Patch Tuesday, July 2025
Microsoft's monthly security release, Tuesday, July 8, 2025. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 8.8HighJul 8, 2025Microsoft SharePoint Code / command injectionCVE-2025-49704Microsoft SharePoint server is affected. An attacker gains arbitrary code execution on the targeted SharePoint server. Patch SharePoint server with latest security updates and configure proper security settings to prevent exploitation.Exploited100% likelyExploit codeMetasploit
- 6.5MediumJul 8, 2025Microsoft SharePoint Auth bypass / access controlCVE-2025-49706Microsoft SharePoint Server An attacker gains elevated privileges to SharePoint sites. Patch SharePoint Server with the latest security updates from Microsoft.Exploited99% likelyExploit codeMetasploit · NucleiDetection
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.