CVE-2025-47981Patch(microsoft / windows_10_1507)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch microsoft windows_10_1507 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

1.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1507
  • windows_10_1607
  • windows_10_1809
  • windows_10_21h2

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-02-05); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
Products
windows_10_1507windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_22h2windows_11_23h2windows_11_24h2windows_server_2008windows_server_2012

2 versions affected across 15 products

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-02-05: 1Mentions · 2026-07-14: 1Mentions · 2026-07-15: 1Patch / Workaround · 2026-07-14: 1Patch / Workaround · 2026-07-15: 1Technical Details · 2026-02-05: 1Technical Details · 2026-07-14: 1Technical Details · 2026-07-15: 102-0507-1407-15
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-02-051
General1
2026-07-141
Patch1
2026-07-151
Patch1
Full discourse3 posts
  • Vistem Solutions@VistemSolutions
    Patch

    Wormable remote code execution vulnerabilities deserve immediate attention because they can spread quickly across vulnerable systems once exploited. Microsoft’s patch for CVE-2025-47981 in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism should be treated as a high-priority update for both Windows clients and Windows Server environments. What organizations should prioritize now: - Identify all affected Windows and Windows Server systems - Apply Microsoft security updates immediately and verify successful deployment - Prioritize internet-facing, domain-joined, and business-critical systems - Monitor for unusual authentication activity, crashes, lateral movement, and suspicious process execution - Enforce least privilege and restrict unnecessary network exposure between systems - Validate backups, rollback plans, and incident response procedures for critical infrastructure 𝗩𝗶𝘀𝘁𝗲𝗺 𝗘𝗹𝗲𝘃𝗮𝘁𝗲 𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝗯𝘆 𝗩𝗶𝘀𝘁𝗲𝗺𝗦𝗲𝗰𝘂𝗿𝗲𝗣𝗿𝗼 helps organizations move from reactive patching to outcome-driven vulnerability management with vCISO-led strategy, continuous monitoring, prioritized remediation, and measurable risk reduction. Contact: sales@vistem.com | http://www.vistem.com?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer #Cybersecurity #MicrosoftSecurity #WindowsSecurity #WindowsServer #CVE #RCE #VulnerabilityManagement #PatchManagement #IncidentResponse #CyberResilience #VistemElevate #VistemSecurePro #VistemSolutions #SecurityCompliance https://cybersecuritynews.com/microsoft-patches-wormable-rce-vulnerability/?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

    Post summary

    The post urges organizations to promptly apply Microsoft’s patch for CVE-2025-47981, highlighting its wormable RCE potential and recommending prioritized remediation and monitoring.

    0001067
    79 followersView on X
  • Decryption Digest ®@DecryptionDigst
    Patch

    127 CVEs patched in July 2026 Patch Tuesday. CVE-2025-47981 (CVSS 9.8): wormable Windows SPNEGO RCE via SMB/RDP with zero credentials. Patch before EOD. http://decryptiondigest.com #PatchTuesday #Windows #Microsoft #CyberSecurity #RCE #Infosec https://t.co/Uo3noathuW

    Post summary

    The tweet announces the patching of 127 CVEs, including CVE-2025-47981—a high‑severity Windows RCE—and urges applying the patch before end of day, with no evidence of active exploitation or PoC availability.

    00000116
    27 followersView on X
  • 🇨🇭 Alpenflug 🗽🇮🇱@alpeflug
    General

    @dev_maims Why use Linux in 2026? - Telemetry - “Recall” - CVE-2025-47981 (remote code incident)

    Post summary

    The tweet merely references CVE‑2025‑47981 as a remote code incident without providing additional details, tools, or mitigation information.

    0000039
    255 followersView on X
CPE platform detail19 entries

19 of 19 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1507--x64
OSmicrosoftwindows_10_1507--x86
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2---
OSmicrosoftwindows_10_22h2---
OSmicrosoftwindows_11_22h2---
OSmicrosoftwindows_11_23h2---
OSmicrosoftwindows_11_24h2---
OSmicrosoftwindows_server_2008r2-x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---
OSmicrosoftwindows_server_2022_23h2---
OSmicrosoftwindows_server_2025---

Explore more