Patch Tuesday, October 2025 ‘End of 10’ Edition
Summary: Microsoft released updates for 172 security holes in Windows, including two vulnerabilities already being actively exploited: CVE-2025-24990 in the Agere Modem driver, which Microsoft removed entirely, and CVE-2025-59230, an elevation of privilege flaw in Windows Remote Access Connection Manager. October also marks the final month Microsoft ships security updates for Windows 10, with Exchange Server 2016 and 2019, Skype for Business 2016, and Outlook 2016 among other products sunsetting.
Key Takeaway: CVE-2025-59287, a critical remote code execution bug in the Windows Server Update Service, carries a threat score of 9.8 and can be exploited without authentication by an attacker with network access, and because WSUS updates privileged files across the file system, an attacker could gain free rein over the operating system and potentially bypass EDR detections that exclude the service.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-24990CVE-2025-59227CVE-2025-59230CVE-2025-59234CVE-2025-59287
- Related
- Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped Cyber Risks ·CVE-2025-59287: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Oct 24, 2025