Microsoft Patch Tuesday, September 2025 Edition
Summary: Microsoft released security updates addressing more than 80 vulnerabilities in Windows and its software, including 13 rated critical, with no known zero-day or actively exploited flaws in this month's bundle. Among the critical fixes are CVE-2025-54918, an NTLM privilege escalation flaw Microsoft rates as 'Exploitation More Likely' that Immersive's Kev Breen says is exploitable over the network, and CVE-2025-55234, an 8.8 CVSS SMB client flaw that was publicly disclosed before this month.
What's compelling: Tenable's Satnam Narang notes that for the third time this year Microsoft patched more elevation-of-privilege flaws than remote code execution flaws, and nearly half of this month's fixes require an attacker to already have access to a target system - meaning the perimeter is not the only thing to defend.