Microsoft Patch Tuesday Fixes Pwn2Own-Found SharePoint RCE

Microsoft’s July 2025 Patch Tuesday (released July 8) fixed 137 vulnerabilities, including 14 Critical flaws, of which 10 allow remote code execution (RCE) with minimal or no user interaction. Critical issues span Windows, Office, SharePoint, SQL Server, and more. BaseFortify.eu users receive early warnings, tailored mitigation steps, and continuous monitoring for these releases—register today to stay ahead.

Wormable Windows Flaw: CVE-2025-47981

A heap-based buffer overflow in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism allows an unauthenticated attacker to execute code simply by sending a crafted network message. Because there’s no user interaction and the code runs with elevated privileges, it’s classified as wormable.

Action:

Verify deployment of the July 8 Windows updates on all edge and domain-joined servers.
Ensure Windows Update (or WSUS) is functioning correctly.
“Test and rollout these patche quikly,” advises Dustin Childs of ZDI.

Office Preview Pane RCEs: CVE-2025-49695, CVE-49696, CVE-49697, CVE-49702

July’s release addresses four Critical RCE bugs in Microsoft Office and Word exploitable via the Preview Pane without opening a document. Three carry an 8.4 CVSS score, one a 7.8. Mac users on LTSC 2021/2024 remain unpatched and should disable the Preview Pane until updates arrive.

Action:

Deploy Office updates on Windows via your update management tool.
On Mac workstations, delay Office LTSC use or disable Preview Pane equivalents.
Monitor BaseFortify.eu for Mac-specific alerts and workarounds.

SharePoint RCE: CVE-2025-49704

A critical RCE in SharePoint Server, demonstrated at Pwn2Own Berlin, enables any authenticated user to execute code on the SharePoint host. This flaw carries an 8.8 CVSS score. Click on the link to check out our annotated CVE report and consult with our A.I. assistant for mitigation steps.

Action:

Install SharePoint Server security updates immediately.
Enforce MFA on all SharePoint accounts.
Review recent site-creation and privilege-escalation logs for anomalous activity.

SQL Server RCE: CVE-2025-49717

A heap overflow in Microsoft SQL Server allows remote code execution through a malicious query, potentially escaping to the OS. Rated 8.5, remediation involves both the SQL Server patch and updating to OLE DB Driver 18/19.

Action:

Apply the July SQL Server CU as documented in the Microsoft Update Guide.
Update applications to use OLE DB Driver 18 or 19.
Validate by restarting SQL instances and confirming connectivity.

Quick Vulnerability Checks

Run these PowerShell commands (as Administrator) to verify if key July updates are present:

    # List all July 8 updates and filter for SPNEGO (replace <KB_SPNEGO> with the actual KB)
    Get-HotFix | Where-Object { $_.InstalledOn -eq '7/8/2025' -and $_.HotFixID -eq '<KB_SPNEGO>' }

    # Check for SharePoint patch (replace <KB_SP2019> with your SharePoint KB)
    Get-HotFix | Where-Object { $_.HotFixID -eq '<KB_SP2019>' }

    # Alternatively, list all July 2025 fixes:
    wmic qfe list | findstr /i '07/08/2025'

Why BaseFortify.eu?

In today’s fast-paced threat landscape, staying on top of every critical patch and zero-day exploit can feel like an uphill battle. BaseFortify.eu is your dedicated partner in this fight, offering an all-in-one platform that not only alerts you to incoming vulnerabilities but also guides you through each step of remediation:

Real-Time Early Warnings
Receive notifications the moment a vendor announces a new patch or when a high-risk exploit—like the Pwn2Own-demonstrated SharePoint RCE—enters the wild. Never be caught off-guard again.
Tailored Mitigation Playbooks
Access concise, step-by-step guides and PowerShell snippets designed for your specific environment, whether you run Windows Server, SharePoint, SQL Server or Office on Mac.
Continuous Vulnerability Monitoring
Track the status of all relevant CVEs across your network, with automated scans and customizable dashboards that integrate seamlessly into SIEM and IT ticketing systems.
Expert Analysis & Recommendations
Benefit from in-depth write ups and video briefings from seasoned security researchers, helping you understand not just what to patch, but why it matters and how attackers might exploit it.
A.I. & Support
All our CVE reports are enhanced using A.I. Each has a tailor-made Q & A as well as an assistant that can be consulted.

Empower your organization with proactive defense — register now and transform Patch Tuesday from a scramble into a streamlined, manageable process.