Microsoft Patch Tuesday September 2025 RCE vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft ships patches for multiple RCE flaws across Windows and Office; no active exploitation reported.
Microsoft released critical patches on September 9, 2025, addressing multiple vulnerabilities across Windows, Office, and related services. The most severe vulnerabilities allow remote code execution, granting attackers the same privileges as the logged-on user. Successful exploitation could enable attackers to install programs, modify or delete data, or create new accounts with full user rights. The impact scales with user privileges; administrative accounts present higher risk than standard users.
Affected components span a broad range of Microsoft products including SQL Server, Azure Windows Virtual Machine Agent, PowerShell, Edge, Windows RRAS, imaging, graphics, kernel, networking, SMB, Office applications (Excel, Word, PowerPoint, SharePoint, Visio), BitLocker, NTFS, NTLM, and Hyper-V. No evidence of active exploitation in the wild has been reported at time of advisory. Defenders should prioritize immediate patching after appropriate testing, implement vulnerability scanning and remediation processes, apply least-privilege principles, and maintain network segmentation to limit blast radius.
Detection guidance
Office Application Spawning Script Interpreter or LOLBin
Detects Word, Excel, PowerPoint, Visio or Outlook spawning shells, script hosts or common LOLBins, a typical post-exploitation pattern for Office RCE and malicious documents. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Microsoft Office processes spawning command shells, script hosts
or common living-off-the-land binaries. This is the typical child-process pattern
after client-side exploitation of an Office RCE vulnerability or a malicious document.
It matches the parent/child relation, not a specific CVE or payload.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \VISIO.EXE
- \OUTLOOK.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Legacy Office macros or add-ins that legitimately call cmd.exe or PowerShell for
business automation
- Outlook rules or add-ins launching helper scripts in some enterprise environments
level: high
id: cea92b86-1e9c-5268-b60b-fd94210e46af
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-09-2025_2025-082
SQL Server Service Spawning Command Shell or PowerShell
Detects the SQL Server engine process spawning a command interpreter, indicating xp_cmdshell abuse or exploitation of the database service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Service Spawning Command Shell or PowerShell
description: Detects sqlservr.exe spawning cmd.exe, PowerShell or other interpreters
and LOLBins. This can indicate exploitation of a SQL Server vulnerability or xp_cmdshell
abuse after compromise of an exposed database. It matches the parent/child relation,
not a specific payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \sqlservr.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- DBA-approved jobs that use xp_cmdshell for file operations or backups
- Legacy application maintenance scripts launched from SQL Agent or the engine
level: medium
id: 1b49e478-44e6-580d-b502-e59e4ace417e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-09-2025_2025-082
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-09-2025_2025-082
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs