# KB5065306: September 2025 cumulative update for Windows Server 2022 KB5065306, released September 9, 2025, fixes 59 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/microsoft/kb5065306 - Platform: Microsoft - Released: Sep 9, 2025 - Priority: Urgent (Closes CVE-2025-54918, exploitation more likely) - CVEs: 59, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.microsoft.com/help/5065306 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2022](https://patchblox.com/security/data/product/microsoft/windows-server-2022.md) | | 20348.4106 | | [Windows Server 2022 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2022-server-core-installation.md) | | 20348.4106 | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-54918](https://patchblox.com/security/data/cve/CVE-2025-54918.md) | Urgent | Windows NTLM | 8.8 | 0.2528 | More likely | | [CVE-2025-55234](https://patchblox.com/security/data/cve/CVE-2025-55234.md) | Urgent | Windows SMB | 8.8 | 0.2076 | Disclosed | | [CVE-2025-54110](https://patchblox.com/security/data/cve/CVE-2025-54110.md) | Urgent | Windows Kernel | 8.8 | 0.0472 | More likely | | [CVE-2025-54098](https://patchblox.com/security/data/cve/CVE-2025-54098.md) | Urgent | Role: Windows Hyper-V | 7.8 | 0.0332 | More likely | | [CVE-2025-54916](https://patchblox.com/security/data/cve/CVE-2025-54916.md) | Urgent | Windows NTFS | 7.8 | 0.0278 | More likely | | [CVE-2025-59502](https://patchblox.com/security/data/cve/CVE-2025-59502.md) | Urgent | Windows Remote Procedure Call | 7.5 | 0.0106 | More likely | | [CVE-2025-53799](https://patchblox.com/security/data/cve/CVE-2025-53799.md) | Urgent | Windows Imaging Component | 5.5 | 0.0084 | | | [CVE-2025-53803](https://patchblox.com/security/data/cve/CVE-2025-53803.md) | Urgent | Windows Kernel | 5.5 | 0.0066 | More likely | | [CVE-2025-53804](https://patchblox.com/security/data/cve/CVE-2025-53804.md) | Urgent | Windows Kernel | 5.5 | 0.0066 | More likely | | [CVE-2025-48807](https://patchblox.com/security/data/cve/CVE-2025-48807.md) | Urgent | Role: Windows Hyper-V | 6.7 | 0.0058 | | | [CVE-2025-55226](https://patchblox.com/security/data/cve/CVE-2025-55226.md) | Urgent | Graphics Kernel | 6.7 | 0.0053 | | | [CVE-2025-53800](https://patchblox.com/security/data/cve/CVE-2025-53800.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0050 | | | [CVE-2025-55236](https://patchblox.com/security/data/cve/CVE-2025-55236.md) | Urgent | Graphics Kernel | 7.3 | 0.0043 | | | [CVE-2025-54093](https://patchblox.com/security/data/cve/CVE-2025-54093.md) | Urgent | Windows TCP/IP | 7.0 | 0.0038 | More likely | | [CVE-2025-55224](https://patchblox.com/security/data/cve/CVE-2025-55224.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0036 | | | [CVE-2025-55228](https://patchblox.com/security/data/cve/CVE-2025-55228.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0033 | | | [CVE-2025-53805](https://patchblox.com/security/data/cve/CVE-2025-53805.md) | High | Windows Internet Information Services | 7.5 | 0.0151 | | | [CVE-2025-54106](https://patchblox.com/security/data/cve/CVE-2025-54106.md) | High | Windows Routing and Remote Access Service (RRAS) | 8.8 | 0.0144 | | | [CVE-2025-54113](https://patchblox.com/security/data/cve/CVE-2025-54113.md) | High | Windows Routing and Remote Access Service (RRAS) | 8.8 | 0.0094 | | | [CVE-2025-54911](https://patchblox.com/security/data/cve/CVE-2025-54911.md) | High | Windows BitLocker | 7.3 | 0.0077 | | | [CVE-2025-54912](https://patchblox.com/security/data/cve/CVE-2025-54912.md) | High | Windows BitLocker | 7.8 | 0.0054 | | | [CVE-2025-54116](https://patchblox.com/security/data/cve/CVE-2025-54116.md) | High | Windows MultiPoint Services | 7.3 | 0.0053 | | | [CVE-2025-53801](https://patchblox.com/security/data/cve/CVE-2025-53801.md) | High | Windows DWM | 7.8 | 0.0045 | | | [CVE-2025-54091](https://patchblox.com/security/data/cve/CVE-2025-54091.md) | High | Role: Windows Hyper-V | 7.8 | 0.0045 | | | [CVE-2025-54102](https://patchblox.com/security/data/cve/CVE-2025-54102.md) | High | Windows Connected Devices Platform Service | 7.8 | 0.0045 | | | [CVE-2025-54894](https://patchblox.com/security/data/cve/CVE-2025-54894.