October Patch Tuesday: Microsoft Fixes 6 Zero-Days, Including 4 Actively Exploited Flaws, as Windows 10 Reaches End-of-Life

October Patch Tuesday delivered one of the year’s largest updates, with 193 vulnerabilities patched across Windows components, including six zero-days, four of which are being actively exploited in the wild. According to Microsoft’s security bulletin, the release also marks the final cumulative update for Windows 10 (KB5066791) as the OS reaches the end of its support lifecycle.

The patch covers components from NTFS and Cloud Files Mini Filter Driver to Remote Desktop Protocol, NTLM and Local Session Manager, and it also includes 14 fixes for Microsoft Edge (Chromium-based). Six zero-days were addressed, including CVE-2025-24990 and CVE-2025-59230 among others, with advisories noting privilege-escalation flaws and an RCE/other class of vulnerabilities; CVE-2025-2884 relates to an out-of-bounds read in TPM 2.0 reference implementation.

CISA has added several of these CVEs to its Known Exploited Vulnerabilities Catalog, and administrators are urged to apply patches promptly as Windows 10 moves off support.