Microsoft July 2025 Patch Tuesday fixes one zero-day, 137 flaws

Today is Microsoft’s July 2025 Patch Tuesday, which includes security updates for 137 flaws, including one publicly disclosed zero-day vulnerability in Microsoft SQL Server.

This Patch Tuesday also fixes fourteen “Critical” vulnerabilities, ten of which are remote code execution vulnerabilities, one is an information disclosure, and two are AMD side channel attack flaws.

The number of bugs in each vulnerability category is listed below:

• 53 Elevation of Privilege Vulnerabilities
• 8 Security Feature Bypass Vulnerabilities
• 41 Remote Code Execution Vulnerabilities
• 18 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

These counts do not include four Mariner and three Microsoft Edge issues fixed earlier this month.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5062553 & KB5062552 cumulative updates and the Windows 10 KB5062554 cumulative update.

One zero-day and critical Microsoft office flaws

This month’s Patch Tuesday fixes one publicly disclosed zero-day in Microsoft SQL Server. Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited while no official fix is available.

The publicly disclosed zero-day is:

CVE-2025-49719 – Microsoft SQL Server Information Disclosure Vulnerability

Microsoft fixes a flaw in Microsoft SQL Server that could allow a remote, unauthenticated attacker to access data from uninitialized memory.

“Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network,” explains Microsoft.

Admins can fix the flaw by installing the latest version of Microsoft SQL Server and by installing the Microsoft OLE DB Driver 18 or 19.

Microsoft attributes the discovery of this flaw to Vladimir Aleksic with Microsoft and does not provide details regarding how it was publicly disclosed.

While there was only one zero-day in this Patch Tuesday, Microsoft fixed numerous, critical remote code execution flaws in Microsoft Office that can be exploited simply by opening a specially crafted document or when viewed through the preview pane.

Microsoft states that the security updates for these flaws are not yet available for Microsoft Office LTSC for Mac 2021 and 2024 and will be released shortly.

The company also fixed another critical RCE in Microsoft SharePoint tracked as CVE-2025-49704 that can be exploited remotely over the Internet as long as they have an account on the platform.

Recent updates from other companies

Other vendors who released updates or advisories in July 2025 include:

• AMD disclosed new Transient Scheduler Attacks based on a Microsoft report titled “Enter, Exit, Page Fault, Leak: Testing Isolation Boundaries for Microarchitectural Leaks.”
• Cisco released numerous patches this month, including one for hardcoded root SSH credentials in Unified CM.
• Fortinet released security updates today for multiple products, including FortiOS, FortiManager, FortiSandbox, FortiIsolator, and FortiProxy.
• Google’s released security updates for Google Chrome to fix an actively exploited zero-day tracked as CVE-2025-6554. Google has not released any Android security patches in its July 2025 Android Security Bulletin.
• Grafana has released security fixes for four Chromium vulnerabilities in Grafana Image Renderer plugin and Synthetic Monitoring Agent.
• Ivanti released security updates for flaws in Ivanti Connect Secure and Policy Secure, Ivanti EPMM, and Ivanti EPM. None of these vulnerabilities has been reported as actively exploited.
• SAP released the July security updates for multiple products, including upgrading a previous flaw (CVE-2025-30012) in SAP Supplier Relationship Management to a rating of 10/10.

The July 2025 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the July 2025 Patch Tuesday updates.