CVEs have been published or revised in the Security Update Guide
August 7, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-53767

• Title: Azure OpenAI Elevation of Privilege Vulnerability
• Version: 1.0
• Reason for revision: Information published.
• Originally released: August 7, 2025
• Last updated: August 7, 2025
• Aggregate CVE severity rating: Critical
• Customer action required: No

CVE-2025-53774

• Title: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
• Version: 1.0
• Reason for revision: Information published.
• Originally released: August 7, 2025
• Last updated: August 7, 2025
• Aggregate CVE severity rating: Critical
• Customer action required: No

CVE-2025-53787

• Title: Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
• Version: 1.0
• Reason for revision: Information published.
• Originally released: August 7, 2025
• Last updated: August 7, 2025
• Aggregate CVE severity rating: Critical
• Customer action required: No

CVE-2025-53792

• Title: Azure Portal Elevation of Privilege Vulnerability
• Version: 1.0
• Reason for revision: Information published.
• Originally released: August 7, 2025
• Last updated: August 7, 2025
• Aggregate CVE severity rating: Critical
• Customer action required: No

August 2025 Security Updates

This release consists of the following 111 Microsoft CVEs:
Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations?

SQL Server CVE-2025-24999
Microsoft Exchange Server CVE-2025-25005
Microsoft Exchange Server CVE-2025-25006
Microsoft Exchange Server CVE-2025-25007
Microsoft Exchange Server CVE-2025-33051
SQL Server CVE-2025-47954
Role: Windows Hyper-V CVE-2025-48807
Azure Virtual Machines CVE-2025-49707
Microsoft Office SharePoint CVE-2025-49712
Microsoft Edge for Android CVE-2025-49736
Microsoft Graphics Component CVE-2025-49743
Microsoft Dynamics 365 (on-premises) CVE-2025-49745
Role: Windows Hyper-V CVE-2025-49751
Microsoft Edge for Android CVE-2025-49755
Windows Routing and Remote Access Service (RRAS) CVE-2025-49757
SQL Server CVE-2025-49758
SQL Server CVE-2025-49759
Windows Kernel CVE-2025-49761
Windows Ancillary Function Driver for WinSock CVE-2025-49762
Desktop Windows Manager CVE-2025-50153
Windows File Explorer CVE-2025-50154
Windows Push Notifications CVE-2025-50155
Windows Routing and Remote Access Service (RRAS) CVE-2025-50156
Windows Routing and Remote Access Service (RRAS) CVE-2025-50157
Windows NTFS CVE-2025-50158
Remote Access Point-to-Point Protocol (PPP) EAP-TLS CVE-2025-50159
Windows Routing and Remote Access Service (RRAS) CVE-2025-50160
Windows Win32K - GRFX CVE-2025-50161
Windows Routing and Remote Access Service (RRAS) CVE-2025-50162
Windows Routing and Remote Access Service (RRAS) CVE-2025-50163
Windows Routing and Remote Access Service (RRAS) CVE-2025-50164
Microsoft Graphics Component CVE-2025-50165
Windows Distributed Transaction Coordinator CVE-2025-50166
Role: Windows Hyper-V CVE-2025-50167
Windows Win32K - ICOMP CVE-2025-50168
Windows SMB CVE-2025-50169
Windows Cloud Files Mini Filter Driver CVE-2025-50170
Remote Desktop Server CVE-2025-50171
Windows DirectX CVE-2025-50172
Windows Installer CVE-2025-50173
Graphics Kernel CVE-2025-50176
Windows Message Queuing CVE-2025-50177
Windows Media CVE-2025-53131
Windows Win32K - GRFX CVE-2025-53132
Windows PrintWorkflowUserSvc CVE-2025-53133
Windows Ancillary Function Driver for WinSock CVE-2025-53134
Windows DirectX CVE-2025-53135
Windows NT OS Kernel CVE-2025-53136
Windows Ancillary Function Driver for WinSock CVE-2025-53137
Windows Routing and Remote Access Service (RRAS) CVE-2025-53138
Kernel Transaction Manager CVE-2025-53140
Windows Ancillary Function Driver for WinSock CVE-2025-53141
Microsoft Brokering File System CVE-2025-53142
Windows Message Queuing CVE-2025-53143
Windows Message Queuing CVE-2025-53144
Windows Message Queuing CVE-2025-53145
Windows Ancillary Function Driver for WinSock CVE-2025-53147
Windows Routing and Remote Access Service (RRAS) CVE-2025-53148
Kernel Streaming WOW Thunk Service Driver CVE-2025-53149
Windows Kernel CVE-2025-53151
Desktop Windows Manager CVE-2025-53152
Windows Routing and Remote Access Service (RRAS) CVE-2025-53153
Windows Ancillary Function Driver for WinSock CVE-2025-53154
Role: Windows Hyper-V CVE-2025-53155
Storage Port Driver CVE-2025-53156
Windows Local Security Authority Subsystem Service (LSASS) CVE-2025-53716
Windows Ancillary Function Driver for WinSock CVE-2025-53718
Windows Routing and Remote Access Service (RRAS) CVE-2025-53719
Windows Routing and Remote Access Service (RRAS) CVE-2025-53720
Windows Connected Devices Platform Service CVE-2025-53721
Windows Remote Desktop Services CVE-2025-53722
Role: Windows Hyper-V CVE-2025-53723
Windows Push Notifications CVE-2025-53724
Windows Push Notifications CVE-2025-53725
Windows Push Notifications CVE-2025-53726
SQL Server CVE-2025-53727
Microsoft Dynamics 365 (on-premises) CVE-2025-53728
Azure File Sync CVE-2025-53729
Microsoft Office Visio CVE-2025-53730
Microsoft Office CVE-2025-53731
Microsoft Office CVE-2025-53732
Microsoft Office Word CVE-2025-53733
Microsoft Office Visio CVE-2025-53734
Microsoft Office Excel CVE-2025-53735
Microsoft Office Word CVE-2025-53736
Microsoft Office Excel CVE-2025-53737
Microsoft Office Word CVE-2025-53738
Microsoft Office Excel CVE-2025-53739
Microsoft Office CVE-2025-53740
Microsoft Office Excel CVE-2025-53741
Microsoft Office Excel CVE-2025-53759
Microsoft Office SharePoint CVE-2025-53760
Microsoft Office PowerPoint CVE-2025-53761
Azure Stack CVE-2025-53765
Windows GDI+ CVE-2025-53766
Azure OpenAI CVE-2025-53767
Windows Security App CVE-2025-53769
Web Deploy CVE-2025-53772
GitHub Copilot and Visual Studio CVE-2025-53773
Microsoft 365 Copilot's Business Chat CVE-2025-53774
Windows NTLM CVE-2025-53778
Windows Kerberos CVE-2025-53779
Azure Virtual Machines CVE-2025-53781
Microsoft Teams CVE-2025-53783
Microsoft Office Word CVE-2025-53784
Microsoft Exchange Server CVE-2025-53786
Microsoft 365 Copilot's Business Chat CVE-2025-53787
Windows Subsystem for Linux CVE-2025-53788
Windows StateRepository API CVE-2025-53789
Azure Portal CVE-2025-53792
Azure Stack CVE-2025-53793