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 7.8 | 0.0045 | | | [CVE-2025-54115](https://patchblox.com/security/data/cve/CVE-2025-54115.md) | High | Role: Windows Hyper-V | 7.0 | 0.0042 | | | [CVE-2025-59290](https://patchblox.com/security/data/cve/CVE-2025-59290.md) | High | Windows Bluetooth Service | 7.8 | 0.0040 | | | [CVE-2025-54919](https://patchblox.com/security/data/cve/CVE-2025-54919.md) | High | Windows Win32K - GRFX | 7.5 | 0.0039 | | | [CVE-2025-54099](https://patchblox.com/security/data/cve/CVE-2025-54099.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0038 | | | [CVE-2025-54111](https://patchblox.com/security/data/cve/CVE-2025-54111.md) | High | Windows UI XAML Phone DatePickerFlyout | 7.8 | 0.0038 | | | [CVE-2025-53802](https://patchblox.com/security/data/cve/CVE-2025-53802.md) | High | Windows Bluetooth Service | 7.0 | 0.0038 | | | [CVE-2025-54112](https://patchblox.com/security/data/cve/CVE-2025-54112.md) | High | Microsoft Virtual Hard Drive | 7.0 | 0.0038 | | | [CVE-2025-54092](https://patchblox.com/security/data/cve/CVE-2025-54092.md) | High | Role: Windows Hyper-V | 7.8 | 0.0034 | | | [CVE-2025-49734](https://patchblox.com/security/data/cve/CVE-2025-49734.md) | High | Windows PowerShell | 7.0 | 0.0033 | | | [CVE-2025-54913](https://patchblox.com/security/data/cve/CVE-2025-54913.md) | High | Windows UI XAML Maps MapControlSettings | 7.8 | 0.0030 | | | [CVE-2025-55223](https://patchblox.com/security/data/cve/CVE-2025-55223.md) | High | Graphics Kernel | 7.0 | 0.0030 | | | [CVE-2025-54895](https://patchblox.com/security/data/cve/CVE-2025-54895.md) | High | Windows SPNEGO Extended Negotiation | 7.8 | 0.0029 | | | [CVE-2025-53807](https://patchblox.com/security/data/cve/CVE-2025-53807.md) | High | Microsoft Graphics Component | 7.0 | 0.0029 | | | [CVE-2025-54114](https://patchblox.com/security/data/cve/CVE-2025-54114.md) | High | Windows Connected Devices Platform Service | 7.0 | 0.0029 | | | [CVE-2025-59220](https://patchblox.com/security/data/cve/CVE-2025-59220.md) | High | Windows Bluetooth Service | 7.0 | 0.0025 | | | [CVE-2025-59289](https://patchblox.com/security/data/cve/CVE-2025-59289.md) | High | Windows Bluetooth Service | 7.0 | 0.0024 | | | [CVE-2025-54101](https://patchblox.com/security/data/cve/CVE-2025-54101.md) | Routine | Windows SMBv3 Client | 4.8 | 0.0312 | | | [CVE-2025-55225](https://patchblox.com/security/data/cve/CVE-2025-55225.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0126 | | | [CVE-2025-53796](https://patchblox.com/security/data/cve/CVE-2025-53796.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-53797](https://patchblox.com/security/data/cve/CVE-2025-53797.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-53798](https://patchblox.com/security/data/cve/CVE-2025-53798.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-53806](https://patchblox.com/security/data/cve/CVE-2025-53806.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-54095](https://patchblox.com/security/data/cve/CVE-2025-54095.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-54096](https://patchblox.com/security/data/cve/CVE-2025-54096.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-54097](https://patchblox.com/security/data/cve/CVE-2025-54097.md) | Routine | Windows Routing and Remote Access Service (RRAS) | 6.5 | 0.0120 | | | [CVE-2025-54107](https://patchblox.com/security/data/cve/CVE-2025-54107.md) | Routine | Windows MapUrlToZone | 4.3 | 0.0096 | | | [CVE-2025-54917](https://patchblox.com/security/data/cve/CVE-2025-54917.md) | Routine | Windows MapUrlToZone | 4.3 | 0.0095 | | | [CVE-2025-54104](https://patchblox.com/security/data/cve/CVE-2025-54104.md) | Routine | Windows Defender Firewall Service | 6.7 | 0.0051 | | | [CVE-2025-54915](https://patchblox.com/security/data/cve/CVE-2025-54915.md) | Routine | Windows Defender Firewall Service | 6.7 | 0.0048 | | | [CVE-2025-53808](https://patchblox.com/security/data/cve/CVE-2025-53808.md) | Routine | Windows Defender Firewall Service | 6.7 | 0.0048 | | | [CVE-2025-54109](https://patchblox.com/security/data/cve/CVE-2025-54109.md) | Routine | Windows Defender Firewall Service | 6.7 | 0.0048 | | | [CVE-2025-53810](https://patchblox.com/security/data/cve/CVE-2025-53810.md) | Routine | Windows Defender Firewall Service | 6.7 | 0.0046 | | | [CVE-2025-54094](https://patchblox.com/security/data/cve/CVE-2025-54094.md) | Routine | Windows Defender Firewall Service | 6.7 | 0.0046 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo