Full Report
Researchers are especially concerned about a high-severity defect in SQL Server and a critical vulnerability in SPNEGO, a foundational protocol. The post Microsoft Patch Tuesday addresses 130 vulnerabilities, none actively exploited appeared first on CyberScoop.
Analysis Summary
# Vulnerability: Critical RCE in SPNEGO and Information Disclosure in SQL Server (July 2025 Patch Tuesday)
## CVE Details
- CVE ID: Multiple (Key Focus: CVE-2025-47981, CVE-2025-49719)
- CVSS Score: 9.8 (Critical) for CVE-2025-47981; 7.5 (High) for CVE-2025-49719
- CWE: Not explicitly detailed, but CVE-2025-47981 suggests potential authentication bypass/RCE, and CVE-2025-49719 indicates improper input validation leading to memory disclosure.
## Affected Systems
- Products: Windows (for SPNEGO vulnerability), Microsoft SQL Server, Microsoft Office and standalone Office products.
- Versions: SQL Server versions spanning releases from 2016 through 2022 are mentioned regarding CVE-2025-49719. Specific versions for SPNEGO and Office are not detailed in the summary but are within the patch release.
- Configurations: N/A, though CVE-2025-47981 affects the foundational SPNEGO protocol used for negotiating authentication.
## Vulnerability Description
Microsoft addressed a total of 130 vulnerabilities. Two vulnerabilities receive specific attention:
1. **CVE-2025-47981 (Critical, CVSS 9.8)**: A Remote Code Execution (RCE) vulnerability existing in Windows SPNEGO Extended Negotiation. This flaw allows for unauthenticated, pre-authentication RCE with low attack complexity and no required user interaction.
2. **CVE-2025-49719 (High, CVSS 7.5)**: An Information Disclosure vulnerability in SQL Server, likely stemming from improper input validation in memory management. This can allow an attacker to read uninitialized memory, potentially exposing sensitive data like credentials or connection strings.
## Exploitation
- Status: **None actively exploited in the wild** according to Microsoft. However, a **Proof-of-Concept (PoC) exploit is publicly available** for SQL Server vulnerability CVE-2025-49719.
- Complexity: Low (for CVE-2025-47981).
- Attack Vector: Network (for CVE-2025-47981, enabling unauthenticated RCE).
## Impact
- Confidentiality: High (CVE-2025-49719 allows retrieval of sensitive data).
- Integrity: High (CVE-2025-47981 allows remote code execution).
- Availability: Potential impact due to RCE exploitation scenarios.
## Remediation
### Patches
- Official patches are available as part of the Microsoft July 2025 Patch Tuesday updates.
- Users are strongly encouraged to apply patches for **CVE-2025-47981** immediately due to its critical, pre-authentication RCE nature.
### Workarounds
- The text does not explicitly list workarounds, but given the nature of CVE-2025-47981 (SPNEGO RCE), network segmentation or disabling services utilizing SPNEGO negotiation (if feasible) might serve as temporary mitigations until patching is complete.
## Detection
- Detection should focus on hunting for signs of exploitation attempts targeting SPNEGO negotiation processes.
- For CVE-2025-49719, monitoring SQL Server memory access anomalies or unusual outbound connections from database servers following failed/successful query attempts could be relevant indicators.
- Defenders are encouraged to "hunt down exposed systems" for CVE-2025-47981.
## References
- Vendor Advisories: Microsoft’s Security Response Center update guide for July 2025: hxxps://msrc.microsoft.com/update-guide/releaseNote/2025-Jul
- CVE NVD Links (Provided in text context): hxxps://nvd.nist.gov/vuln/detail/CVE-2025-49719, hxxps://nvd.nist.gov/vuln/detail/CVE-2025-47981