Last Windows 10 Patch Tuesday Features Six Zero-Days
Microsoft has fixed over 170 CVEs in October’s Patch Tuesday, including six zero-day vulnerabilities.
A UK / EMEA News Reporter from Infosecurity Magazine notes that it’s set to be a busy October for system administrators after Microsoft issued security updates to fix 172 vulnerabilities, including six classed as zero-days.
Three of the zero-day vulnerabilities in this month’s Patch Tuesday list are being actively exploited.
- CVE-2025-59230: a local elevation of privilege (EoP) bug in the Windows Remote Access Connection Manager.
- CVE-2025-24990: another EoP vulnerability, this time in the third-party Agere Modem driver (ltmdm64.sys) which ships with Windows.
With no user interaction required, this will go straight into an attacker’s standard toolkit.
There’s very little information in the advisory itself, but someone out there knows exactly how to exploit this vulnerability.
Rapid7 lead software engineer, Adam Barnett, warned about the severity of these vulnerabilities.
Author’s summary: Microsoft fixes 172 vulnerabilities in October’s Patch Tuesday.