Redazione RHC : 14 October 2025 21:13
In its latest update, the tech giant fixed 175 vulnerabilities affecting its core products and underlying systems, including two actively exploited zero-day vulnerabilities , the company said in its latest security update . This is the largest set of bugs disclosed by the tech giant this year.
The zero-day vulnerabilities, CVE-2025-24990 affecting the Agere Windows Modem Driver and CVE-2025-59230 affecting the Windows Remote Access Connection Manager , both have a CVSS score of 7.8.
The Cybersecurity and Infrastructure Security Agency (CISA) added both zero-day vulnerabilities to its KEV catalog of known vulnerabilities on Tuesday.
Microsoft said the third-party Agere modem driver , which ships with supported Windows operating systems, has been removed in the October security update. Fax modem hardware that relies on this driver will no longer work on Windows, the company said.
Attackers can gain administrator privileges by exploiting CVE-2025-24990 . ” All supported versions of Windows could be affected by a successful exploitation of this vulnerability, even if the modem is not in use,” Microsoft stated in its summary of the bug.
Microsoft has stated that the improper access control vulnerability affecting Windows Remote Access Connection Manager can be exploited by an authorized attacker to elevate privileges locally and gain system privileges.
Windows Remote Access Connection Manager , a service used to manage remote network connections via virtual private networks and dial-up networks, is a “frequent flyer on Patch Tuesday, appearing more than 20 times since January 2022,” Satnam Narang, Senior Staff Research Engineer at Tenable, said in an email. “This is the first time we’ve seen the bug exploited as a zero-day.”
The most severe vulnerabilities disclosed this month include CVE-2025-55315, which affects ASP.NET Core, and CVE-2025-49708, which affects the Microsoft graphics component. Microsoft has stated that these vulnerabilities are less likely to be exploited, but both have a CVSS score of 9.9.
Microsoft has flagged 14 flaws as most likely to be exploited this month, including a pair of critical vulnerabilities with a CVSS rating of 9.8: CVE-2025-59246 affecting Azure Entra ID and CVE-2025-59287 affecting Windows Server Update Service.
This month, the vendor disclosed five critical vulnerabilities and 121 high-severity vulnerabilities . The full list of vulnerabilities addressed this month is available on Microsoft’s Security Response Center .
Redazione