August Patch Tuesday: Patch Now for Kerberos EoP, Graphics RCEs, and SharePoint Risks

Microsoft’s August Patch Tuesday landed as a heavy-duty maintenance window for Windows environments, with the vendor listing more than a hundred fixes across its product portfolio — including a clutch of high-profile remote code execution (RCE) and elevation-of-privilege flaws that demand immediate attention from sysadmins and security teams. The batch includes a publicly known Kerberos elevation-of-privilege issue, a pair of near–top-score RCE defects affecting the Windows graphics stack, and multiple SharePoint and Hyper‑V fixes that could enable lateral movement or full domain compromise if chained with other flaws. The advisories released with this cycle state that none of the addressed vulnerabilities were observed under active exploitation at release time, but historical patterns show that “no active exploitation” at release is not a reliable comfort — rapid, prioritized patching is still required.

Background​

What this Patch Tuesday covers​

This monthly security update addresses an extensive set of issues spanning the Windows operating system, Office and server products, virtualization and cloud-edge components, and third‑party vendors. Among the most consequential items are critical-rated RCE vulnerabilities in graphics components and Office, an elevation-of-privilege flaw in Kerberos that is publicly known, and a remotely exploitable SharePoint RCE that requires authentication but can be triggered over the network. Forum and community briefings produced alongside the vendor advisories list dozens of fixes in Hyper‑V, Azure Stack Hub, Microsoft Teams, RRAS and other widely deployed subsystems.

Why this matters now​

Even when Microsoft’s advisory language assesses “exploitation less likely” or lists no known in-the-wild attacks at release, the operational reality is that attackers rapidly reverse-engineer public advisories and weaponize the easiest paths. Graphics and document-handling vulnerabilities are especially attractive because they can often be triggered with minimal user interaction — by viewing a crafted image or previewing a document — and delivered via common vectors such as malicious web pages, advertising networks, or email attachments. The combination of remote exploitability and common delivery vectors elevates the risk profile for enterprises and service providers.

---

Overview of the most significant fixes​

Kerberos elevation-of-privilege — CVE-2025-53779​

• Impact: Elevation of privilege in Windows Kerberos delegation mechanics that could lead to domain administrator escalation under constrained conditions.
• Severity: Rated 7.2 CVSS base score; Microsoft rates “exploitation less likely” because the exploit chain requires prior authenticated access and specific write privileges to dMSA attributes.
• Attack prerequisites: An attacker would need authenticated access and the ability to modify msds-ManagedAccountPrecededByLink or related dMSA attributes to abuse delegation semantics.
• Why it matters: If an attacker can satisfy the preconditions, the advisory warns a successful exploit could gain domain administrator privileges, a catastrophic outcome for any domain‑joined environment.

Administrators should treat this Kerberos weakness as a high-priority remediation for domain controllers and identity infrastructure despite Microsoft’s “less likely” language: the privilege escalation vector targets identity delegation semantics and, when combined with other footholds or misconfigurations, can become an operational knockout blow.

Graphics stack RCEs — CVE-2025-53766 (GDI+) and CVE-2025-50165 (Windows Graphics Component)​

Two of this month’s highest-severity items scored at or very near the maximum on the CVSS scale and deserve immediate patching.

• CVE-2025-53766 — GDI+ heap-based buffer overflow
• Impact: Remote code execution via a heap-based buffer overflow in the Windows Graphics Device Interface (GDI+).
• Exploit vectors: No privileges required; exploitation can occur by visiting a malicious webpage or opening a crafted document/asset that contains the malformed graphic. Ad networks and standard web content delivery mechanisms can be abused to massively scale impact.
• Why it’s serious: The flaw enables code execution in the context of the user and can be delivered silently through web or document vectors — a classic browser/document-style remote compromise.
• CVE-2025-50165 — Windows Graphics Component JPEG RCE
• Impact: RCE triggered by viewing a specially crafted JPEG image embedded in Office or third-party files.
• Exploit vectors: Embedding in Office documents, third-party file types, or web content; no user privileges required for successful exploitation.
• Attribution: Reported to Microsoft by external researchers and listed among critical fixes for the cycle.

These graphics-related bugs share a dangerous property: they can be weaponized into no-click or low‑click attacks (for example, preview panes or auto-rendering in browsers and document viewers), enabling broad-scale compromise with minimal attacker effort. Any environment that uses Office, browser content rendering, or processes user-supplied images should prioritize these patches.

SharePoint remote code execution — CVE-2025-49712 (as reported)​

SharePoint continues to be a recurring hot spot in Patch Tuesday cycles.

• Impact: RCE that can be triggered by an authenticated user and is remotely exploitable.
• Severity: High — critical class vulnerability allowing authenticated attackers to trigger remote execution chains.
• Operational guidance: The advisory notes the flaw type is commonly used in second-stage exploit chains, where an initial authentication bypass enables the attacker to reach this RCE. Given the number of documented authentication bypasses that have circulated, this SharePoint bug increases the urgency of patching and hardening SharePoint instances, particularly those exposed to public internet traffic.

