Top Critical Vulnerabilities of the Week (September 2025): Windows, Office, Android and ICS

Microsoft Vulnerabilities: Windows, Office, Azure

• CVE-2025-55232 (CVSS 9.8): Microsoft High Performance Compute Pack – lets an unauthenticated attacker execute code remotely through deserialization of untrusted data. The flaw is potentially "wormable" and needs to be patched right away.
• CVE-2025-55234 (CVSS 8.8): Windows SMB Server – enables relay attacks and privilege escalation. Enabling SMB Signing and Extended Protection for Authentication (EPA) is recommended.
• CVE-2025-54918 (CVSS 8.8): Windows NTLM – lets attackers escalate to privileged accounts; it is exploited in attacks that seek SYSTEM-level access.
• CVE-2025-55226, CVE-2025-55228, CVE-2025-55236: Windows Graphics Kernel – allow remote code execution by winning race conditions or by exploiting authentication flaws.
• CVE-2025-55224: Windows Hyper-V – lets an authenticated user execute code remotely.
• CVE-2025-54910: Microsoft Office – a heap-based buffer overflow that allows remote code execution when a malicious file is opened.
• CVE-2025-53799: Windows Imaging Component – can leak portions of memory to unauthorized users.

Android

• CVE-2025-38352: Kernel – a zero-day that is actively exploited for privilege escalation with no user interaction.
• CVE-2025-48543: Android Runtime – a zero-day that allows privilege escalation and is under active exploitation.
• CVE-2025-48539: System component – a critical RCE flaw that requires an immediate update.

Infrastructure and ICS

• Critical flaws in Rockwell and ABB systems used in industrial sectors let attackers take control and escalate privileges in OT/ICS networks.

Other

• Sangoma: A critical zero-day in communications systems that can lead to data leakage.
• Salesloft Drift OAuth: An OAuth flaw that enables data exfiltration attacks against sales automation systems.

Sources and Recommendations

Patch Tuesday: Crowdstrike, Tenable, BleepingComputer
SecurityAffairs, CyberScoop, Splashtop
Android Security Bulletin
CISA, IndustrialCyber, Capturethebug

Patch production environments now and update all systems affected by the vulnerabilities listed above. Every delay in deploying patches significantly raises the risk that your IT infrastructure will be compromised.

For full details on the latest Patch Tuesday, see our article on Microsoft's September security updates. To learn how zero-day flaws work, read our comprehensive guide to 0-day vulnerabilities.