Microsoft's security release of 14 October 2025
Patch Tuesday, October 2025
As of , CISA lists three of the 167 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2025-59287, Windows Server Update Service (WSUS) Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution. Listed by CISA on 24 October 2025, 10 days after the release
- CVE-2025-24990Windows Agere Modem Driver Elevation of Privilege. Listed by CISA on 14 October 2025, release day
- CVE-2025-59230Windows Remote Access Connection Manager Elevation of Privilege. Listed by CISA on 14 October 2025, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 167 CVEs |
| On CISA's list of exploited vulnerabilities | 3 CVEs |
| CISA's SSVC exploitation: active | 3 CVEs |
| CISA's SSVC exploitation: proof of concept | 2 CVEs |
| CISA's SSVC exploitation: none | 162 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 3 CVEs |
| EPSS 0.10 or more | 2 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution | Active | Patch this weekListed | 9.8 Critical | 0.99 |
| 2 | CVE-2025-24990Windows Agere Modem Driver Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.06 |
| 3 | CVE-2025-59230Windows Remote Access Connection Manager Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.03 |
| 4 | CVE-2025-55315ASP.NET Security Feature Bypass | Proof of concept | Not on CISA's list | 9.9 Critical | 0.66 |
| 5 | CVE-2025-55680Windows Cloud Files Mini Filter Driver Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.00 |
| 6 | CVE-2025-55681Desktop Window Manager Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.05 |
| 7 | CVE-2025-59199Software Protection Platform (SPP) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 8 | CVE-2025-55692Windows Error Reporting Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 9 | CVE-2025-55694Windows Error Reporting Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 10 | CVE-2025-59194Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.03 |
| 11 | CVE-2025-55338Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.03 |
| 12 | CVE-2025-59237Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 13 | CVE-2025-59295Windows URL Parsing Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 14 | CVE-2025-24052Windows Agere Modem Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 15 | CVE-2025-58722Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.02 |
| 16 | CVE-2025-48004Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.02 |
| 17 | CVE-2025-55693Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.02 |
| 18 | CVE-2025-59214Microsoft Windows File Explorer Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 19 | CVE-2025-59257Windows Local Session Manager (LSM) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 20 | CVE-2025-59259Windows Local Session Manager (LSM) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 21 | CVE-2025-49708Microsoft Graphics Component Elevation of Privilege | None | Not on CISA's list | 9.9 Critical | 0.01 |
| 22 | CVE-2025-58718Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 23 | CVE-2025-59228Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 24 | CVE-2025-59249Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 25 | CVE-2025-59250JDBC Driver for SQL Server Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 26 | CVE-2025-58724Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 27 | CVE-2025-59227Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2025-59231Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2025-59233Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2025-59234Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2025-59254Microsoft DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2025-59494Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2025-55698DirectX Graphics Kernel Denial of Service | None | Not on CISA's list | 7.7 High | 0.01 |
| 34 | CVE-2025-59200Data Sharing Service Spoofing | None | Not on CISA's list | 7.7 High | 0.01 |
| 35 | CVE-2025-55326Windows Connected Devices Platform Service (Cdpsvc) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 36 | CVE-2025-58726Windows SMB Server Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 37 | CVE-2025-59248Microsoft Exchange Server Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 38 | CVE-2025-59502Remote Procedure Call Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 39 | CVE-2025-55247.NET Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 40 | CVE-2025-59235Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 41 | CVE-2025-47989Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 42 | CVE-2025-59282Internet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution | None | Not on CISA's list | 7.0 High | 0.01 |
| 43 | CVE-2025-59285Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 44 | CVE-2025-55320Configuration Manager Elevation of Privilege | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 45 | CVE-2025-55700Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 46 | CVE-2025-58717Windows Routing and Remote Access Service (RRAS) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 47 | CVE-2025-58729Windows Local Session Manager (LSM) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 48 | CVE-2025-58739Microsoft Windows File Explorer Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 49 | CVE-2025-59185NTLM Hash Disclosure Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 50 | CVE-2025-59244NTLM Hash Disclosure Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 51 | CVE-2025-59258Windows Active Directory Federation Services (ADFS) Information Disclosure | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 52 | CVE-2025-55330Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 53 | CVE-2025-55332Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 54 | CVE-2025-55333Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 55 | CVE-2025-55337Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 56 | CVE-2025-55682Windows BitLocker Security Feature Bypass | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 57 | CVE-2025-47979Microsoft Failover Cluster Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 58 | CVE-2025-55325Windows Storage Management Provider Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 59 | CVE-2025-55336Windows Cloud Files Mini Filter Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 60 | CVE-2025-55676Windows USB Video Class System Driver Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 61 | CVE-2025-55683Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 62 | CVE-2025-55699Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 63 | CVE-2025-59186Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 64 | CVE-2025-59190Windows Search Service Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 65 | CVE-2025-59204Windows Management Services Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 66 | CVE-2025-59211Windows Push Notification Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 67 | CVE-2025-55248.NET, .NET Framework, and Visual Studio Information Disclosure | None | Not on CISA's list | 4.8 Medium | 0.01 |
| 68 | CVE-2025-59284Windows NTLM Spoofing | None | Not on CISA's list | 3.3 Low | 0.01 |
| 69 | CVE-2025-59294Windows Taskbar Live Preview Information Disclosure | None | Not on CISA's list | 2.1 Low | 0.01 |
| 70 | CVE-2025-58715Windows Speech Runtime Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 71 | CVE-2025-58716Windows Speech Runtime Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 72 | CVE-2025-59213Configuration Manager Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 73 | CVE-2025-53782Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 74 | CVE-2025-59236Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 75 | CVE-2025-59291Confidential Azure Container Instances Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 76 | CVE-2025-59292Azure Compute Gallery Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 77 | CVE-2025-50152Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 78 | CVE-2025-50175Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 79 | CVE-2025-53150Windows Digital Media Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 80 | CVE-2025-53768Xbox IStorageService Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 81 | CVE-2025-55328Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 82 | CVE-2025-55339Windows Network Driver Interface Specification (NDIS) Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 83 | CVE-2025-55677Windows Device Association Broker Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 84 | CVE-2025-55696NtQueryInformation Token function (ntifs.h) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 85 | CVE-2025-55697Azure Local Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 86 | CVE-2025-55701Windows Authentication Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 87 | CVE-2025-58714Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 88 | CVE-2025-58720Windows Cryptographic Services Information Disclosure | None | Not on CISA's list | 7.8 High | 0.00 |
| 89 | CVE-2025-58728Windows Bluetooth Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 90 | CVE-2025-59187Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 91 | CVE-2025-59191Windows Connected Devices Platform Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 92 | CVE-2025-59192Storport.sys Driver Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 93 | CVE-2025-59201Network Connection Status Indicator (NCSI) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 94 | CVE-2025-59207Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 95 | CVE-2025-59222Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 96 | CVE-2025-59223Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 97 | CVE-2025-59224Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 98 | CVE-2025-59225Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 99 | CVE-2025-59226Microsoft Office Visio Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 100 | CVE-2025-59238Microsoft PowerPoint Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 14 October 2025, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.