SharePoint services that must remain internet-accessible should be behind strict reverse proxies, application gateways, or limited by IP/identity-based access controls to reduce exposure until patches are applied.

Hyper‑V and virtualization fixes​

This release also addresses multiple Hyper‑V issues, including information disclosure, spoofing, and local/remote code execution paths. Hyper‑V vulnerabilities that permit VM escape, information leakage, or privilege spoofing are particularly severe in mixed-tenant or nested virtualization scenarios, because a compromised guest can impact host or adjacent VMs.

• Examples from the cycle: Hyper‑V information disclosure (CVE-2025-53781), spoofing (CVE-2025-49707), and RCE (CVE-2025-48807).
• Why to prioritize: Virtualization holes can bypass multi-tenant boundaries and lead to broad lateral movement. Patch hypervisor hosts and guest integration services in a coordinated maintenance window.

Other critical items noted in the update​

• MSMQ RCE (CVE-2025-50177) and multiple Office RCEs (CVE-2025-53731, CVE-2025-53740).
• NTLM elevation-of-privilege (CVE-2025-53778) and Azure Stack Hub information disclosure (CVE-2025-53793).
• Various other Windows kernel and service-level RCEs and EoP flaws were tallied as critical across the release notes and community briefings.

---

Third-party and ecosystem patches: Adobe, SAP, Intel, Google (Android)​

This Patch Tuesday cycle isn’t limited to Microsoft; multiple ecosystem vendors released significant updates.

Adobe​

• Scope: Adobe released updates that reportedly address dozens of CVEs across products such as InCopy, InDesign, Commerce, Substance 3D suite, Animate, Illustrator, Photoshop, FrameMaker, and more.
• Highlights: Multiple critical-rated RCEs in InCopy and other creative tools; patching creative-suite endpoints should be part of standard desktop remediation plans. (Adobe’s advisory set was summarized in contemporaneous reporting but was not independently verified with vendor pages in this briefing.)

SAP​

• Scope: SAP published new security notes and updates, including several critical code-injection flaws affecting S/4HANA and Landscape Transformation analysis platform.
• Action: Start with the highest-rated SAP notes (9.9 severity reported) when scheduling ERP patching; prioritize the public-cloud and on‑premise S/4HANA instances.

Intel​

• Scope: Intel’s advisory corpus this month covered dozens of vulnerabilities across firmware, drivers and software; several high-severity issues affected Xeon 6 family processors and some Intel Ethernet drivers for Linux.
• Risk: Some of these flaws can lead to privilege escalation, information disclosure, or denial-of-service on affected drivers and firmware.

Google / Android & Qualcomm​

• Scope: Android updates this month reportedly addressed actively exploited Qualcomm vulnerabilities disclosed in June, including CVE-2025-27038 and CVE-2025-21479, which were described as potentially under targeted exploitation.
• Action: Mobile fleets using Qualcomm SoCs should prioritize OEM-supplied Android security patches and verify that device management platforms are distributing vendor updates promptly.

Caveat: the above third‑party details were summarized from community reporting and internal briefing files; full validation against official vendor security advisories is recommended.

---

Technical and operational analysis​

What makes these vulnerabilities attractive to attackers​

• Common attack surface: Graphics libraries and document rendering are universal and frequently accept untrusted input (images, metafiles, embedded JPEGs), making them low-friction attack vectors.
• Low prerequisite exploitation: Several critical RCEs require no authentication or privileges, meaning they can often be triggered by unauthenticated network actors.
• Chaining potential: Elevation-of-privilege issues in Kerberos, NTLM, or service accounts pair readily with RCE footholds to build full domain compromise chains.
• Delivery scale: Web-based delivery via malicious pages, ad networks, or compromised advertising content enables high-scale distribution, increasing the potential impact of a single vulnerability.

Strengths in Microsoft’s response — what’s good​

• Comprehensive coverage: The release addresses a broad swath of Microsoft’s attack surface — Windows core, Office, SharePoint, Hyper‑V, Azure Stack Hub — demonstrating an effort to remediate systemic memory and parsing issues.
• Coordination with researchers: Multiple vulnerabilities were credited to external researchers and vendors, showing active researcher engagement and responsible disclosure pathways.
• Transparent exploitability guidance: Microsoft’s advisories indicate conditions and exploitability assessments (for example, “exploitation less likely”), which help administrators prioritize.

Risks and areas of concern​

• “Exploitation less likely” language can be misleading: Past cycles where Microsoft reported no active exploitation have nonetheless been followed by rapid weaponization. Operational teams should not rely solely on exploitability qualifiers to delay patching.
• Complex prerequisite chains glossed over: Some elevation-of-privilege advisories (Kerberos dMSA-related) require niche preconditions that can be present in poorly configured or legacy environments — assuming they are rare is dangerous.
• Third-party dependencies: Creative suites, device firmware and ERP systems add friction to coordinated patching, increasing the window for adversary action.
• Limited independent verification in this briefing: External cross-checks against vendor advisory pages were not available during this report’s drafting; administrators should confirm CVE details directly from vendor security pages prior to applying mitigations.

