Two New Windows Zero-Days Exploited in the Wild — One Affects Every Version Ever Shipped

Microsoft has released fixes for 183 security flaws across its products, including two Windows zero-days that have come under active exploitation in the wild.

The two Windows zero-days are CVE-2025-24990, a Windows Agere Modem Driver ("ltmdm64.sys") Elevation of Privilege Vulnerability, and CVE-2025-59230, a Windows Remote Access Connection Manager (RasMan) Elevation of Privilege Vulnerability; Microsoft notes both could allow attackers to execute code with elevated privileges, though there are no indications of how they are being exploited or how widespread the activity is.

In the case of CVE-2025-24990, Microsoft said it plans to remove the driver entirely rather than patch a legacy third-party component. The updates also include a Secure Boot bypass in IGEL OS before 11 (CVE-2025-47827), described as a vulnerability that could enable kernel‑level rootkit deployment with potential access to credentials. All three issues have been added to the US CISA Known Exploited Vulnerabilities catalog, requiring federal agencies to apply patches by 4 November 2025.

The article notes other notable flaws in the update, including high‑scoring CVSS entries such as CVE-2025-49708 and CVE-2025-55315, and quotes experts on the potential impact of these vulnerabilities.