Microsoft Releases October 2025 Security Updates
Scheduled updates for Microsoft products address 175 vulnerabilities, of which 3 are under exploitation and 3 have been reported as publicly disclosed
Summary
Scheduled updates for Microsoft products address 175 vulnerabilities, of which 3 are under exploitation and 3 have been reported as publicly disclosed
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
Multiple other Microsoft platforms. Please see Microsoft's October 2025 Security Update guide for full details.
Threat details
Final security updates for Windows 10
From 14 October 2025, Windows 10 is end-of-life. The October 2025 security updates are the last available for Windows 10.
To ensure the continued security and efficiency of NHS digital systems, as well as protect patient data, all NHS Trusts and Integrated Care Boards (ICBs) must transition to Windows 11.
For more details please visit the Windows 10 end of support October 2025 page.
Introduction
Microsoft has released security updates to address 175 vulnerabilities in Microsoft products. 6 vulnerabilities are highlighted below.
Microsoft has reported exploitation for 3 vulnerabilities and a proof-of-concept exploit for 1 vulnerability
CVE-2025-24990, CVE-2025-59230, and CVE-2025-47827 have been reported as exploited by Microsoft.
A proof-of-concept exploit is available for CVE-2025-55680.
Vulnerability details
Exploited vulnerabilities:
- CVE-2025-24990 - Windows Agere Modem Driver Elevation of Privilege Vulnerability - CVSSv3 score: 7.8
- CVE-2025-59230 - Windows Remote Access Connection Manager Elevation of Privilege Vulnerability - CVSSv3 core: 7.8
- CVE-2025-47827 - Secure Boot Bypass in IGEL OS before 11 - CVSSv3 score: 4.6
- CVE-2025-55680 - Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability - CVSSv3 score: 7.8
Publicly disclosed vulnerabilities:
- CVE-2025-0033 - RMP Corruption During SNP Initialization (affecting AMD EPYC processors used in Azure Confidential Computing) - CVSSv3 score: 8.2
- CVE-2025-2884 - Out-of-Bounds Read Vulnerability in TCG TPM2.0 Reference Implementation - CVSSv3 score: 5.3
- CVE-2025-24052 - Windows Agere Modem Driver Elevation of Privilege Vulnerability - CVSSv3 score: 7.8
Threat updates
| Date | Update |
|---|---|
| 10 Nov 2025 |
Updated Exploitation Details
Added CVE-2025-55680 to CVE identifier list and updated exploitation details. |
Remediation advice
Affected organisations are encouraged to review Microsoft's October 2025 Security Updates and apply the relevant updates as soon as possible.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 10 November 2025 12:04 pm