📄 The Patch Point
Your monthly briefing on patching, vulnerabilities, and small-business security operations
Issue: Microsoft July Patch Tuesday Edition | For IT leads, sysadmins, and small-business owners
Microsoft's July 2025 Patch Tuesday addresses 137 vulnerabilities across Windows, Office, SharePoint, SQL Server, .NET, and more. Of these, 14 are rated Critical — 11 of which are Remote Code Execution (RCE) bugs. No vulnerabilities are known to be actively exploited in the wild, but one publicly disclosed zero-day and a proof-of-concept exploit make this month's release urgent.
Total Vulnerabilities
Rated Critical
Critical RCE Bugs
Publicly Disclosed Zero-Day
🔍 Key Vulnerabilities to Know
CVE-2025-49719 — SQL Server Info Disclosure (Zero-Day)
Publicly disclosed before patching. Unauthenticated attackers can extract uninitialized memory — potentially exposing credentials or connection strings. A proof-of-concept exploit exists. Affects SQL Server 2016 through 2022. Rated Important but treat as Critical priority.
CVE-2025-47981 — Windows Netlogon RCE (CVSS 9.8)
Pre-authentication RCE in how Windows servers negotiate authentication mechanisms. CVSS score of 9.8 out of 10. Affects domain controllers and clients. Patch immediately — this is the highest-severity bug this month.
CVE-2025-49704 — SharePoint Server RCE (CVSS 7.7)
Authenticated attackers with Site Member permissions can execute arbitrary code remotely via code injection. Attack complexity is low and exploitation is rated "more likely" by Microsoft.
CVE-2025-49735 — Windows KDC Proxy RCE (CVSS 8.1)
Unauthenticated RCE in the Kerberos KDC Proxy Service. Affects Windows servers configured as KDC Proxy servers (not domain controllers). Exploitation rated "more likely" by Microsoft.
What end users should do right now
Install updates promptly, especially on Office and Windows machines connected to corporate systems. Prioritise CVE-2025-47981 and CVE-2025-49719 — the Netlogon RCE and SQL Server zero-day carry the highest real-world risk. Back up before patching — large Patch Tuesday releases can occasionally cause compatibility issues.
Why you shouldn't 'wait and see'
Delaying leaves a window for internal lateral movement or accidental exposure. The SQL Server zero-day already has a proof-of-concept in the wild — that shortens the exploitation window significantly. Treat non-critical endpoints as trust-but-verify: patch on cadence, audit regularly.
FEATURE — Best Practices for Automated Patch Management in Small Business
If the lead story is about what to patch, this feature is about how to keep it done — month after month, without burning your IT team out.
The small-business formula
For a small business, the best approach is to automate the routine patches, keep a small pilot group for testing, and use a critical-first rollout for security updates. You also want asset inventory, maintenance windows, reboot enforcement, and reporting so you can see what was patched and what failed [1][2][3][4].
Practical setup
A clean patching operation rests on these building blocks:
Maintain a full inventory
of endpoints and installed apps so nothing is missed [3][4].
Separate devices into groups
such as servers, office PCs, and business-critical laptops [3].
Test patches on a pilot group
before broad deployment, especially for line-of-business apps [5][3].
Prioritise critical and important security patches first
then handle lower-risk updates on a regular schedule [2][3].
Schedule deployments during maintenance windows
and allow limited deferral for users when needed [5][3].
Track patch success, failures, and reboots
with automated alerts and compliance reports [3][5].
Recommended policy
A simple policy works best: patch monthly for third-party apps, patch Windows and macOS on a fixed cadence, and push emergency fixes faster when vendors rate them as critical or actively exploited. Use one standard process for approval, deployment, rollback, and verification so updates do not depend on ad hoc IT decisions. For small teams, the goal is not perfection — it is fast, repeatable coverage with enough testing to avoid breaking payroll, accounting, or endpoint tools [6][7][4][1][2][5].
What good tooling looks like
Look for tools that can detect missing patches automatically, group devices by role, support third-party app patching, and generate compliance reports [8][6][5][3]. If you already use an RMM or endpoint management platform, integrate patching with ticketing and alerting so failures become actionable items instead of hidden risk. For Australian SMBs, this is especially useful when multiple SaaS, accounting, and identity tools need to stay aligned without manual chasing [8][6][5][3].