Patch Tuesday:​ October 2025's Microsoft Security Updates

October 2025 Patch Tuesday: Microsoft Fixes 175 Vulnerabilities Including 2 Actively Exploited Zero-Days

Executive Summary

Microsoft's October 2025 Patch Tuesday addresses a staggering 175 security vulnerabilities, including 6 zero-day vulnerabilities with 2 being actively exploited in the wild. This monthly security update includes 9 critical-severity flaws and 123 important-severity vulnerabilities that demand immediate attention from IT administrators and security teams.

Organizations must prioritize patching efforts to protect against actively exploited vulnerabilities targeting Windows drivers, remote access services, and critical infrastructure components like Windows Server Update Services (WSUS).

October 2025 Patch Tuesday by the Numbers

Actively Exploited Zero-Day Vulnerabilities (Immediate Action Required)

1. CVE-2025-24990: Windows Agere Modem Driver Elevation of Privilege

Severity: High (CVSS 7.8)
Status: Actively Exploited in the Wild
Attack Vector: Local

The Windows Agere Modem Driver contains an elevation of privilege vulnerability that attackers are actively exploiting as a second-stage payload following initial system compromise. Once exploited, threat actors can escalate privileges to gain deeper access to compromised systems.

Why This Matters: This vulnerability is being leveraged in active attack campaigns, making it a top priority for patching across all Windows environments.

Mitigation: Apply October 2025 security updates immediately to all Windows systems.

2. CVE-2025-59230: Windows Remote Access Connection Manager Elevation of Privilege

Severity: High (CVSS 7.8)
Status: Actively Exploited in the Wild
Attack Vector: Local

This vulnerability in the Windows Remote Access Connection Manager allows local attackers to exploit improper access controls to gain SYSTEM-level privileges. Attackers with initial access can leverage this flaw to achieve complete control over affected systems.

Why This Matters: Remote access services are critical infrastructure components, and privilege escalation vulnerabilities pose significant risks to enterprise environments.

Mitigation: Prioritize patching for systems with Remote Access Services enabled, particularly in VPN and remote work infrastructures.

Additional Zero-Day Vulnerabilities (Publicly Disclosed)

3. CVE-2025-24052: Windows Agere Modem Driver Elevation of Privilege

Severity: High (CVSS 7.8)
Status: Publicly Known (Not Yet Exploited)
Attack Vector: Local

A second Agere Modem Driver vulnerability allows attackers to gain administrative privileges on affected systems. While not yet exploited in the wild, public disclosure increases exploitation risk.

4. CVE-2025-2884: TPM 2.0 Out-of-Bounds Read Vulnerability

Severity: Varies
Status: Publicly Known
Attack Vector: Local

This vulnerability in the Trusted Platform Module (TPM) 2.0 specification affects the CryptHmacSign function, potentially allowing attackers to read sensitive memory contents or extract cryptographic secrets.

Impact: Organizations relying on TPM for BitLocker encryption, secure boot, or credential protection should prioritize this update.

Mitigation: Update TPM firmware and apply Windows security patches to affected systems.

Critical Remote Code Execution Vulnerabilities

CVE-2025-59287: Windows Server Update Services (WSUS) RCE

Severity: Critical (CVSS 9.8)
Attack Vector: Network (Remote, Unauthenticated)
User Interaction: None Required

The Threat: This critical vulnerability allows remote, unauthenticated attackers to execute arbitrary code with elevated privileges on vulnerable WSUS servers. The vulnerability is wormable, meaning it can spread automatically between affected WSUS servers without user interaction.

Why This Is Critical:

• No authentication required
• No user interaction needed
• Can compromise enterprise patch management infrastructure
• Potential for lateral movement across networks

Who's Affected: Organizations using Windows Server Update Services for patch management.

Mitigation Priority: IMMEDIATE - Update all WSUS servers as soon as possible.

