Microsoft’s October 2025 Patch Tuesday has been significant for cybersecurity, addressing 167 vulnerabilities, the highest count this year. Among these, seven are classified as critical, necessitating immediate action from Chief Information Security Officers (CISOs).
One of the most pressing vulnerabilities is in the Windows Server Update Service (WSUS) identified as CVE-2025-59287. This flaw, which allows for remote code execution, has a CVSSv3 score of 9.8 and could potentially compromise an entire organization’s patch management system. Tenable highlighted that this is the first RCE vulnerability in WSUS since 2023 and underscores its considerable risks. CISO Mike Walters emphasized the urgency for teams to review their patch management architecture and the network exposure of WSUS servers to prevent malicious updates from being deployed across all systems.
Additional critical vulnerabilities include two remote code execution flaws in Microsoft Office, CVE-2025-59227 and CVE-2025-59234, which can be exploited via social engineering tactics without requiring the target to open an infected document.
Highlighting the issues within legacy components, two vulnerabilities in the Agere modem driver, CVE-2025-24990 and CVE-2025-24052, have been flagged as critical, with one being actively exploited as a zero-day. Microsoft has decided to remove this outdated driver from future updates, indicating the security dangers of maintaining legacy systems in contemporary environments.
Other vulnerabilities attracting attention include a zero-day elevation of privilege vulnerability in Windows Remote Access Connection Manager, CVE-2025-59230, and a critical graphic component flaw, CVE-2025-49708, which could allow attackers to break out from low-privilege virtual machines to execute code on host servers.
Additionally, today marks the end of security updates for Windows 10, with new updates only being available for users enrolled in the Extended Security Updates (ESU) program.
In the realm of SAP, a critical patch, detailed in Security Note #3660659, was also released, addressing severe vulnerabilities linked to insecure deserialization. This patch aims to enhance protections significantly against potential attacks which could effectively cripple an organization’s operations.
These vulnerabilities underline the critical need for organizations to prioritize updates, particularly those concerning legacy systems and critical infrastructure, to bolster their cybersecurity posture.
Hudson Valley Host is premier provider of cutting-edge hosting solutions, specializing in delivering a seamless online experience for businesses and individuals. We offer a comprehensive range of hosting services, including Shared Hosting, VPS, Dedicated Servers, and Colocation. With 24/7 technical support, robust security measures, and user-friendly control panels, we empower clients in managing their online presence effortlessly. Hudson Valley Host is your trusted partner in achieving online success.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@hudsonvalleyhost.com.
