Microsoft Patches 137 CVEs in July, but No Zero-Days

Microsoft's July security update discloses 137 vulnerabilities — 14 rated critical — including an urgent unauthenticated remote code execution in the NEGOEX/SPNEGO extended negotiation (CVE-2025-47981) that can execute code in LSASS, multiple high-risk RCEs in Office and SharePoint, privilege escalation and security-bypass flaws (including BitLocker bypasses), and a publicly disclosed SQL Server information-leak issue; vendors and defenders are urged to patch immediately and monitor for NEGOEX/SPNEGO activity and unusual authentication traffic due to the likelihood of rapid weaponization.