Please review and note that the CVE-2025-47981 vulnerability has the potential to become a worm that does not require user interaction for malicious activity. Please expedite testing an patching since the severity level of these protections may change if this is used in an exploit.
Recommendations:
CVE-2025-47981 is a severe threat. The impact could be a worm type virus that does not require activity from the client. There is not enough information on potential mitigations. Using currently known information, the questions are “when” this vulnerability will be made into an effective attack and what actions will that successful attack take. Current estimates are around 30 days.
There are 9 other critical patches for July. Please note that if additional attack vectors or new exploits are released the priority for remediation will change.
Testing and patching should be started for all systems. All systems (server and desktop) should be prioritized
All admins are reminded that browser updates, including updates to Edge Chrome and Firefox, should be deployed regularly.
Action Plan:
For all admins, please test and review changes to ensure compatibility with your environment. Patches should be expedited for all systems and completed in the next 30 calendar days – August 7th . This will be changed if there is evidence of active attacks using vulnerabilities detailed in this set of patches.
Admins using the KDC Proxy Service or Sharepoint should note the critical vulnerabilities impacting their environment and review the guidance to determine if patching is sufficient. Users making OLEDB connections to Microsoft SQL server should review these patches and test to ensure continued operation of their connections after patching.
Links:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47981
- https://msrc.microsoft.com/update-guide/en-us/releaseNote/2025-jul
- https://www.zerodayinitiative.com/blog/2025/7/8/the-july-2025-security-update-review
- https://www.tenable.com/blog/microsofts-june-2025-patch-tuesday-addresses-65-cves-cve-2025-33053