Security Advisory
The latest Security Advisory coverage — news, analysis, and updates from the WindowsNews.AI desk.
Critical Windows LSASS Bug Exposes Domain Controllers to Authentication DoS Attacks
Microsoft’s latest security advisory for CVE-2025-53809 details a network-exploitable denial-of-service flaw in the Windows Local Security Authority Subsystem Service, the bedrock of authentication...
Critical Windows Graphics Race Condition (CVE-2025-53807) Hands Out SYSTEM Access—Urgent Patch Guide
A race condition in the Windows Graphics Component can hand authenticated attackers full SYSTEM privileges, Microsoft disclosed this week. The vulnerability, cataloged as CVE-2025-53807, lurks in the...
CVE-2025-53806: Microsoft Patches RRAS Memory Disclosure Flaw in Windows VPN Servers
Microsoft has disclosed CVE-2025-53806, a new information disclosure vulnerability in the Windows Routing and Remote Access Service (RRAS) that allows attackers to read sensitive memory contents from...
Microsoft Patches Windows Imaging Component Flaw That Could Leak Sensitive Data Through Crafted Images
A critical information disclosure vulnerability in the Windows Imaging Component (WIC) was among the top fixes delivered in Microsoft’s July 2025 Patch Tuesday updates. Tracked as CVE-2025-47980,...
CVE-2025-49692: Azure Connected Machine Agent Vulnerability Demands Immediate Patching
Microsoft has released a security update to address a critical elevation-of-privilege vulnerability (CVE-2025-49692) in the Azure Connected Machine agent, the software component that enables Azure...
SQL Server Vulnerability CVE-2025-47997: Patch Now to Block Memory Disclosure Attacks
Microsoft has released patches for a critical information-disclosure vulnerability in SQL Server that could allow an authenticated attacker to read sensitive memory contents over the network. Tracked...
Microsoft AutoUpdate Vulnerability Lets Attackers Escalate to Root on macOS via Symlink Tricks
Microsoft has disclosed a fresh local elevation-of-privilege vulnerability in its Microsoft AutoUpdate (MAU) agent that allows an attacker with an existing foothold on a macOS machine to escalate to...
Azure Arc’s Critical Local Privilege Flaw Fixed, But CVE Muddle May Leave Systems Exposed
Microsoft has patched a high-severity local elevation-of-privilege vulnerability in Azure Arc, but confusion over the associated CVE identifier could cause dangerous patching delays, security...
Microsoft Flags Critical Visio Heap Overflow – Urgent Patch for CVE-2025-54907 Underway
Microsoft has confirmed a dangerous heap-based buffer overflow in Microsoft Office Visio that lets attackers execute malicious code simply by convincing a user to open a rigged diagram file. The...
CVE-2025-54899 Exposes Excel to Code Execution Attacks: Patch Deployed for Critical Memory-Safety Bug
Microsoft has released a security update to patch CVE-2025-54899, a memory-safety vulnerability in Excel that can allow attackers to execute arbitrary code on a victim's machine when a malicious...
How to Prioritize Patching with Microsoft’s Confidence Metric: Lessons from CVE-2025-54894
A single metric buried inside every Microsoft Security Response Center (MSRC) advisory could be the difference between a patching strategy that works and one that wastes precious time. Security teams...
Critical Windows Server VPN Gateway Flaw Allows Unauthenticated Remote Code Execution — Patch RRAS Now
Microsoft is urging organizations to immediately patch a series of critical heap-based buffer overflow vulnerabilities in Windows Routing and Remote Access Service (RRAS) that can be exploited...