Microsoft Sept 2025 Patch Tuesday: 45 updates fix 974 CVEs, including actively exploited EoPs in ALPC and SharePoint

Key Vulnerability Information Summary for Microsoft's September 2025 Patch Day I. Vulnerability Overview Microsoft released 45 security updates during its routine September 2025 Patch Day, fixing 974 unique vulnerabilities (of which 13 were marked as "Critical"). Vulnerability type distribution (by proportion): - Elevation of Privilege (EoP) vulnerabilities: ~45% - Remote Code Execution (RCE) vulnerabilities: ~25% - Information Disclosure: ~18% - The remainder are other types (e.g., DoS, Information Disclosure, etc.) Two high-priority vulnerabilities are being actively exploited: - (CVSS 7.8): An Elevation of Privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) - (CVSS 7.8): An Elevation of Privilege (EoP) vulnerability in SharePoint Server Additionally, 20 high-priority RCE vulnerabilities were identified, including: - : An Elevation of Privilege vulnerability in Microsoft Exchange Server, allowing a low-privilege attacker to elevate privileges and hijack any user's mailbox - : An RCE vulnerability in DNS Server, which can cause severe, self-propagating cascading risks - : The most severe RCE vulnerability in DNS Server, allowing unauthenticated attackers to execute arbitrary code on domain controllers via LDAP - : An RCE vulnerability in Windows Shell - : An RCE vulnerability in Windows Services - : An RCE vulnerability in Microsoft Word - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE vulnerability in DNS Server - : An RCE

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft Sept 2025 Patch Tuesday: 45 updates fix 974 CVEs, including actively exploited EoPs in ALPC and SharePoint