MS Family September 2025 Routine Security Update Advisory
Overview
Microsoft(https://www.microsoft.com) has released a security update that fixes vulnerabilities in products it has supplied. Users of affected products are advised to update to the latest version.
Affected Products
Apps family
Xbox Gaming Services
Azure Family
Azure Connected Machine Agent
Microsoft HPC Pack 2019
ESU Family
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Microsoft Office Suite
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft AutoUpdate for Mac
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft Office LTSC 2024 for 32-bit editions
Microsoft Office LTSC 2024 for 64-bit editions
Microsoft Office LTSC for Mac 2021
Microsoft Office LTSC for Mac 2024
Microsoft Office for Android
Microsoft OfficePLUS
Microsoft PowerPoint 2016 (32-bit edition)
Microsoft PowerPoint 2016 (64-bit edition)
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2016 (64-bit edition)
Office Online Server
Open Source Software Suite
Azl3 kernel 6.6.96.2-1 on Azure Linux 3.0
SQL Server Family
Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)
Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 Azure Connect Feature Pack
Microsoft SQL Server 2017 for x64-based Systems (CU 31)
Microsoft SQL Server 2017 for x64-based Systems (GDR)
Microsoft SQL Server 2019 for x64-based Systems (CU 32)
Microsoft SQL Server 2019 for x64-based Systems (GDR)
Microsoft SQL Server 2022 for x64-based Systems (CU 20)
Microsoft SQL Server 2022 for x64-based Systems (GDR)
Windows Family
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 23H2 for ARM64-based Systems
Windows 11 Version 23H2 for x64-based Systems
Windows 11 Version 24H2 for ARM64-based Systems
Windows 11 Version 24H2 for x64-based Systems
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server 2022, 23H2 Edition (Server Core installation)
Windows Server 2025
Windows Server 2025 (Server Core installation)
Resolved Vulnerabilities
8 vulnerabilities rated Critical and 72 vulnerabilities rated Important were found.
Apps Family
Critical-rated privilege escalation vulnerability in Xbox Gaming Services (CVE-2025-55245)
Azure family
Critical elevation of privilege vulnerability in Azure Connected Machine Agent (CVE-2025-55316)
Critical elevation of privilege vulnerability in Azure Windows Virtual Machine Agent (CVE-2025-49692)
Critical remote code execution vulnerability in Microsoft High Performance Compute Pack (HPC) (CVE-2025-55232)
Microsoft Office Suite
Critical elevation of privilege vulnerability in Microsoft AutoUpdate (MAU) (CVE-2025-55317)
Critical remote code execution vulnerabilities in Microsoft Office Excel (CVE-2025-54896, CVE-2025-54898, CVE-2025-54899, CVE-2025-54902, CVE-2025-54903, CVE-2025-54904, CVE-2025-54900)
Critical information disclosure vulnerability in Microsoft Office Excel (CVE-2025-54901)
Critical remote code execution vulnerability in Microsoft Office PowerPoint (CVE-2025-54908)
Critical remote code execution vulnerability in Microsoft Office SharePoint (CVE-2025-54897)
Critical remote code execution vulnerability in Microsoft Office Visio (CVE-2025-54907)
Critical information disclosure vulnerability in Microsoft Office Word (CVE-2025-54905)
Critical remote code execution vulnerability in Microsoft Office (CVE-2025-54910)
Critical-grade spoofing vulnerability in Microsoft Office (CVE-2025-55243)
Critical-grade remote code execution vulnerability in Microsoft Office (CVE-2025-54906)
Open Source Software Suites
Vulnerabilities of unknown severity in Mariner (CVE-2025-39731, CVE-2025-39732, CVE-2025-39730)
SQL Server Family
Vulnerability of unknown severity in SQL Server (CVE-2024-21907)
Critical elevation of privilege vulnerability in SQL Server (CVE-2025-55227)
Information Disclosure Vulnerability of Critical Rank in SQL Server (CVE-2025-47997)
Windows Family
Critical elevation of privilege vulnerability in Capability Access Management Service (camsvc) (CVE-2025-54108)
