Full Report
Researchers are especially concerned about a high-severity defect in SQL Server and a critical vulnerability in SPNEGO, a foundational protocol. The post Microsoft Patch Tuesday addresses 130 vulnerabilities, none actively exploited appeared first on CyberScoop.
Analysis Summary
# Vulnerability: Critical RCE in SPNEGO and Information Disclosure in SQL Server Highlighted in July 2025 Patch Tuesday
## CVE Details
- CVE ID: CVE-2025-47981 (Most Critical)
- CVSS Score: 9.8 (Critical) (For CVE-2025-47981)
- CVE ID: CVE-2025-49719 (High Severity)
- CVSS Score: 7.5 (High) (For CVE-2025-49719)
- CWE: Not specified in detail, but CVE-2025-49719 relates to improper input validation/uninitialized memory access.
## Affected Systems
- Products: Windows (related to SPNEGO), Microsoft SQL Server, Microsoft Office (16 vulnerabilities addressed, including 4 noted as more likely to be exploited).
- Versions: SQL Server versions spanning releases from 2016 through 2022 are affected by CVE-2025-49719. Specific versions for all 130 vulnerabilities are available in the vendor advisory.
- Configurations: N/A for SPNEGO RCE, which affects a foundational negotiation protocol.
## Vulnerability Description
Microsoft addressed 130 vulnerabilities including two of significant concern:
1. **CVE-2025-47981 (SPNEGO RCE):** A Remote Code Execution vulnerability in the SPNEGO Extended Negotiation protocol. This flaw allows attackers to execute arbitrary code remotely before authentication.
2. **CVE-2025-49719 (SQL Server Information Disclosure):** A vulnerability in SQL Server likely stemming from improper input validation in memory management, leading to uninitialized memory access. This allows attackers to retrieve remnants of sensitive data, such as credentials or connection strings.
## Exploitation
- Status: **CVE-2025-47981:** Exploitation status not explicitly stated, but highly likely to be targeted due to severity. **CVE-2025-49719:** PoC exploit code has been shared publicly.
- Complexity: **CVE-2025-47981:** Low attack complexity, unauthenticated pre-authentication RCE with no user interaction required. **CVE-2025-49719:** Exploitation is rated as "less likely" by Microsoft, but public disclosure increases risk.
- Attack Vector: **CVE-2025-47981:** Network (Remote).
## Impact
- Confidentiality: **CVE-2025-49719:** High (Retrieval of sensitive data like credentials).
- Integrity: **CVE-2025-47981:** High (Remote Code Execution).
- Availability: Unspecified, but RCE can lead to service disruption.
## Remediation
### Patches
- Patches are available as part of the July 2025 Microsoft Patch Tuesday release. All 130 vulnerabilities, including the critical ones, are addressed in these updates.
### Workarounds
- No specific workarounds were detailed in the provided summary, emphasizing immediate patching, especially for CVE-2025-47981.
## Detection
- **Indicators of Compromise:** Standard IoCs associated with exploiting memory corruption flaws in SQL Server or network activity related to SPNEGO authentication failure/success patterns preceding lateral movement.
- **Detection Methods and Tools:** Defenders are strongly encouraged to patch quickly and hunt down exposed systems aggressively due to the severity and immediate public awareness of the flaws.
## References
- Vendor Advisory: [msrc.microsoft.com/update-guide/releaseNote/2025-Jul] (Defanged)
- NVD Entry (Example for RCE): [nvd.nist.gov/vuln/detail/CVE-2025-47981] (Defanged)
- NVD Entry (Example for SQL Info Leak): [nvd.nist.gov/vuln/detail/CVE-2025-49719] (Defanged)