# Microsoft Patch Tuesday August 2025 critical RCE fixes

Published: 2026-06-09 · Severity: routine · Sectors: government-national, financial-services, healthcare, technology, defense, education, manufacturing
Canonical: https://vorant.io/reports/b618c8b7-ceb5-5714-b0ed-78bbb1524188/microsoft-patch-tuesday-august-2025-critical-rce-fixes

> Microsoft issued patches for multiple critical RCE vulnerabilities across Exchange, SQL Server, Windows, Office and cloud products; no active exploitation reported.

On August 12, 2025, Microsoft released patches addressing multiple vulnerabilities across a broad range of products and services. The most severe vulnerabilities allow remote code execution in the context of the logged-on user, potentially enabling attackers to install programs, view or modify data, or create new accounts with elevated privileges. The severity of impact depends on the privileges of the compromised user account; administrative accounts face greater risk than those with restricted permissions.

Affected products span Microsoft's enterprise and consumer portfolios, including Exchange Server, SQL Server, Windows Hyper-V, Azure services, Microsoft Office applications (Word, Excel, PowerPoint, SharePoint), Microsoft Edge for Android, Windows kernel components, Remote Desktop Services, Azure Stack, Microsoft Teams, and various Windows subsystems. The advisory notes no current reports of in-the-wild exploitation. CIS-ISAC recommends immediate patching after appropriate testing, implementation of least-privilege principles, automated patch management, and endpoint detection controls.

## Detection guidance (public sample)

### Office Application Spawning Script or Command Interpreter

ATT&CK: T1203

Word, Excel or PowerPoint spawning cmd, PowerShell or script hosts, a common sign of a client-side RCE or malicious document. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script or Command Interpreter
id: 9c565d08-b12c-591b-ba63-2620a8de2184
status: experimental
description: Detects Microsoft Office applications spawning command interpreters or
  script hosts. This is typical post-exploitation behaviour after exploitation of
  an Office client-side RCE vulnerability or a malicious document. Matches the parent/child
  relation, not any specific exploit artefact.
tags:
- attack.execution
- attack.t1203
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Business macros or add-ins that legitimately launch cmd or PowerShell
- Legacy Excel-based automation that shells out to scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
```

### IIS Worker Process Spawning Command Shell

ATT&CK: T1190

w3wp.exe (for example Exchange or SharePoint app pools) spawning cmd or PowerShell, indicating webshell or exploitation of a public-facing app. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Command Shell
id: b219706c-4ea2-5f2e-9c56-6ca58190c8e9
status: experimental
description: Detects the IIS worker process w3wp.exe spawning a command interpreter
  or common living-off-the-land utilities. This is typical of webshell activity or
  exploitation of public-facing Exchange, SharePoint or other IIS-hosted applications.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
  condition: selection
falsepositives:
- Web applications that intentionally invoke cmd or PowerShell for administrative
  functions
- Some SharePoint or Exchange management operations that launch PowerShell from an
  app pool
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
```

### SQL Server Process Spawning Command Interpreter

ATT&CK: T1059

sqlservr.exe spawning cmd or PowerShell, consistent with xp_cmdshell abuse or SQL Server RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Server Process Spawning Command Interpreter
id: a165512e-2e7d-5fb9-9ddc-13f28e039e57
status: experimental
description: Detects the SQL Server service process spawning cmd, PowerShell or script
  hosts. This can indicate xp_cmdshell abuse or post-exploitation after a SQL Server
  remote code execution vulnerability.
tags:
- attack.execution
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sqlservr.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection
falsepositives:
- DBA maintenance jobs that intentionally enable xp_cmdshell
- Legacy SQL Agent jobs running batch files through cmd
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-august-12-2025_2025-070

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b618c8b7-ceb5-5714-b0ed-78bbb1524188/microsoft-patch-tuesday-august-2025-critical-rce-fixes.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup