Headlines
Microsoft issued patches for 81 CVE-rated vulnerabilities
Two publicly disclosed Zero Day vulnerabilities
Nine vulnerabilities listed as Critical
SAP Netweaver has a CVSS 10 vulnerability
Quorum Cyber Recommendations
Patching should be completed within your regular cycles and without delay. We do not at this time recommend expedited patching.
Microsoft Release Notes
September 2025 Security Updates – Release Notes – Security Update Guide – Microsoft
Key Vulnerability Details
| Title | Improper Handling of Exceptional Conditions in Newtonsoft.Json |
| CVE | CVE-2024-21907 |
| CVSS | 7.5 |
| Reason for Concern | An attacker can craft a malicious JSON payload with extreme nesting depth that: Consumes excessive CPU and memory during deserialization Triggers a StackOverflowException during serialization or ToString() operations 2 This can crash the application or service, leading to remote DoS. |
| Mitigations and other factors | Microsoft recommend setting a maximum depth in JsonSerializerSettings: JsonConvert.DefaultSettings = () => new JsonSerializerSettings { MaxDepth = 128 }. The recommended fix is to Upgrade to Newtonsoft.Json version 13.0.1 or later, which introduces: Safer defaults Depth limits to prevent recursion-based crashes.
|
| Commentary | Vulnerability exists in .NET library Newtonsoft.Json (also known as Json.NET). You can search for Newtonsoft.Json.dll on servers and check for versions < 13.0.1. |
| Threat Intelligence Comment | CVE-2024-21907 is a high-severity Denial-of-Service (DoS) vulnerability in Newtonsoft.Json (versions before 13.0.1) caused by improper handling of deeply nested JSON during deserialization. Remote attackers can exploit this flaw by sending specially crafted JSON payloads that trigger stack overflows or resource exhaustion, leading to application crashes or hangs. Public exploit code exists, and active exploitation has been reported. Immediate patching to version 13.0.1 or later and enforcing input depth limits are essential to mitigate the risk. |
| Link | CVE-2024-21907 – Security Update Guide – Microsoft – VulnCheck: CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json |
| Title | Windows SMB Elevation of Privilege Vulnerability |
| CVE | CVE-2025-55234 |
| CVSS | 8.8 |
| Reason for Concern | Publicly disclosed zero day Impact: The SMB Server may be susceptible to relay attacks, depending on its configuration. Exploitation: A successful attacker could perform a relay attack leading to elevation of privilege, potentially allowing them to gain unauthorised access or escalate privileges on the network. |
| Mitigations and other factors | Microsoft recommends the following steps to mitigate the risk: Audit your environment using tools provided in the September 2025 security updates. Enable SMB Server hardening measures, specifically: SMB Server Signing Extended Protection for Authentication (EPA). |
| Commentary | Microsoft have stated that user interaction is required and that the attacker could only gain the privileges of the user they exploit. |
| Threat Intelligence Comment | CVE-2025-55234 is a high-severity vulnerability in the Windows SMB Server with a CVSS score of 8.8, publicly disclosed as a zero-day. It affects the SMB Server’s authentication mechanism, making it vulnerable to relay attacks depending on configuration. Successful exploitation allows attackers to perform relay attacks that can lead to privilege escalation and unauthorised access on the network, although user interaction is required and privileges gained are limited to the exploited user’s level. Microsoft recommends auditing environments with tools from the September 2025 security update and enabling SMB Server hardening features like SMB Signing and Extended Protection for Authentication (EPA). A security update addressing this vulnerability was released in September 2025. |
| Link | CVE-2025-55234 – Security Update Guide – Microsoft – Windows SMB Elevation of Privilege Vulnerability |
| Title | SAP Netweaver Deserialization Vulnerability |
| CVE | CVE-2025-42944 |
| CVSS | 10 |
| Reason for Concern | CVSS score of 10. No authentication required. Exploitable from any network segment with access to the P4 port. Attackers can execute arbitrary OS commands, potentially with high privileges. Exploitation may involve building a Java gadget chain using available classes or SAP libraries. |
| Mitigations and other factors | Apply the latest SAP updates, but you can also consider network segmentation and firewall rules to restrict access to the P4 port.
|
| Commentary | SAP NetWeaver is foundational to many enterprise applications. A vulnerability like this can lead to: Full system compromise Data exfiltration Operational disruption Supply chain risk in industries relying on SAP.
|
| Threat Intelligence Comment | CVE-2025-42944 is a critical deserialization vulnerability in SAP NetWeaver’s RMI-P4 module with a CVSS score of 10. It requires no authentication and is exploitable from any network segment with access to the P4 port. Attackers can execute arbitrary OS commands, potentially with high privileges, by sending malicious Java deserialization payloads, often leveraging gadget chains from available classes or SAP libraries. This vulnerability can lead to full system compromise, data exfiltration, operational disruption, and supply chain risks in SAP-dependent industries. Mitigation includes applying the latest SAP updates and implementing network segmentation or firewall rules to restrict access to the P4 port. A patch is available via SAP Security Note 3634501. |
| Link | SAP Security Patch Day – September 2025 |
| Title | Microsoft Office Remote Code Execution Vulnerability |
| CVE | CVE-2025-54910 |
| CVSS | 8.4 |
| Reason for Concern | The vulnerability is triggered when a malicious Office document is processed. Exploitation occurs without user interaction, notably via the Preview Pane in Outlook An attacker can craft a document that causes a heap overflow, leading to arbitrary code execution with the privileges of the current user. |
| Mitigations and other factors | Microsoft recommend the following: Disable Preview Pane in Outlook to reduce exposure Use Microsoft Defender or equivalent endpoint protection Implement application whitelisting Restrict document preview/opening from untrusted sources. |
| Commentary | This has not yet been fixed in Office for Mac LTSC. |
| Threat Intelligence Comment | CVE-2025-54910 is a high-severity heap-based buffer overflow vulnerability in Microsoft Office (CVSS score 8.4) affecting multiple versions including Office 2016, 2019, 2021, 2024, Microsoft 365 Apps, and Mac LTSC editions. It can be exploited without user interaction via the Preview Pane in Outlook by processing a maliciously crafted document, allowing attackers to execute arbitrary code with the current user’s privileges. Exploitation risks include full system compromise, unauthorised data access, file modification or deletion, malware installation, and system disruption. Microsoft recommends disabling the Preview Pane, using endpoint protection like Microsoft Defender, implementing application whitelisting, and restricting document previews from untrusted sources. While patches are available for most Office versions, Mac LTSC editions remain unpatched. |
| Link | CVE-2025-54910 – Security Update Guide – Microsoft – Microsoft Office Remote Code Execution Vulnerability |