Critical remote code execution vulnerabilities in Graphics Kernel (CVE-2025-55226, CVE-2025-55236)
Critical-grade privilege escalation vulnerability in the Graphics Kernel (CVE-2025-55223)
Critical elevation of privilege vulnerability in the Microsoft Brokering File System (CVE-2025-54105)
Urgent elevation of privilege vulnerability in Microsoft Graphics Component (CVE-2025-53800)
Critical elevation of privilege vulnerability in Microsoft Graphics Component (CVE-2025-53807)
Critical elevation of privilege vulnerability in Microsoft Virtual Hard Drive (CVE-2025-54112)
Role: Critical elevation of privilege vulnerabilities in Windows Hyper-V (CVE-2025-54091, CVE-2025-54092, CVE-2025-54098, CVE-2025-54115)
Critical elevation of privilege vulnerability in Windows Ancillary Function Driver for WinSock (CVE-2025-54099)
Critical elevation of privilege vulnerabilities in Windows BitLocker (CVE-2025-54911, CVE-2025-54912)
Critical elevation of privilege vulnerability in Windows Bluetooth Service (CVE-2025-53802)
Critical elevation of privilege vulnerability in Windows Connected Devices Platform Service (CVE-2025-54102)
Highly Critical Denial of Service Vulnerability in Windows Connected Devices Platform Service (CVE-2025-54114)
Critical elevation of privilege vulnerability in Windows DWM (CVE-2025-53801)
Critical elevation of privilege vulnerabilities in Windows Defender Firewall Service (CVE-2025-53808, CVE-2025-53810, CVE-2025-54094, CVE-2025-54104, CVE-2025-54109, CVE-2025-54915)
Critical information disclosure vulnerability in Windows Imaging Component (CVE-2025-53799)
Critical-grade denial-of-service vulnerability in Windows Internet Information Services (CVE-2025-53805)
Critical elevation of privilege vulnerability in Windows Kernel (CVE-2025-54110)
Critical information disclosure vulnerabilities in the Windows Kernel (CVE-2025-53803, CVE-2025-53804)
Critical elevation of privilege vulnerability in the Windows Local Security Authority Subsystem Service (LSASS) (CVE-2025-54894)
Critical denial of service vulnerability in Windows Local Security Authority Subsystem Service (LSASS) (CVE-2025-53809)
Critical elevation of privilege vulnerability in Windows Management Services (CVE-2025-54103)
Critical security feature bypass vulnerability in Windows MapUrlToZone (CVE-2025-54107, CVE-2025-54917)
Critical elevation of privilege vulnerability in Windows MultiPoint Services (CVE-2025-54116)
Critical remote code execution vulnerability in Windows NTFS (CVE-2025-54916)
Urgent elevation of privilege vulnerability in Windows NTLM (CVE-2025-54918)
Critical elevation of privilege vulnerability in Windows PowerShell (CVE-2025-49734)
Critical remote code execution vulnerabilities in Windows Routing and Remote Access Service (RRAS) (CVE-2025-54106, CVE-2025-54113)
Critical information disclosure vulnerabilities in Windows Routing and Remote Access Service (RRAS) (CVE-2025-53797, CVE-2025-53798, CVE-2025-54095, CVE-2025-54096, CVE-2025-54097, CVE-2025-55225, CVE-2025-53796, CVE-2025-53806)
Critical remote code execution vulnerability in Windows SMBv3 Client (CVE-2025-54101)
Critical elevation of privilege vulnerability in Windows SMB (CVE-2025-55234)
Critical elevation of privilege vulnerability in Windows SPNEGO Extended Negotiation (CVE-2025-54895)
Critical elevation of privilege vulnerability in Windows TCP/IP (CVE-2025-54093)
Critical elevation of privilege vulnerability in Windows UI XAML Maps MapControlSettings (CVE-2025-54913)
Windows UI XAML Phone DatePickerFlyout has a critical elevation of privilege vulnerability (CVE-2025-54111)
Windows Win32K – Emergency-grade remote code execution vulnerability in GRFX (CVE-2025-55228, CVE-2025-55224)
Windows Win32K – Critical-grade remote code execution vulnerability in GRFX (CVE-2025-54919)
Vulnerability Patches
The following product-specific Vulnerability Patches were made available with the September 09, 2025 Update Please use the Windows Update feature for automatic installation or refer to the URLs in the product information below to download and install.