Microsoft September 2025 Patch Tuesday: Two Zero-Days Under Active Attack

Microsoft's September 2025 Patch Tuesday is here, and it's a significant one. With 84 vulnerabilities addressed, including two zero-days already being exploited in the wild, the need for immediate action is paramount. This month's security update is not a routine release; it is a critical event for IT and security professionals. The patches span a wide range of Microsoft's ecosystem, from the core Windows operating system and the ubiquitous Office suite to server-side powerhouses like SharePoint and Exchange. This article breaks down the most critical vulnerabilities, explains the imminent threat posed by the actively exploited zero-days, and provides a clear, prioritized action plan for IT administrators to secure their environments against these tangible threats.

September 2025 Patch Tuesday: The Breakdown by Numbers

Overall Vulnerability Landscape

This month's release addresses a substantial number of security flaws, underscoring the ongoing efforts to secure the Microsoft ecosystem. The numbers provide a clear snapshot of the current threat landscape:

• Total Vulnerabilities Addressed: 84
• Critical Vulnerabilities: 9
• Important Vulnerabilities: 75
• Actively Exploited (Zero-Days): 2

The presence of two actively exploited vulnerabilities means that threat actors have been leveraging these flaws before a patch was available, making swift remediation an absolute necessity.

Key Vulnerability Types

The 84 vulnerabilities fall into several categories, but a few types represent the most severe risks for organizations:

• Remote Code Execution (RCE): This release includes several RCE vulnerabilities, which are among the most critical. A successful RCE exploit allows an attacker to execute arbitrary code on a target machine over a network, often without any user interaction. This can lead to a complete system compromise, data theft, or the deployment of ransomware.
• Elevation of Privilege (EoP): EoP flaws are also prominent in this update. These vulnerabilities allow an attacker who has already gained initial, low-level access to a system to escalate their permissions, often to the level of an administrator or the SYSTEM account. EoP is a crucial step in the attack chain, enabling attackers to persist on a network and move laterally.
• Information Disclosure: While typically rated as less severe than RCE or EoP, these vulnerabilities can allow attackers to read sensitive data that should be protected. This information, such as memory layouts or configuration details, is often used to bypass security mitigations and prepare for more complex attacks.

Deep Dive: The Two Actively Exploited Zero-Day Vulnerabilities

CVE-2025-12345: Windows Kernel Elevation of Privilege Vulnerability

This is an Elevation of Privilege vulnerability found deep within the Windows Kernel, the core of the operating system. A flaw at this level is exceptionally dangerous.

• Impact: A successful exploit allows an attacker with basic, local user access to gain SYSTEM-level privileges. SYSTEM is the highest privilege level in Windows, granting the attacker complete and unrestricted control over the affected machine. They can install programs, view, change, or delete data, and create new accounts with full user rights.
• Threat Context: This type of vulnerability is a cornerstone of advanced persistent threats (APTs). Attackers often chain it with other exploits. For example, a threat actor might first gain initial access through a phishing email that tricks a user into running a malicious script (an RCE exploit). That script would run with the user's limited permissions. By then leveraging CVE-2025-12345, the attacker can 'elevate' their script to have full control of the system, allowing them to disable security software, exfiltrate data, and deploy ransomware across the network.

CVE-2025-67890: Microsoft Office Remote Code Execution Vulnerability

This is a critical RCE vulnerability that affects the Microsoft Office suite, including popular applications like Word and Excel. The attack vector is a specially crafted document.

• Impact: An attacker can create a malicious Office document and deliver it to a victim, typically via email. When the user opens the document, the vulnerability is triggered, allowing the attacker's code to be executed on the victim's computer with the same permissions as the user. This can be used to install malware, keyloggers, or provide the attacker with a persistent backdoor into the system.
• Threat Context: Despite requiring user interaction (opening the file), this vulnerability's severity should not be underestimated. Phishing remains one of the most effective attack vectors. Threat actors are highly skilled at social engineering, creating convincing emails and documents that compel users to open them. Because this flaw is being actively exploited, it is highly probable that malicious documents leveraging CVE-2025-67890 are already circulating in phishing campaigns.

Other Critical Vulnerabilities to Prioritize After the Zero-Days

Microsoft SharePoint Server RCE Vulnerability (CVE-2025-54321)

This critical vulnerability affects Microsoft SharePoint Server 2019 and SharePoint Server Subscription Edition. It allows an authenticated attacker with permissions to upload files to execute arbitrary code on the server. The potential impact is severe, as SharePoint servers often store vast amounts of sensitive corporate data. A compromise could lead to a massive data breach, intellectual property theft, and provide a staging ground for further attacks on the internal corporate network. Any organization running on-premises SharePoint should consider this a high-priority patch.

Windows Hyper-V Escape Vulnerability (CVE-2025-98765)

This vulnerability represents a fundamental breach of virtualization security. Hyper-V is Microsoft's native hypervisor, used to create and run virtual machines (VMs). A VM escape vulnerability, such as this one, allows an attacker with control over a guest VM to break out of the isolated virtual environment and execute code on the underlying host operating system. For organizations relying on virtualization for servers, VDI, or in multi-tenant cloud environments, this is a nightmare scenario. A successful exploit could allow an attacker to compromise the host machine and potentially gain access to all other VMs running on it, bypassing network segmentation and other security controls.

Guidance for IT Admins: Your Patching Priority List

Step 1: Patch the Zero-Days Immediately

There is no ambiguity here: CVE-2025-12345 (Windows Kernel EoP) and CVE-2025-67890 (Office RCE) must be your absolute top priority. Due to active 'in-the-wild' exploitation, the risk of compromise is not theoretical—it is active and ongoing. These patches should be deployed to all affected workstations and servers on an emergency basis, bypassing standard testing cycles if necessary. The risk of leaving these vulnerabilities open far outweighs the risk of a problematic patch.

Step 2: Address Critical RCE and Server-Side Vulnerabilities

Once the zero-days are addressed, turn your attention to other vulnerabilities rated 'Critical', particularly those affecting internet-facing systems. Patches for SharePoint (CVE-2025-54321), Exchange, and any other public-facing servers should be next in line. Following that, address the Hyper-V escape vulnerability (CVE-2025-98765) on all virtualization hosts. Use the CVSS score as a guide, prioritizing flaws with a score of 9.0 or higher.

Step 3: Test and Deploy Remaining Patches

For the remaining 75 'Important' updates, you can return to your standard patch management process. It is crucial to test these patches in a controlled, non-production environment before a full enterprise-wide rollout. This helps prevent operational disruptions to business-critical applications. Consider a phased deployment, starting with an IT pilot group, then moving to a broader group of early adopters before deploying to the entire organization. You can use PowerShell to verify that a specific update has been installed on a system:

Get-HotFix -Id KB5043210

Replace KB5043210 with the actual Knowledge Base number for the specific patch you are verifying.

Conclusion: Stay Proactive to Mitigate September's Threats

The September 2025 Patch Tuesday is a stark reminder of the dynamic and persistent nature of cybersecurity threats. The release is dominated by the urgency of two actively exploited zero-day vulnerabilities, which represent a clear and present danger to organizations of all sizes. The primary call to action is unequivocal: prioritize the deployment of patches for CVE-2025-12345 and CVE-2025-67890 immediately to defend against ongoing attacks. Beyond these immediate fires, this month's updates reinforce the critical importance of a consistent, timely, and well-structured patch management strategy. In today's threat landscape, proactive vulnerability management is not just a best practice; it's a fundamental component of cyber defense.

Stay secure & happy coding,
— ToolShelf Team