CVE-2025-59234 & CVE-2025-59236: Microsoft Office and Excel RCE

Severity: High
Attack Vector: User must open malicious file

Microsoft patched critical use-after-free vulnerabilities in Office and Excel that enable remote code execution when users open specially crafted documents.

CVE-2025-59234: Microsoft Office use-after-free RCE
CVE-2025-59236: Microsoft Excel use-after-free RCE

Attack Scenario: Attackers can craft malicious Office or Excel files and distribute them via email phishing campaigns. When opened, these files execute arbitrary code on the victim's system.

Mitigation:

• Apply October 2025 Office updates immediately
• Educate users about opening unexpected email attachments
• Enable Protected View in Office applications

CVE-2025-59228 & CVE-2025-59237: SharePoint Server RCE

Severity: High (CVSS 8.8)
Attack Vector: Network

Two remote code execution vulnerabilities affect SharePoint Server, allowing authenticated attackers to execute arbitrary code on vulnerable SharePoint installations.

Who's Affected: Organizations running SharePoint Server for collaboration and document management.

Mitigation: Update SharePoint Server deployments immediately.

Azure Cloud Security Vulnerabilities

CVE-2025-59218: Azure Entra ID Authentication Bypass

Severity: Critical (CVSS 9.6)
Platform: Azure Cloud

A critical authentication bypass vulnerability in Azure Entra ID (formerly Azure Active Directory) could allow attackers to circumvent authentication mechanisms.

Impact: Unauthorized access to cloud resources and identity management systems.

Mitigation: Azure customers should verify automatic updates have been applied to their Entra ID tenants.

Additional Azure Vulnerabilities

• CVE-2025-59246: Azure security flaw requiring immediate attention
• Additional Azure service vulnerabilities affecting cloud infrastructure

Azure Customers: Review the Azure Security Updates page for service-specific guidance and ensure cloud resources are properly configured.

Legacy Component Vulnerability

CVE-2016-9535: LibTIFF Heap Buffer Overflow

Severity: Varies
Year Discovered: 2016

Microsoft patched a legacy LibTIFF heap buffer overflow vulnerability that has existed since 2016. This vulnerability affects TIFF image processing libraries.

Why Patching Old Vulnerabilities Matters: Legacy vulnerabilities can still be exploited in modern systems, especially in components that haven't been updated or are rarely reviewed.

Windows 10 End of Life Notice

Important: Windows 10 reached its end-of-life in October 2025. Organizations still running Windows 10 should:

1. Migrate to Windows 11 or a supported operating system immediately
2. Consider Extended Security Updates (ESU) for systems that cannot be upgraded immediately
3. Understand that unsupported systems will no longer receive security patches

Security Risk: Running unsupported operating systems dramatically increases vulnerability to cyberattacks.

Vulnerability Categories Breakdown

Elevation of Privilege (EoP)

• Multiple Windows kernel vulnerabilities
• Driver-based privilege escalation flaws
• Service and application EoP issues

Remote Code Execution (RCE)

• Office and Excel vulnerabilities
• SharePoint Server flaws
• WSUS critical vulnerability
• Azure service vulnerabilities

Information Disclosure

• Approximately 30 information disclosure vulnerabilities patched
• Memory leak issues
• Sensitive data exposure risks

Denial of Service (DoS)

• Multiple DoS vulnerabilities across Windows components
• Service availability impacts

Security Feature Bypass

• BitLocker encryption bypass vulnerability
• Authentication and authorization bypass issues

Patch Priority Matrix

Priority 1: Patch Immediately (Within 24-48 Hours)

1. CVE-2025-24990 - Actively exploited Windows Agere Modem Driver EoP
2. CVE-2025-59230 - Actively exploited Windows Remote Access Connection Manager EoP
3. CVE-2025-59287 - Critical WSUS RCE (CVSS 9.8, wormable)
4. CVE-2025-59218 - Azure Entra ID Authentication Bypass (CVSS 9.6)

