Full Report
Today is Microsoft's July 2025 Patch Tuesday, which includes security updates for 137 flaws, including one publicly disclosed zero-day vulnerability in Microsoft SQL Server. [...]
Analysis Summary
# Vulnerability: Microsoft July 2025 Patch Tuesday Summary (Includes SQL Server Zero-Day)
## CVE Details
- **CVE ID:** Summary includes multiple CVEs listed in the article (e.g., CVE-2025-49704, CVE-2025-36357, CVE-2025-36350, CVE-2025-47988, etc.). The zero-day is not explicitly numbered but is a flaw in Microsoft SQL Server.
- **CVSS Score:** Not universally provided, but **14 Critical** vulnerabilities were fixed, including 10 RCEs. Specific scores for individual CVEs require referencing the full report. The highest severity mentioned is Critical.
- **CWE:** Not specified for the collection, but the SQL Server zero-day involves disclosure of data from uninitialized memory.
## Affected Systems
- **Products:** Microsoft SQL Server (Zero-Day), Microsoft Office (unspecified versions susceptible to RCE via document opening/preview), Microsoft SharePoint, Azure Monitor Agent, AMD Processors (Side-Channel), various Windows components (Kernel, Graphics, IME, UPnP, VBS, etc.).
- **Versions:** Specific vulnerable versions are not detailed in this summary but can be found in the vendor advisory. **Microsoft Office LTSC for Mac 2021 and 2024** are specifically noted as *not yet having patches available*.
- **Configurations:** SQL Server flaw impacts remote, unauthenticated attackers. SharePoint RCE requires the attacker to have an account on the platform.
## Vulnerability Description
This Patch Tuesday addresses 137 flaws. The most critical is a **publicly disclosed zero-day RCE/Information Disclosure vulnerability in Microsoft SQL Server**. This flaw, caused by improper input validation, allows an unauthenticated remote attacker to **disclose information from uninitialized memory over a network.**
Numerous critical Remote Code Execution (RCE) flaws exist in **Microsoft Office**, exploitable by opening a malicious document or viewing it in the preview pane. A critical RCE exists in **Microsoft SharePoint (CVE-2025-49704)**, exploitable by a remote attacker with platform account credentials. Additionally, two Critical severity side-channel vulnerabilities affecting AMD processors were patched (CVE-2025-36357, CVE-2025-36350).
## Exploitation
- **Status:** The **Microsoft SQL Server flaw is publicly disclosed/actively exploited** (Zero-Day). Several critical RCEs were also fixed, suggesting a high likelihood of active exploitation attempts on similar flaws.
- **Complexity:** The SQL Server flaw is exploitable remotely by an unauthenticated attacker; complexity is likely **Low** for the zero-day. Office RCEs are often **Low/Medium** complexity if only opening a file is required.
- **Attack Vector:** Primarily **Network** for the SQL Server and SharePoint RCEs.
## Impact
- **Confidentiality:** High (Explicitly stated for the SQL Server zero-day allowing information disclosure).
- **Integrity:** High (Implied by 10 Critical RCEs fixed).
- **Availability:** Moderate to High (Implied by RCE/DoS potential in critical components like SQL Server and Windows services).
## Remediation
### Patches
- **Microsoft SQL Server:** Install the latest version and update the **Microsoft OLE DB Driver 18 or 19**.
- **Microsoft SharePoint:** Install the security update addressing **CVE-2025-49704**.
- **General Systems:** Apply all relevant security updates released during the July 2025 Patch Tuesday for all listed CVEs.
### Workarounds
- **Microsoft Office LTSC for Mac 2021 and 2024:** Note that security updates are **not yet available** for these products. Monitor vendor communications for imminent fixes. (No other specific vendor workarounds were detailed in the summary provided).
## Detection
- **Indicators of Compromise:** Not explicitly detailed, but monitoring for unauthorized memory access attempts or unusual network traffic directed at SQL Server instances is advised.
- **Detection Methods and Tools:** Apply security updates and utilize vulnerability management tools scanning for missing Microsoft July 2025 security bulletins.
## References
- Vendor Advisory (General): [Microsoft July 2025 Patch Tuesday Advisory] (Requires searching MSRC based on date)
- Full Report Link (Defanged): hxxps://www.bleepingcomputer[.]com/microsoft-patch-tuesday-reports/Microsoft-Patch-Tuesday-July-2025[.]html
- Specific Advisory Link (SharePoint): hxxps://msrc[.]microsoft[.]com/update-guide/en-US/advisory/CVE-2025-49704