Mitigating CVE-2025-22944 Remote Code Execution Vulnerability in Microsoft 365 Apps for Enterprise

Question

Mitigating CVE-2025-22944 Remote Code Execution Vulnerability in Microsoft 365 Apps for Enterprise

Lakin Marquieta 80

We manage Microsoft 365 Apps for Enterprise (Version 2409, Build 16829.20234) across 250 Windows 10/11 endpoints in an enterprise environment with Defender for Endpoint and Configuration Manager. Following the disclosure of CVE-2025-22944, a critical remote code execution vulnerability (CVSS 8.8) in Microsoft Office, we are urgently addressing risks from malicious file exploitation, which could allow attackers to execute arbitrary code or steal data.

The August 2025 security update (KB5063224) is queued for deployment, but we seek clarification to ensure robust mitigation.

Our environment includes mixed Office versions (Microsoft 365 Apps and Office LTSC 2021) with heavy use of Word/Excel for macro-enabled documents shared via OneDrive and Outlook.

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi Lakin Marquieta,

Welcome to Microsoft Q&A Forum!

Have a good day and hope you're doing well!

Thank you for sharing the details about the issue you're facing with CVE-2025-22944 in your Microsoft 365 Apps environment. I completely understand and empathize with your concern. This is a serious RCE vulnerability, especially in a system with 250 endpoints involving many macro-enabled documents, and deploying the KB5063224 patch requires support from tools like Defender for Endpoint (for monitoring and blocking unusual behavior) and Configuration Manager (for phased patch deployment). These tools are powerful for mitigating risks, but configuring them correctly can be complex and require specialized support.

As a moderator of this forum, I must note that our platform cannot provide direct support for advanced technical issues like configuring Defender for Endpoint or Configuration Manager, as they involve specific enterprise environments and may require system access. I highly recommend reaching out to Microsoft Intune Support for specialized assistance, including deployment guidance and troubleshooting. They have a team of experts ready to help via ticket or call. You can contact them here: Microsoft Intune Support (select the option to create a support request). User's image

In the meantime, while waiting for official support, here are some reliable resources from Microsoft for you to research further on Defender for Endpoint and Configuration Manager in the context of mitigating vulnerabilities like CVE-2025-22944:

Defender for Endpoint – Guide to Monitoring and Blocking Office Exploits: Microsoft Defender for Endpoint Documentation. Focus on setting up alerts for behaviors like Office calling PowerShell.
Configuration Manager – Deploying Patches and Updates: Configuration Manager Deployment Guide. Guidance on phased deployment for the KB5063224 patch on Windows endpoints.
Integrating Defender with Configuration Manager for Security: Attack Surface Reduction Rules. Specific rules to block RCE in Office apps.

If you have any general questions about the forum, need basic advice, or if I've misunderstood anything or something is unclear, feel free to let me know. Wishing you a smooth resolution!

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Lakin Marquieta 80 Reputation points

2025-09-30T07:59:41.2066667+00:00

Hi NghiaP

Thanks for the information, seem like we have to reach out to Intune team for the definitive solution right ? But I wonder how long of the support process since I create the ticket ?
Matthew-P 7,535 Reputation points Microsoft External Staff Moderator

2025-09-30T08:17:01.8533333+00:00

Hi Lakin Marquieta,

Thanks for your update. I'm glad to hear you're moving forward with creating a support ticket. Once you've submitted it, you'll receive a unique ticket ID from Microsoft. If you'd like, feel free to share that ID with me via private message here on the forum. I can help monitor its progress on your behalf and keep you informed of any updates, to make the process as smooth as possible.

Additionally, if you find my previous response helpful, you might consider marking it as "Accepted Answer". This would serve as a way to acknowledge the suggested direction for resolving your issue, while also turning your case into a valuable reference for other users facing similar challenges with CVE-2025-22944. It helps build a stronger, more helpful community for everyone involved. Of course, this is entirely up to you. I'm here to support however I can.

Let me know if there's anything else I can assist with!
Lakin Marquieta 80 Reputation points

2025-09-30T08:20:04.4233333+00:00

Ok, got it, thank you

Share via

Mitigating CVE-2025-22944 Remote Code Execution Vulnerability in Microsoft 365 Apps for Enterprise

0 additional answers

Your answer