Microsoft Patch Tuesday, July 2025 Edition

Summary: Microsoft released updates addressing at least 137 security vulnerabilities in Windows and supported software, with 14 rated critical and none known to be actively exploited. Among them, CVE-2025-47981 carries a CVSS score of 9.8 as a pre-authentication remote code execution flaw affecting Windows 10 1607 and above and all current Windows Server versions, while CVE-2025-49719 is a publicly disclosed SQL Server information disclosure flaw with proof-of-concept code available.
Bottom line: CVE-2025-49719 can be exploited without authentication and reaches SQL Server 2016 through 2022, and as Action1's Mike Walters noted, many third-party applications depend on SQL Server and the affected drivers, so the exposure extends past direct SQL Server users to organizations handling regulated data.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-47178 CVE-2025-47981 CVE-2025-49695 CVE-2025-49696 CVE-2025-49697 CVE-2025-49702 CVE-2025-49719 CVE-2025-49740
Related: Microsoft Patch Tuesday for July 2025 — Snort rules and prominent vulnerabilities Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026