Microsoft's security release of 9 September 2025
Patch Tuesday, September 2025
As of , CISA lists none of the 80 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2025-54897, Microsoft SharePoint Remote Code Execution.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 80 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 80 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 3 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-54897Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.20 |
| 2 | CVE-2025-54918Windows NTLM Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.20 |
| 3 | CVE-2025-55234Windows SMB Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.20 |
| 4 | CVE-2025-54110Windows Kernel Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.04 |
| 5 | CVE-2025-54098Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 6 | CVE-2025-54101Windows SMB Client Remote Code Execution | None | Not on CISA's list | 4.8 Medium | 0.03 |
| 7 | CVE-2025-55232Microsoft High Performance Compute (HPC) Pack Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 8 | CVE-2025-54916Windows NTFS Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 9 | CVE-2025-54106Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 10 | CVE-2025-54113Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 11 | CVE-2025-55227Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 12 | CVE-2025-54910Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.01 |
| 13 | CVE-2025-53800Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 14 | CVE-2025-54896Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 15 | CVE-2025-54898Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 16 | CVE-2025-54899Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 17 | CVE-2025-54900Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 18 | CVE-2025-54902Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 19 | CVE-2025-54903Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 20 | CVE-2025-54904Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 21 | CVE-2025-54906Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 22 | CVE-2025-54907Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 23 | CVE-2025-54908Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2025-54912Windows BitLocker Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2025-53805HTTP.sys Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 26 | CVE-2025-55243Microsoft OfficePlus Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 27 | CVE-2025-54116Windows MultiPoint Services Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 28 | CVE-2025-54911Windows BitLocker Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 29 | CVE-2025-54905Microsoft Word Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 30 | CVE-2025-47997Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 31 | CVE-2025-53796Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 32 | CVE-2025-53797Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 33 | CVE-2025-53798Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 34 | CVE-2025-53806Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 35 | CVE-2025-53809Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 36 | CVE-2025-54095Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 37 | CVE-2025-54096Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 38 | CVE-2025-54097Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 39 | CVE-2025-55225Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 40 | CVE-2025-53799Windows Imaging Component Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 41 | CVE-2025-53803Windows Kernel Memory Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 42 | CVE-2025-53804Windows Kernel-Mode Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 43 | CVE-2025-54901Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 44 | CVE-2025-54107MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 45 | CVE-2025-54917MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 46 | CVE-2025-49692Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 47 | CVE-2025-53801Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 48 | CVE-2025-54091Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 49 | CVE-2025-54092Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 50 | CVE-2025-54102Windows Connected Devices Platform Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 51 | CVE-2025-54111Windows UI XAML Phone DatePickerFlyout Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 52 | CVE-2025-54894Local Security Authority Subsystem Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 53 | CVE-2025-54895SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 54 | CVE-2025-54913Windows UI XAML Maps MapControlSettings Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 55 | CVE-2025-55224Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 56 | CVE-2025-55228Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 57 | CVE-2025-55245Xbox Gaming Services Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 58 | CVE-2025-55316Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 59 | CVE-2025-55317Microsoft AutoUpdate (MAU) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 60 | CVE-2025-54919Windows Graphics Component Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.00 |
| 61 | CVE-2025-54103Windows Management Service Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.00 |
| 62 | CVE-2025-55236Graphics Kernel Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.00 |
| 63 | CVE-2025-49734PowerShell Direct Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 64 | CVE-2025-53802Windows Bluetooth Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 65 | CVE-2025-53807Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 66 | CVE-2025-54093Windows TCP/IP Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 67 | CVE-2025-54099Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 68 | CVE-2025-54105Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 69 | CVE-2025-54108Capability Access Management Service (camsvc) Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 70 | CVE-2025-54112Microsoft Virtual Hard Disk Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 71 | CVE-2025-54114Windows Connected Devices Platform Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 72 | CVE-2025-54115Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 73 | CVE-2025-55223DirectX Graphics Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 74 | CVE-2025-53808Windows Defender Firewall Service Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 75 | CVE-2025-53810Windows Defender Firewall Service Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 76 | CVE-2025-54094Windows Defender Firewall Service Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 77 | CVE-2025-54104Windows Defender Firewall Service Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 78 | CVE-2025-54109Windows Defender Firewall Service Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 79 | CVE-2025-54915Windows Defender Firewall Service Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 80 | CVE-2025-55226Graphics Kernel Remote Code Execution | None | Not on CISA's list | 6.7 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 9 September 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.