CVE tracker

Microsoft Patch Tuesday

What Microsoft fixes on the second Tuesday of every month – straight from the official Security Update Guide: number of vulnerabilities, critical and already exploited ones (zero-days), affected products and the history of the last 24 months.

94vulnerabilities fixed (CVEs)

13of them critical

0exploited (zero-day)

1publicly disclosed

Tue, 10 Nov 2026Next Patch Tuesday
in 10 days and 0 hours

← Back to the month overview

All CVEs – Patch Tuesday September 2025

94 vulnerabilities

CVE-2025-54914CriticalCVSS 10.0Elevation of privilege

Azure Networking Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-55241CriticalCVSS 10.0Elevation of privilege

Azure Entra ID Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-55244CriticalCVSS 9.0Elevation of privilege

Azure Bot Service Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-54918CriticalCVSS 8.8Elevation of privilege

Windows NTLM Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54910CriticalCVSS 8.4Remote code execution

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office · KB5002781 · MSRC

CVE-2025-53800CriticalCVSS 7.8Elevation of privilege

Windows Graphics Component Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55224CriticalCVSS 7.8Remote code execution

Windows Hyper-V Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55228CriticalCVSS 7.8Remote code execution

Windows Graphics Component Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065432 KB5065306 KB5065429 KB5065431 · MSRC

CVE-2025-55238CriticalCVSS 7.5Information disclosure

Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability

Microsoft Dynamics · MSRC

CVE-2025-55236CriticalCVSS 7.3Remote code execution

Graphics Kernel Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55226CriticalCVSS 6.7Remote code execution

Graphics Kernel Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55242CriticalCVSS 6.5Information disclosure

Xbox Certification Bug Copilot Djando Information Disclosure Vulnerability

Apps · MSRC

CVE-2025-53799CriticalCVSS 5.5Information disclosure

Windows Imaging Component Information Disclosure Vulnerability

Windows, Windows ESU (Extended Security Updates), Microsoft Office · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55232ImportantCVSS 9.8Remote code execution

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

Azure · MSRC

CVE-2025-54106ImportantCVSS 8.8Remote code execution

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065426 · MSRC

CVE-2025-54110ImportantCVSS 8.8Elevation of privilege

Windows Kernel Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54113ImportantCVSS 8.8Remote code execution

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065426 · MSRC

CVE-2025-54897ImportantCVSS 8.8Remote code execution

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft Office · KB5002778 KB5002775 KB5002784 · MSRC

CVE-2025-55227ImportantCVSS 8.8Elevation of privilege

Microsoft SQL Server Elevation of Privilege Vulnerability

SQL Server · KB5065224 KB5065223 KB5065226 KB5065227 · MSRC

CVE-2025-55234ImportantCVSS 8.8Publicly disclosedElevation of privilege

Windows SMB Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55319ImportantCVSS 8.8Remote code execution

Agentic AI and Visual Studio Code Remote Code Execution Vulnerability

Developer tools (.NET, Visual Studio …) · MSRC

CVE-2025-49692ImportantCVSS 7.8Elevation of privilege

Azure Connected Machine Agent Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-53801ImportantCVSS 7.8Elevation of privilege

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54091ImportantCVSS 7.8Elevation of privilege

Windows Hyper-V Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54092ImportantCVSS 7.8Elevation of privilege

Windows Hyper-V Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54098ImportantCVSS 7.8Elevation of privilege

Windows Hyper-V Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54102ImportantCVSS 7.8Elevation of privilege

Windows Connected Devices Platform Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54111ImportantCVSS 7.8Elevation of privilege

Windows UI XAML Phone DatePickerFlyout Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54894ImportantCVSS 7.8Elevation of privilege

Local Security Authority Subsystem Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54895ImportantCVSS 7.8Elevation of privilege

SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54896ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002776 KB5002782 · MSRC

CVE-2025-54898ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002776 KB5002782 · MSRC

CVE-2025-54899ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002782 · MSRC

CVE-2025-54900ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002776 KB5002782 · MSRC

CVE-2025-54902ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002776 KB5002782 · MSRC

CVE-2025-54903ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002776 KB5002782 · MSRC

CVE-2025-54904ImportantCVSS 7.8Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002776 KB5002782 · MSRC

CVE-2025-54906ImportantCVSS 7.8Remote code execution

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office · KB5002778 KB5002775 KB5002781 KB5002576 · MSRC

CVE-2025-54907ImportantCVSS 7.8Remote code execution

Microsoft Office Visio Remote Code Execution Vulnerability

Microsoft Office · MSRC

CVE-2025-54908ImportantCVSS 7.8Remote code execution

Microsoft PowerPoint Remote Code Execution Vulnerability

Microsoft Office · KB5002779 · MSRC

CVE-2025-54912ImportantCVSS 7.8Elevation of privilege

Windows BitLocker Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54913ImportantCVSS 7.8Elevation of privilege

Windows UI XAML Maps MapControlSettings Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-54916ImportantCVSS 7.8Remote code execution

Windows NTFS Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55245ImportantCVSS 7.8Elevation of privilege

Xbox Gaming Services Elevation of Privilege Vulnerability

Apps · MSRC

CVE-2025-55316ImportantCVSS 7.8Elevation of privilege

Azure Connected Machine Agent Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-55317ImportantCVSS 7.8Elevation of privilege

Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability

Microsoft Office · MSRC

CVE-2025-59251ImportantCVSS 7.6Remote code execution

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Browser (Edge) · MSRC

CVE-2025-53805ImportantCVSS 7.5Denial of service

HTTP.sys Denial of Service Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065432 KB5065306 KB5065431 KB5065426 · MSRC

CVE-2025-54919ImportantCVSS 7.5Remote code execution

Windows Graphics Component Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5065428 KB5065432 KB5065306 KB5065429 · MSRC

CVE-2025-55243ImportantCVSS 7.5Spoofing

Microsoft OfficePlus Spoofing Vulnerability

Microsoft Office · MSRC

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed