Monthly Fallout Report
September 2025 Fallout
81 vulnerabilities, SMB relay zero-day, KB5065426 refusing to install, DRM shattered, and Active Directory losing its mind.
Tired of patch chaos? Automox automates patching across Windows, Mac, and Linux — so you're never caught off guard on Patch Tuesday.
Try Free →Fallout Timeline
Vault dwellers, September 2025 brings 81 vulnerabilities including 2 publicly disclosed zero-days and 9 criticals. The headliner is CVE-2025-55234 — a privilege escalation flaw in Windows SMB Server that enables relay attacks, allowing attackers to impersonate users and escalate privileges. No active exploitation confirmed, but public details are out there, so the clock is ticking. The second zero-day is CVE-2024-21907 — a year-old denial-of-service flaw in Newtonsoft.Json now bundled into SQL Server patches (yes, really — a 2024 CVE finally getting its Microsoft fix in 2025). Critical NTLM flaw CVE-2025-54918 (CVSS 8.8) is flagged as "Exploitation More Likely" — chain it with other bugs and attackers could reach SYSTEM. Office RCE via CVE-2025-54910 is trigged through the Outlook Preview Pane with no user interaction — treat that one as urgent. Windows 10 (KB5065429) and Windows 11 (KB5065426/KB5065431) are this month's deployments. September also fixes the NDI streaming chaos left behind by August's updates. Patch, but test first — there's turbulence ahead.
Windows SMB Server Elevation of Privilege — enables relay attacks, publicly disclosed. Enable SMB Signing and EPA. New auditing tools in September updates help assess compatibility before hardening.
Newtonsoft.Json Denial of Service in SQL Server — a 2024 vulnerability finally patched via Microsoft. Unauthenticated attacker can crash SQL Server instances via crafted JSON. Critical infrastructure risk.
Windows NTLM Elevation of Privilege — flagged "Exploitation More Likely." Can escalate to SYSTEM level. Prioritize for Active Directory environments.
Microsoft Office RCE — triggered through the Outlook Preview Pane with no user interaction required. High urgency for any organization running Outlook.
Microsoft HPC Pack RCE — unauthenticated remote code execution over the network, potentially wormable. Block TCP port 5999 and deploy in secure enclaves. Patch immediately if running HPC Pack.
Sources: r/sysadmin · BleepingComputer · Neowin · Krebs on Security
Three days in and KB5065426 is fighting back — refusing to install on a significant number of Windows 11 24H2 systems with errors including 0x800F0991, 0x800F0922, 0x80071A2D, and 0x800F081F. Even the Microsoft Update Catalog workaround is failing for some. The Media Creation Tool is the current best fix. SMBv1 file sharing is broken after installing September updates — if you're still running SMBv1 (you shouldn't be, but here we are), connections to shared files and folders are failing. IIS modules are vanishing from IIS Manager post-update. Input method issues are causing certain apps to stop responding. The NTLM hardening story continues to nag legacy environments. Vault dwellers running HPC Pack: block TCP port 5999 immediately.
- Windows 11 24H2 KB5065426 failing to install — errors 0x800F0991, 0x800F0922, 0x80071A2D. Use Media Creation Tool as workaround
- Windows 11 (all) SMBv1 file sharing broken after September update — KB5065789 resolves this
- Windows 11 (all) IIS modules disappearing from IIS Manager — resolved in September update itself
- Windows 11 (all) PowerShell Direct (PSDirect) connection failures — edge case affecting hotpatched VMs, addressed in KB5066360
- Server / Enterprise NTLM hardening (CVE-2025-55234) — legacy device compatibility issues when enabling SMB signing/EPA. Use new auditing tools first
Sources: r/sysadmin · Windows Latest · AskWoody
Two weeks out and September is leaving a messy trail. The big new story: KB5065426 is causing Active Directory sync failures on Windows Server 2025 — large AD security groups with more than 10,000 members are not fully syncing via Microsoft Entra Connect Sync. Microsoft has a registry workaround (add a REG_DWORD at HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides with value 2362988687 = 0) but warns of risks. KB5066835 (Known Issue Rollback policy) is available for managed devices. Additionally, DRM is broken for digital TV and DVD apps using the Enhanced Video Renderer with HDCP enforcement — video jitters, playback interruptions, and copyright errors. EA games using the Javelin anti-cheat engine are also affected. Microsoft says a fix is coming in a future update. SMBv1 issues are resolved via KB5065789. The KB5065426 installation failures are easing as more workarounds circulate.
- Windows Server 2025 AD sync failures — large groups (10,000+ members) not syncing via Entra Connect Sync. Registry workaround available, KB5066835 KIR policy for managed devices
- Windows 11 24H2 DRM broken for digital TV and DVD apps using Enhanced Video Renderer with HDCP — video jitters, playback stops. Fix coming in future update
- Windows 11 (gaming) EA games using Javelin anti-cheat engine broken after September update — no fix yet
- Windows 11 (all) SMBv1 file sharing issues resolved via KB5065789
- Windows 11 (all) PowerShell Direct (PSDirect) VM connection failures resolved via KB5066360
Sources: BleepingComputer · Windows Latest · AskWoody
Resources