Priority 2: Patch Within One Week

5. CVE-2025-24052 - Windows Agere Modem Driver EoP (publicly known)
6. CVE-2025-2884 - TPM 2.0 vulnerability (publicly known)
7. CVE-2025-59234, CVE-2025-59236 - Office/Excel RCE vulnerabilities
8. CVE-2025-59228, CVE-2025-59237 - SharePoint Server RCE
9. Other critical-severity vulnerabilities

Priority 3: Standard Patch Cycle (Within 30 Days)

10. Important and moderate severity vulnerabilities
11. Information disclosure and denial of service vulnerabilities

Patching Best Practices

1. Test Before Deploying

• Deploy patches to test environments first
• Validate critical applications and services
• Monitor for compatibility issues

2. Segment Your Rollout

• Patch servers and critical infrastructure first
• Roll out to workstations in phases
• Maintain backup and rollback capabilities

3. Verify Patch Application

• Use security tools to confirm successful installation
• Scan for unpatched systems
• Document patching status

4. Monitor for Exploitation Attempts

• Review security logs for indicators of compromise
• Watch for unusual privilege escalation activities
• Monitor remote access and VPN logs

Additional Security Recommendations

For IT Administrators

1. Enable automatic updates for Microsoft 365 and cloud services
2. Implement least privilege access controls
3. Deploy endpoint detection and response (EDR) solutions
4. Conduct vulnerability scans post-patching
5. Maintain asset inventory to track all systems requiring updates

For Security Teams

1. Review threat intelligence for active exploitation campaigns
2. Hunt for indicators of compromise related to zero-day vulnerabilities
3. Update detection signatures for newly disclosed vulnerabilities
4. Coordinate with incident response teams for potential breaches
5. Communicate with stakeholders about patching timelines and risks

For End Users

1. Restart systems to complete patch installation
2. Update Microsoft Office applications
3. Report suspicious activity to IT security teams
4. Avoid opening unexpected email attachments

Resources and References

• Microsoft Security Response Center (MSRC): https://msrc.microsoft.com
• Microsoft Update Catalog: https://www.catalog.update.microsoft.com
• CISA Known Exploited Vulnerabilities: https://www.cisa.gov/known-exploited-vulnerabilities
• Azure Security Updates: https://azure.microsoft.com/updates

The October 2025 Patch Tuesday represents a significant security update with multiple critical vulnerabilities requiring immediate attention. The combination of actively exploited zero-days, critical remote code execution flaws, and wormable WSUS vulnerability makes this month's patching cycle particularly urgent.

Organizations must prioritize patching efforts, focusing first on actively exploited vulnerabilities and critical infrastructure components like WSUS servers. With 175 total vulnerabilities addressed, comprehensive patch management and testing are essential to maintaining security posture while ensuring business continuity.

Key Takeaway: Don't delay patching. The presence of actively exploited zero-days means attackers are already leveraging these vulnerabilities in the wild. Every day without patches increases your organization's risk exposure.

Last Updated: October 15, 2025
Next Patch Tuesday: November 12, 2025

Windows 10 End of Support

October 14, 2025 is the last day Windows 10 receives free monthly security updates. The final cumulative security update will be released for all supported versions, including 22H2. After this date, Windows 10 devices will no longer receive:

• Security updates
• Technical support
• Feature updates

What This Means for Users

• Upgrade to Windows 11: To continue receiving security updates and support, users should migrate to Windows 11 before the cutoff date.
• Extended Security Updates (ESU): Organizations and users who cannot immediately upgrade can enroll in Microsoft's paid ESU program to receive critical and important security updates for up to three additional years.
• Security Risks: Devices remaining on Windows 10 without ESU will be increasingly vulnerable to security threats as new vulnerabilities are discovered.

Recommended Actions

• Inventory all Windows 10 devices in your environment
• Plan and test Windows 11 upgrades before the deadline
• For devices that cannot be upgraded, evaluate ESU enrollment
• Communicate the timeline and implications to all stakeholders

Other October 2025 Updates