We are republishing 8 non-Microsoft CVEs:
CNA Tag CVE FAQs? Workarounds? Mitigations?

Chrome Microsoft Edge (Chromium-based) CVE-2025-8576
Chrome Microsoft Edge (Chromium-based) CVE-2025-8577
Chrome Microsoft Edge (Chromium-based) CVE-2025-8578
Chrome Microsoft Edge (Chromium-based) CVE-2025-8579
Chrome Microsoft Edge (Chromium-based) CVE-2025-8580
Chrome Microsoft Edge (Chromium-based) CVE-2025-8581
Chrome Microsoft Edge (Chromium-based) CVE-2025-8582
Chrome Microsoft Edge (Chromium-based) CVE-2025-8583

Security Update Guide Blog Posts
Date Blog Post
November 12, 2024 Toward greater transparency: Publishing machine-readable CSAF files
June 27, 2024 Toward greater transparency: Unveiling Cloud Service CVEs
April 9, 2024 Toward greater transparency: Security Update Guide now shares CWEs for CVEs
January 6, 2023 Publishing CBL-Mariner CVEs on the Security Update Guide CVRF API
January 11, 2022 Coming Soon: New Security Update Guide Notification System
February 9, 2021 Continuing to Listen: Good News about the Security Update Guide API
January 13, 2021 Security Update Guide Supports CVEs Assigned by Industry Partners
December 8, 2020 Security Update Guide: Let’s keep the conversation going
November 9, 2020 Vulnerability Descriptions in the New Version of the Security Update Guide

