Microsoft Fixes 80 Flaws — Including SMB Priv Esc and Azure CVSS 10.0 Bugs
Summary: Microsoft's September Patch Tuesday addressed 80 vulnerabilities, eight rated Critical and 72 Important, with none exploited in the wild as a zero-day and 38 of them privilege escalation flaws. The publicly known bug is CVE-2025-55234 (CVSS 8.8), an SMB privilege escalation enabling relay attacks, while the highest-scoring flaw is CVE-2025-54914 (CVSS 10.0) in Azure Networking, which requires no customer action.
What you should know: CVE-2025-55234 is one where patching alone does not close the exposure: the update adds auditing for SMB signing and EPA, leaving administrators to determine which clients cannot support the hardening before relay attacks can be ruled out. Separately, a CVSS 10.0 Azure Networking flaw sits outside the Release Notes and outside customer control, a reminder that the cloud half of the estate is patched on someone else's schedule.