# Microsoft Patch Tuesday September 2025 RCE vulnerabilities

Published: 2026-06-09 · Severity: routine · Sectors: government-national, financial-services, healthcare, technology, education, manufacturing
Canonical: https://vorant.io/reports/b64008d5-e9cf-5e8d-b254-f666048a36e5/microsoft-patch-tuesday-september-2025-rce-vulnerabilities

> Microsoft ships patches for multiple RCE flaws across Windows and Office; no active exploitation reported.

Microsoft released critical patches on September 9, 2025, addressing multiple vulnerabilities across Windows, Office, and related services. The most severe vulnerabilities allow remote code execution, granting attackers the same privileges as the logged-on user. Successful exploitation could enable attackers to install programs, modify or delete data, or create new accounts with full user rights. The impact scales with user privileges; administrative accounts present higher risk than standard users.

Affected components span a broad range of Microsoft products including SQL Server, Azure Windows Virtual Machine Agent, PowerShell, Edge, Windows RRAS, imaging, graphics, kernel, networking, SMB, Office applications (Excel, Word, PowerPoint, SharePoint, Visio), BitLocker, NTFS, NTLM, and Hyper-V. No evidence of active exploitation in the wild has been reported at time of advisory. Defenders should prioritize immediate patching after appropriate testing, implement vulnerability scanning and remediation processes, apply least-privilege principles, and maintain network segmentation to limit blast radius.

## Detection guidance (public sample)

### Office Application Spawning Script Interpreter or LOLBin

ATT&CK: T1203

Detects Word, Excel, PowerPoint, Visio or Outlook spawning shells, script hosts or common LOLBins, a typical post-exploitation pattern for Office RCE and malicious documents. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Microsoft Office processes spawning command shells, script hosts
  or common living-off-the-land binaries. This is the typical child-process pattern
  after client-side exploitation of an Office RCE vulnerability or a malicious document.
  It matches the parent/child relation, not a specific CVE or payload.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \VISIO.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legacy Office macros or add-ins that legitimately call cmd.exe or PowerShell for
  business automation
- Outlook rules or add-ins launching helper scripts in some enterprise environments
level: high
id: cea92b86-1e9c-5268-b60b-fd94210e46af
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-09-2025_2025-082
```

### SQL Server Service Spawning Command Shell or PowerShell

ATT&CK: T1190

Detects the SQL Server engine process spawning a command interpreter, indicating xp_cmdshell abuse or exploitation of the database service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Server Service Spawning Command Shell or PowerShell
description: Detects sqlservr.exe spawning cmd.exe, PowerShell or other interpreters
  and LOLBins. This can indicate exploitation of a SQL Server vulnerability or xp_cmdshell
  abuse after compromise of an exposed database. It matches the parent/child relation,
  not a specific payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sqlservr.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- DBA-approved jobs that use xp_cmdshell for file operations or backups
- Legacy application maintenance scripts launched from SQL Agent or the engine
level: medium
id: 1b49e478-44e6-580d-b502-e59e4ace417e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-09-2025_2025-082
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-september-09-2025_2025-082

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b64008d5-e9cf-5e8d-b254-f666048a36e5/microsoft-patch-tuesday-september-2025-rce-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup