{
  "fix": "KB5065509",
  "url": "https://patchblox.com/security/fix/microsoft/kb5065509",
  "summary": "KB5065509, released September 9, 2025, fixes 34 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent.",
  "platform": "microsoft",
  "type": "kb",
  "releaseKind": "Security",
  "title": "September 2025 security update",
  "released": "2025-09-09T12:00:00Z",
  "priority": "Urgent",
  "priorityTier": 2,
  "priorityReason": "Closes CVE-2025-54918, exploitation more likely",
  "supported": true,
  "cveCount": 34,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.25278,
  "maxCvss": 8.8,
  "vendorAdvisory": "https://support.microsoft.com/help/5065509",
  "appliesTo": [
    {
      "product": "Windows Server 2012",
      "productUrl": "https://patchblox.com/security/product/microsoft/windows-server-2012",
      "fixedVersion": "",
      "supported": true
    },
    {
      "product": "Windows Server 2012 (Server Core installation)",
      "productUrl": "https://patchblox.com/security/product/microsoft/windows-server-2012-server-core-installation",
      "fixedVersion": "",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2025-54918",
      "url": "https://patchblox.com/security/cve/CVE-2025-54918",
      "title": "Windows NTLM Elevation of Privilege Vulnerability",
      "component": "Windows NTLM",
      "impact": "Elevation of Privilege",
      "priority": "Urgent",
      "severity": "Critical",
      "cvss": 8.8,
      "epss": 0.25278,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-55234",
      "url": "https://patchblox.com/security/cve/CVE-2025-55234",
      "title": "Windows SMB Elevation of Privilege Vulnerability",
      "component": "Windows SMB",
      "impact": "Elevation of Privilege",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 8.8,
      "epss": 0.20758,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": true
    },
    {
      "cveId": "CVE-2025-54110",
      "url": "https://patchblox.com/security/cve/CVE-2025-54110",
      "title": "Windows Kernel Elevation of Privilege Vulnerability",
      "component": "Windows Kernel",
      "impact": "Elevation of Privilege",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 8.8,
      "epss": 0.04717,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54098",
      "url": "https://patchblox.com/security/cve/CVE-2025-54098",
      "title": "Windows Hyper-V Elevation of Privilege Vulnerability",
      "component": "Role: Windows Hyper-V",
      "impact": "Elevation of Privilege",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.03321,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54916",
      "url": "https://patchblox.com/security/cve/CVE-2025-54916",
      "title": "Windows NTFS Remote Code Execution Vulnerability",
      "component": "Windows NTFS",
      "impact": "Remote Code Execution",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.02777,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53799",
      "url": "https://patchblox.com/security/cve/CVE-2025-53799",
      "title": "Windows Imaging Component Information Disclosure Vulnerability",
      "component": "Windows Imaging Component",
      "impact": "Information Disclosure",
      "priority": "Urgent",
      "severity": "Critical",
      "cvss": 5.5,
      "epss": 0.00842,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53803",
      "url": "https://patchblox.com/security/cve/CVE-2025-53803",
      "title": "Windows Kernel Memory Information Disclosure Vulnerability",
      "component": "Windows Kernel",
      "impact": "Information Disclosure",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 5.5,
      "epss": 0.00661,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53804",
      "url": "https://patchblox.com/security/cve/CVE-2025-53804",
      "title": "Windows Kernel-Mode Driver Information Disclosure Vulnerability",
      "component": "Windows Kernel",
      "impact": "Information Disclosure",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 5.5,
      "epss": 0.00661,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-55226",
      "url": "https://patchblox.com/security/cve/CVE-2025-55226",
      "title": "Graphics Kernel Remote Code Execution Vulnerability",
      "component": "Graphics Kernel",
      "impact": "Remote Code Execution",
      "priority": "Urgent",
      "severity": "Critical",
      "cvss": 6.7,
      "epss": 0.00526,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54093",
      "url": "https://patchblox.com/security/cve/CVE-2025-54093",
      "title": "Windows TCP/IP Driver Elevation of Privilege Vulnerability",
      "component": "Windows TCP/IP",
      "impact": "Elevation of Privilege",
      "priority": "Urgent",
      "severity": "Important",
      "cvss": 7,
      "epss": 0.00384,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54113",
      "url": "https://patchblox.com/security/cve/CVE-2025-54113",
      "title": "Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Remote Code Execution",
      "priority": "High",
      "severity": "Important",
      "cvss": 8.8,
      "epss": 0.00936,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54911",
      "url": "https://patchblox.com/security/cve/CVE-2025-54911",
      "title": "Windows BitLocker Elevation of Privilege Vulnerability",
      "component": "Windows BitLocker",
      "impact": "Elevation of Privilege",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.3,
      "epss": 0.00771,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54912",
      "url": "https://patchblox.com/security/cve/CVE-2025-54912",
      "title": "Windows BitLocker Elevation of Privilege Vulnerability",
      "component": "Windows BitLocker",
      "impact": "Elevation of Privilege",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.00541,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54091",
      "url": "https://patchblox.com/security/cve/CVE-2025-54091",
      "title": "Windows Hyper-V Elevation of Privilege Vulnerability",
      "component": "Role: Windows Hyper-V",
      "impact": "Elevation of Privilege",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.00454,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54894",
      "url": "https://patchblox.com/security/cve/CVE-2025-54894",
      "title": "Local Security Authority Subsystem Service Elevation of Privilege Vulnerability",
      "component": "Windows Local Security Authority Subsystem Service (LSASS)",
      "impact": "Elevation of Privilege",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.00454,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54099",
      "url": "https://patchblox.com/security/cve/CVE-2025-54099",
      "title": "Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability",
      "component": "Windows Ancillary Function Driver for WinSock",
      "impact": "Elevation of Privilege",
      "priority": "High",
      "severity": "Important",
      "cvss": 7,
      "epss": 0.00382,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54895",
      "url": "https://patchblox.com/security/cve/CVE-2025-54895",
      "title": "SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege Vulnerability",
      "component": "Windows SPNEGO Extended Negotiation",
      "impact": "Elevation of Privilege",
      "priority": "High",
      "severity": "Important",
      "cvss": 7.8,
      "epss": 0.00287,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54101",
      "url": "https://patchblox.com/security/cve/CVE-2025-54101",
      "title": "Windows SMB Client Remote Code Execution Vulnerability",
      "component": "Windows SMBv3 Client",
      "impact": "Remote Code Execution",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 4.8,
      "epss": 0.03124,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-55225",
      "url": "https://patchblox.com/security/cve/CVE-2025-55225",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01259,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53796",
      "url": "https://patchblox.com/security/cve/CVE-2025-53796",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53797",
      "url": "https://patchblox.com/security/cve/CVE-2025-53797",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53798",
      "url": "https://patchblox.com/security/cve/CVE-2025-53798",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53806",
      "url": "https://patchblox.com/security/cve/CVE-2025-53806",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54095",
      "url": "https://patchblox.com/security/cve/CVE-2025-54095",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54096",
      "url": "https://patchblox.com/security/cve/CVE-2025-54096",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54097",
      "url": "https://patchblox.com/security/cve/CVE-2025-54097",
      "title": "Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability",
      "component": "Windows Routing and Remote Access Service (RRAS)",
      "impact": "Information Disclosure",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.5,
      "epss": 0.01198,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54107",
      "url": "https://patchblox.com/security/cve/CVE-2025-54107",
      "title": "MapUrlToZone Security Feature Bypass Vulnerability",
      "component": "Windows MapUrlToZone",
      "impact": "Security Feature Bypass",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 4.3,
      "epss": 0.00962,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54917",
      "url": "https://patchblox.com/security/cve/CVE-2025-54917",
      "title": "MapUrlToZone Security Feature Bypass Vulnerability",
      "component": "Windows MapUrlToZone",
      "impact": "Security Feature Bypass",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 4.3,
      "epss": 0.00947,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54104",
      "url": "https://patchblox.com/security/cve/CVE-2025-54104",
      "title": "Windows Defender Firewall Service Elevation of Privilege Vulnerability",
      "component": "Windows Defender Firewall Service",
      "impact": "Elevation of Privilege",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.7,
      "epss": 0.00511,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54915",
      "url": "https://patchblox.com/security/cve/CVE-2025-54915",
      "title": "Windows Defender Firewall Service Elevation of Privilege Vulnerability",
      "component": "Windows Defender Firewall Service",
      "impact": "Elevation of Privilege",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.7,
      "epss": 0.00479,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53808",
      "url": "https://patchblox.com/security/cve/CVE-2025-53808",
      "title": "Windows Defender Firewall Service Elevation of Privilege Vulnerability",
      "component": "Windows Defender Firewall Service",
      "impact": "Elevation of Privilege",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.7,
      "epss": 0.00478,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54109",
      "url": "https://patchblox.com/security/cve/CVE-2025-54109",
      "title": "Windows Defender Firewall Service Elevation of Privilege Vulnerability",
      "component": "Windows Defender Firewall Service",
      "impact": "Elevation of Privilege",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.7,
      "epss": 0.00478,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-53810",
      "url": "https://patchblox.com/security/cve/CVE-2025-53810",
      "title": "Windows Defender Firewall Service Elevation of Privilege Vulnerability",
      "component": "Windows Defender Firewall Service",
      "impact": "Elevation of Privilege",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.7,
      "epss": 0.00464,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-54094",
      "url": "https://patchblox.com/security/cve/CVE-2025-54094",
      "title": "Windows Defender Firewall Service Elevation of Privilege Vulnerability",
      "component": "Windows Defender Firewall Service",
      "impact": "Elevation of Privilege",
      "priority": "Routine",
      "severity": "Important",
      "cvss": 6.7,
      "epss": 0.00464,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-07T06:34:28Z"
}