVE-2025-49725Windows Notification Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 108 | CVE-2025-49726Windows Notification Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 109 | CVE-2025-49732Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 110 | CVE-2025-49733Win32k Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 111 | CVE-2025-49738Microsoft PC Manager Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 112 | CVE-2025-49742Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 113 | CVE-2025-49690Capability Access Management Service (camsvc) Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.00 |
| 114 | CVE-2025-48819Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege | None | Not on CISA's list | 7.1 High | 0.00 |
| 115 | CVE-2025-47975Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 116 | CVE-2025-49678NTFS Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 117 | CVE-2025-49685Windows Search Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 118 | CVE-2025-49699Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.00 |
| 119 | CVE-2025-49727Win32k Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 120 | CVE-2025-49737Microsoft Teams Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 121 | CVE-2025-47999Windows Hyper-V Denial of Service | None | Not on CISA's list | 6.8 Medium | 0.00 |
| 122 | CVE-2025-48001Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.8 Medium | 0.00 |
| 123 | CVE-2025-48803Windows Virtualization-Based Security (VBS) Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 124 | CVE-2025-48811Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 125 | CVE-2025-21195Azure Service Fabric Runtime Elevation of Privilege | None | Not on CISA's list | 6.0 Medium | 0.00 |
| 126 | CVE-2025-26636Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.00 |
| 127 | CVE-2025-49756Office Developer Platform Security Feature Bypass | None | Not on CISA's list | 3.3 Low | 0.00 |
| 128 | CVE-2025-49731Microsoft Teams Elevation of Privilege | None | Not on CISA's list | 3.1 Low | 0.00 |