Full Report
Microsoft has released its monthly security update for July 2025, which includes 132 vulnerabilities affecting a range of products, including 14 that Microsoft marked as “critical.”
Analysis Summary
# Vulnerability: Microsoft July 2025 Security Updates Summary (Critical RCEs Highlighted)
## CVE Details
- CVE ID: Multiple (e.g., CVE-2025-49735, CVE-2025-49704, CVE-2025-47981, etc.)
- CVSS Score: Varied. (e.g., CVE-2025-49735: 8.1, CVE-2025-49704: 7.7, CVE-2025-48822: 8.6, CVE-2025-47981: 9.8, CVE-2025-49717: 8.5, CVE-2025-47980: Information Disclosure)
- CWE: Cryptographic protocol vulnerability, Code Injection, Use After Free (UAF), Out-of-Bounds Read/Write, Heap-based Buffer Overflow.
## Affected Systems
- Products: Microsoft Windows (including KDC Proxy Service, Hyper-V DDA), Microsoft Office, Microsoft Word, Microsoft SharePoint Server, SPNEGO Extended Negotiation (NEGOEX), Microsoft SQL Server, Windows Imaging Component.
- Versions:
- Windows KDC Proxy Service (KPSSVC): Windows servers configured as Kerberos KDC Proxy Protocol servers (Domain Controllers excluded).
- SharePoint: Affected versions not specified, requires authenticated Site Member permissions.
- Windows 10 (v1607 and above): Affected by CVE-2025-47981 if the GPO "Network security: Allow PKU2U authentication requests to this computer to use online identities" is enabled by default.
- Windows Hyper-V DDA: Affected versions not specified.
- SQL Server: Affected versions not specified.
- Configurations: Specific configurations like KDC Proxy role or default GPO settings are relevant for certain vulnerabilities.
## Vulnerability Description
Microsoft released 132 vulnerabilities in the July 2025 security update, including 14 critical flaws. Key critical vulnerabilities include:
* **CVE-2025-49735 (KDC Proxy RCE):** An unauthenticated attacker can leverage a cryptographic protocol flaw in the Windows KDC Proxy Service via a specially-crafted application to achieve Remote Code Execution on affected Windows servers.
* **CVE-2025-49704 (SharePoint RCE):** An authenticated attacker (minimum Site Member) who can reach the server over the network can exploit improper code generation control (code injection) in SharePoint to execute arbitrary code.
* **CVE-2025-47981 (NEGOEX RCE):** A critical (CVSS 9.8) heap-based buffer overflow in the NEGOEX Security Mechanism allows an unauthenticated network attacker to execute code if the default GPO is enabled on Windows clients.
* **CVE-2025-49717 (SQL Server RCE):** A heap-based buffer overflow in Microsoft SQL Server allowing network RCE.
* **Microsoft Office/Word RCEs (CVE-2025-49695, etc.):** Several RCEs including Use After Free (UAF) and Out-of-Bounds Read flaws, often exploitable by interacting with crafted files.
* **CVE-2025-48822 (Hyper-V DDA RCE):** An out-of-bounds read flaw in Hyper-V DDA that could allow local code execution.
* **CVE-2025-47980 (Information Disclosure):** Allows an attacker to read small portions of heap memory via the Windows Imaging Component.
## Exploitation
- Status: **None of the included vulnerabilities were observed being actively exploited in the wild** at the time of the advisory. However, exploitation is described as "more likely" for several high-severity flaws (e.g., CVE-2025-49735, CVE-2025-49704, CVE-2025-47981, CVE-2025-49701, CVE-2025-49724).
- Complexity: Varies from **Low** (e.g., SharePoint RCE, Office UAFs) to **High** (CVE-2025-49735).
- Attack Vector: Primarily **Network** for most RCEs, but CVE-2025-48822 is noted as **Local**.
## Impact
- Confidentiality: High (For RCEs and Information Disclosure like CVE-2025-47980).
- Integrity: High (RCEs allow arbitrary code execution, leading to complete system compromise).
- Availability: High (RCEs can lead to denial of service or system instability).
## Remediation
### Patches
- Microsoft has released security updates that patch all disclosed vulnerabilities for July 2025. Customers must apply the relevant updates for their installed products.
### Workarounds
- Specific workarounds are detailed for individual CVEs (e.g., for CVE-2025-49735, ensuring the system is *not* configured as a KDC Proxy Server; addressing the GPO setting for CVE-2025-47981). Customers must consult the full Microsoft update guide for specific product workarounds.
## Detection
- Indicators of Compromise (IOCs): Not specifically listed, but network indicators targeting the specific protocols or file types associated with the RCEs would be relevant.
- Detection Methods and Tools:
- **Snort Rules:** New Snort rulesets are available to detect exploitation attempts:
- Snort 2 Rules: 64435, 64436, 65092, 65096 – 65107, 65110 – 65113.
- Snort 3 Rules: 301114, 301268 – 301272.
- Cisco Security Firewall customers should update their SRU.
## References
- Vendor Advisories: Microsoft Security Update Guide for July 2025.
- Relevant links - defanged:
- hxxps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-49735
- hxxps://www.snort.org/