Microsoft’s August 2025 Patch Tuesday Roundup

Microsoft Patch Tuesday August 2025: 119 Vulnerabilities Fixed Across Windows, Office, Exchange, and Azure

Overview of Microsoft August 2025 Security Updates

On August 14, 2025, Microsoft released its August Patch Tuesday addressing 111 vulnerabilities in Microsoft products and an additional 8 non-Microsoft CVEs, totaling 119 security flaws. These span Windows, Microsoft Office, Exchange Server, SharePoint, SQL Server, Azure services, and Microsoft 365 applications. The vulnerabilities include Remote Code Execution (RCE), Elevation of Privilege (EoP), Information Disclosure, Spoofing, Tampering, and Denial of Service (DoS). With 21 CVEs flagged as high-risk or actively exploitable, enterprises must patch immediately to avoid compromise.

Key Exploitable Vulnerabilities Patched in August 2025

Kerberos BadSuccessor (CVE-2025-53779)

The most notable disclosure is CVE-2025-53779 “BadSuccessor”, a Kerberos Elevation of Privilege vulnerability involving path traversal in delegated Managed Service Accounts (dMSAs). Attackers could escalate privileges to domain administrator, posing significant risks in enterprise Active Directory environments.

Microsoft Exchange Hybrid EoP (CVE-2025-53786)

This vulnerability affects Exchange Server 2016 and 2019 in hybrid deployments. Attackers with on-premises Exchange admin rights can pivot into Exchange Online and Office 365, risking cloud account takeovers.

Windows NTLM EoP (CVE-2025-53778)

A critical Windows NTLM vulnerability rated CVSS 8.8, flagged as “Exploitation More Likely.” It could allow attackers to escalate privileges and move laterally across Windows environments.

Microsoft Message Queuing (CVE-2025-50177)

A remote code execution (RCE) vulnerability in Microsoft Message Queuing, triggered by crafted network packets, allowing remote takeover of Windows servers.

GDI+ and Graphics Components (CVE-2025-53766, CVE-2025-50165)

Multiple graphics rendering flaws, including heap overflows and malicious JPEG handling, enable remote code execution by simply opening or viewing crafted image files.

Vulnerability Breakdown by Category

Severity Distribution of August 2025 Patches

• 17 Critical vulnerabilities

• 91 Important vulnerabilities

• 2 Moderate vulnerabilities

• 1 Low severity vulnerability

In total:

• 35 Remote Code Execution (RCE) issues

• 44 Elevation of Privilege (EoP) flaws

• 18 Information Disclosure

• 9 Spoofing vulnerabilities

• 4 Denial of Service (DoS)

• 1 Tampering vulnerability

Products Affected in August 2025

Microsoft Ecosystem Under Attack

The August updates target a wide range of products, including:

• Windows 10, Windows 11, Windows Server (2008 – 2025)

• Microsoft Office (Word, Excel, PowerPoint, Visio, Outlook)

• Microsoft Exchange Server (2016, 2019)

• Microsoft SharePoint (2016 – 2019)

• Microsoft SQL Server

• Microsoft Hyper-V

• Azure Virtual Machines, Azure OpenAI, Azure Stack Hub

• Microsoft 365 Copilot and GitHub Copilot integrations

MITRE ATT&CK Mapping of Exploited CVEs

Adversary Techniques Observed

Microsoft’s advisory links the vulnerabilities to multiple MITRE ATT&CK tactics and techniques, including:

• TA0001 Initial Access: Phishing (T1566), Exploit Public-Facing Applications (T1190)

• TA0002 Execution: Command & Scripting Interpreter (T1059), Exploitation for Client Execution (T1203)

• TA0004 Privilege Escalation: Exploitation for Privilege Escalation (T1068), Pass-the-Ticket (T1550.003), Kerberos Ticket Forgery (T1558)

• TA0006 Credential Access: Valid Accounts (T1078), Modify Authentication Process (T1556)

• TA0040 Impact: Endpoint Denial of Service (T1499), Hybrid-cloud exploitation vectors

Recommendations for Enterprises

Immediate Security Actions

• Prioritize patching of critical CVEs: CVE-2025-53779, CVE-2025-53786, CVE-2025-53778, CVE-2025-50177, CVE-2025-53766, CVE-2025-50165.

• Conduct service exposure evaluation to identify and secure internet-facing services.

• Implement network segmentation to contain lateral movement and limit attacker reach.

• Apply least privilege principles to reduce impact of privilege escalation flaws.

• Harden device configurations and update endpoint defenses against RCE and EoP exploits.

Conclusion

Why August 2025 Patch Tuesday Matters

With 119 vulnerabilities addressed, including 21 high-risk and actively exploitable flaws, Microsoft’s August 2025 Patch Tuesday represents one of the most critical patch cycles of the year. From Kerberos domain escalation to Exchange hybrid cloud compromises and remote code execution in graphics and messaging services, this release underscores the urgency of proactive vulnerability management. Organizations that fail to patch quickly risk domain-wide compromise, cloud breaches, and business disruption.