September Patch Tuesday: Microsoft Fixes Two Zero-Days and a Critical Windows NTLM Flaw

September's Big Patch Drop

As on every second Tuesday of the month, Windows administrators around the world were anxiously hitting refresh on Windows Update. For September's Patch Tuesday, Microsoft released 84 security fixes, 8 of them rated critical. This time, though, the bundle came with two particularly unpleasant surprises.

Two Zero-Days Handed to Attackers on a Silver Platter

The patched flaws include two zero-day vulnerabilities. In other words, they were known and potentially being actively exploited by cybercriminals before Microsoft managed to ship a fix.

1. CVE-2025-55234 (CVSS 8.8): This flaw in Windows SMB Server enabled relay attacks, letting attackers impersonate users on the network. It had also been publicly disclosed, which raised the risk of widespread exploitation even further.
2. The second vulnerability is less well documented, but it was also being actively exploited and gave attackers unauthorized access to systems.

Watch Out for NTLM!

The biggest stir, however, came from a critical flaw, CVE-2025-54918 (CVSS 8.8), in the Windows NTLM authentication mechanism. It allowed an authenticated but low-privileged attacker to remotely elevate their privileges to SYSTEM level. Put simply, anyone with basic access could easily take full control of a server. It's like handing an intern the keys to the server room and the combination to the safe.

This month Microsoft also fixed a number of other critical vulnerabilities that could lead to remote code execution, including flaws in Microsoft Office, the Windows Graphics Component and Hyper-V.

Our advice is the same as always. It's simple and boring, but it matters: patch your systems before cybercriminals exploit them for you. Unlike the rest of us, they never take a day off.

To learn more about zero-day vulnerabilities and the global market for them, read our comprehensive guide to 0-day vulnerabilities.

Sources: CrowdStrike, Redmond Magazine