Microsoft Drops Terrifyingly Large October Patch Update

Microsoft’s October Patch Tuesday update was record-setting, weighing in with 175 CVEs, including two zero-days that attackers are already exploiting, and more than a dozen others the vendor regards as likely targets. It has pushed the year’s total of unique Microsoft vulnerabilities to 1,021, surpassing the 2024 tally of 1,009 with two months still to go.

According to Satnam Narang, senior staff research engineer at Tenable, the two actively exploited zero-days are CVE-2025-59230 (Windows Remote Access Connection Manager) and CVE-2025-24990 (a third-party driver for the Windows Agere modem), both rated CVSS 7.8, with the latter prompting Microsoft to remove the driver from Windows.

In addition, Microsoft disclosed CVE-2025-24052 (CVSS 7.8) in the same modem service, enabling privilege escalation, and a separate IGEL OS flaw, CVE-2025-47827 (CVSS 4.6), that MITRE assigned, not Microsoft. High-priority fixes include CVE-2025-59287 (CVSS 9.8) in WSUS and CVE-2025-55315 (CVSS 9.9) in the ASP.Net Core framework, though none are exploitable by anonymous attackers in all cases.

The patch also signals the end of life for Windows 10, which still holds about 41% of the desktop Windows share, with organisations urged to transition to Extended Security Updates if they remain on the platform.