Relevant Resources

• The new Hotpatching feature is now generally available. Please see Hotpatching feature for Windows Server Azure Edition virtual machines (VMs) for more information.
• Windows 10 and Windows 11 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10 and Windows 11, in addition to non-security updates. The updates are available via the Microsoft Update Catalog. For information on lifecycle and support dates for Windows 10 and Windows 11 operating systems, please see Windows Lifecycle Facts Sheet.
• Microsoft is improving Windows Release Notes. For more information, please see What's next for Windows release notes.
• A list of the latest servicing stack updates for each operating system can be found in ADV990001. This list will be updated whenever a new servicing stack update is released. It is important to install the latest servicing stack update.
• In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.
• Customers running Windows Server 2008 R2, or Windows Server 2008 need to purchase the Extended Security Update to continue receiving security updates. See 4522133 for more information.

Known Issues
You can see these in more detail from the Deployments tab by selecting Known Issues column in the Edit Columns panel.

For more information about Windows Known Issues, please see Windows message center (links to currently-supported versions of Windows are in the left pane).

KB Article Applies To
5063888 Windows Server 2008 (Monthly Rollup)
5063948 Windows Server 2008 (Security-only update)
5002769 SharePoint Server 2019
5050672 Exchange Server 2019 CU15
5050673 Exchange Server 2019 CU14
5050674 Exchange Server 2016 CU23
Released: Aug 12, 2025
August 2025 Security Updates - Release Notes - Security Update Guide - Microsoft

CVEs have been published or revised in the Security Update Guide

August 14, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-53786

• Title: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability
• Version: 1.1
• Reason for revision: Updated FAQ information. This is an informational change only.
• Originally released: August 12, 2025
• Last updated: August 13, 2025
• Aggregate CVE severity rating: Important

Customer action required: Yes

August 19, 2025 Windows 11—KB5066189 (OS Builds 22621.5771 and 22631.5771) Out-of-band
Release Date:

8/19/2025

Version:

OS Builds 22621.5771 and 22631.5771

August 19, 2025—KB5066189 (OS Builds 22621.5771 and 22631.5771) Out-of-band - Microsoft Support

CVEs have been published or revised in the Security Update Guide

August 26, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

CVE-2025-55229

• Title: Windows Certificate Spoofing Vulnerability
• Version: 2.0
• Reason for revision: Corrected Download and Article links in the Security Updates table. This is an informational change only.
• Originally released: August 21, 2025
• Last updated: August 26, 2025
• Aggregate CVE severity rating: Important
• Customer action required: Yes

CVE-2025-55230

• Title: Windows MBT Transport Driver Elevation of Privilege Vulnerability
• Version: 2.0
• Reason for revision: Corrected Download and Article links in the Security Updates table. This is an informational change only.
• Originally released: August 21, 2025
• Last updated: August 26, 2025
• Aggregate CVE severity rating: Important
• Customer action required: Yes

CVE-2025-55231

• Title: Windows Storage-based Management Service Remote Code Execution Vulnerability
• Version: 2.0
• Reason for revision: Corrected Download and Article links in the Security Updates table. This is an informational change only.
• Originally released: August 21, 2025
• Last updated: August 26, 2025
• Aggregate CVE severity rating: Important

Customer action required: Yes

CVEs have been published or revised in the Security Update Guide

August 28, 2025

These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:

ADV200013

• Title: Microsoft Guidance for Addressing Spoofing Vulnerability in DNS Resolver
• Version: 1.3
• Reason for revision: In the Security Updates table, added Windows Server 2022, version 23H2, Windows Server 2025, and Windows Server 2025 (Server Core installation) as these versions of Windows Server are also affected by this vulnerability. Customers running these versions should configure Windows DNS servers to have UDP buffer size of 1221, as detailed in the Workaround, to be protected from this vulnerability.
• Originally released: December 8, 2020
• Last updated: August 28, 2025
• Aggregate CVE severity rating: Important

Customer action required: Yes