Microsoft Patch Tuesday, August 2025: the CVEs, page 2

Microsoft Patch Tuesday August 2025: the CVEs Microsoft published on 12 August 2025, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025, Dec 2024, Nov 2024, Oct 2024, Sep 2024, Aug 2024. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 8.8CVE-2025-47954EPSS 1.7%2025-08-12

   Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

2. 7.5CVE-2025-33051EPSS 1.5%2025-08-12

   Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

3. 5.3CVE-2025-25007EPSS 0.9%2025-08-12

   Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

4. 5.3CVE-2025-25006EPSS 1.0%2025-08-12

   Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

5. 6.5CVE-2025-25005EPSS 1.6%2025-08-12

   Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

6. 8.8CVE-2025-24999EPSS 1.9%2025-08-12

   Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.