---

Practical, prioritized remediation guidance for sysadmins​

Executive triage (what to patch first)​

• Patch exposed services and internet‑accessible assets: public SharePoint, RRAS, Azure Stack Hub endpoints, and any services that render user-controlled images or documents. These have the greatest immediate exposure.
• Patch hypervisor hosts and virtualized infrastructure: Hyper‑V host updates first, then guest integration components.
• Apply patches to Windows clients and Office that address the GDI+, JPEG, and Office RCEs to remove common document/image rendering vectors.
• Remediate identity and domain infrastructure: address Kerberos and NTLM related fixes on domain controllers and identity servers.
• Coordinate third‑party and firmware updates: Intel firmware/drivers, Adobe creative apps, and Android device fleets via MDM.

Practical deployment steps​

• Use staggered, monitored rollouts: deploy to test/Canary groups, run behavior monitoring, then gradually widen the rollout.
• Maintain image-level backups and snapshot hypervisor states before large host patches to enable rapid rollback if driver/firmware interactions cause disruptions.
• Validate post-patch behavior: check key services, event logs, and exploit-detection telemetry.
• Harden attack surface while patching: disable internet exposure for services that do not require it, restrict public access via network ACLs or WAFs, and apply least-privilege controls for service accounts.
• Prioritize monitoring for any indicators of compromise (IoCs) tied to post-release exploit attempts and pivot to emergency ramp-ups if active exploitation is detected.

Mitigations and compensating controls while patches are staged​

• Restrict ingress to vulnerable ports and services at the perimeter.
• Disable or restrict preview/auto-rendering features in email clients and document management systems where feasible.
• Remove unnecessary dMSA or delegated privileges until identity-focused patches are applied.
• Use endpoint detection and response (EDR) rules to catch anomalous behavior associated with known exploit patterns (unexpected child processes spawned from browsers or Office apps, network connections to suspicious URLs immediately after document previewing).

---

Hardening and long-term risk reduction​

Policy and architecture changes to reduce future blast radius​

• Limit public exposure of collaboration platforms: move away from direct internet-facing SharePoint and replace with reverse proxy front-ends and Zero Trust access controls.
• Protect identity infrastructure: treat dMSA and delegated account attributes as high-value configuration items with strict ACLs and change control.
• Adopt aggressive patch windows for components that parse untrusted input (browsers, Office rendering subsystems, imaging libraries) and coordinate security testing ahead of major releases.
• Enforce application allowlisting where possible and robust EDR telemetry to detect pre- and post-exploitation activity.

Process and automation​

• Implement faster patch validation pipelines: automated smoke tests that validate service availability and key functionality immediately after patch deployment.
• Embed threat intelligence into patch prioritization: track CVE weaponization trends and accelerate patches when proof-of-concept or exploit samples surface.
• Regularly inventory third-party dependencies and device fleets for timely OEM patch adoption and firmware updates.

---

Caveats, verification notes, and recommended next steps​

• External web verification of every CVE and vendor bulletin was not available at the time this briefing was drafted. The article’s technical summaries and CVE references are drawn from community and forum briefings consolidated in the internal security update archive and from contemporaneous reporting collected in briefing files. Administrators and security teams should confirm CVE IDs, severity scores, and vendor mitigation details directly against official vendor advisories and the Microsoft Security Update Guide prior to taking operational action.
• Where advisory text used qualifiers such as “exploitation less likely,” operational posture should treat the flaws conservatively — the historical pattern is that some vulnerabilities move from “unlikely” to “weaponized” in days or weeks after disclosure.
• If there are discrepancies between internal briefings and vendor pages (for example differing CVE numbers or affected component lists), prioritize the vendor’s official guidance and the published CVE entries.

---

Conclusion: a disciplined, prioritized response is non‑negotiable​

August’s Patch Tuesday is a dense and consequential set of updates that touches core Windows components, virtualization stacks, identity services, and a range of third‑party products. The technical makeup of the most serious issues — graphics and document parsing RCEs, Kerberos/NTLM elevation weaknesses, and SharePoint RCEs — makes them an ideal fit for exploitation chains that can escalate from an initial browser or document foothold to full domain compromise.
The pragmatic response for every security team is clear:

• Treat public-facing services and components that render untrusted content as the highest priorities.
• Coordinate hypervisor and host patches carefully, while rapidly patching client and Office endpoints to deny easy RCE vectors.
• Harden identity infrastructure and restrict delegation privileges until patches are applied.
• Verify every fix against official vendor advisories and maintain monitoring for post-patch exploitation indicators.

The scale and nature of the fixes in this cycle mean patching is not optional — it is an immediate operational imperative. The safest posture is fast, staged deployments coupled with network hardening and heightened detection until the new software state has stabilized across the estate.

---

Source: theregister.com Microsoft's Patch Tuesday gives sys admins a baker's dozen