CVE tracker

Microsoft Patch Tuesday

What Microsoft fixes on the second Tuesday of every month – straight from the official Security Update Guide: number of vulnerabilities, critical and already exploited ones (zero-days), affected products and the history of the last 24 months.

180vulnerabilities fixed (CVEs)

18of them critical

2exploited (zero-day)

1publicly disclosed

Tue, 10 Nov 2026Next Patch Tuesday
in 10 days and 0 hours

← Back to the month overview

All CVEs – Patch Tuesday October 2025

180 vulnerabilities

CVE-2025-24990ImportantCVSS 7.8Exploited (zero-day)Elevation of privilege

Windows Agere Modem Driver Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-59230ImportantCVSS 7.8Exploited (zero-day)Elevation of privilege

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066586 KB5066782 KB5066791 KB5066793 · MSRC

CVE-2025-59503CriticalCVSS 10.0Elevation of privilege

Azure Compute Resource Provider Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-49708CriticalCVSS 9.9Elevation of privilege

Microsoft Graphics Component Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066586 KB5066782 KB5066791 KB5066793 · MSRC

CVE-2025-59246CriticalCVSS 9.8Elevation of privilege

Azure Entra ID Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-59287CriticalCVSS 9.8Remote code execution

Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5070883 KB5070884 KB5070892 KB5070881 · MSRC

CVE-2025-59218CriticalCVSS 9.6Elevation of privilege

Azure Entra ID Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-55321CriticalCVSS 9.3Spoofing

Azure Monitor Log Analytics Spoofing Vulnerability

Azure · MSRC

CVE-2025-59252CriticalCVSS 9.3Information disclosure

M365 Copilot Information Disclosure Vulnerability

Apps · MSRC

CVE-2025-59272CriticalCVSS 9.3Information disclosure

Microsoft Copilot Information Disclosure Vulnerability

Apps · MSRC

CVE-2025-59286CriticalCVSS 9.3Information disclosure

Microsoft Copilot Information Disclosure Vulnerability

Apps · MSRC

CVE-2025-59247CriticalCVSS 8.8Elevation of privilege

Azure PlayFab Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-59271CriticalCVSS 8.7Elevation of privilege

Redis Enterprise Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-59236CriticalCVSS 8.4Remote code execution

Microsoft Excel Remote Code Execution Vulnerability

Microsoft Office · KB5002797 · MSRC

CVE-2025-59291CriticalCVSS 8.2Elevation of privilege

Confidential Azure Container Instances Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-59292CriticalCVSS 8.2Elevation of privilege

Azure Compute Gallery Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-59227CriticalCVSS 7.8Remote code execution

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office · KB5002792 · MSRC

CVE-2025-59234CriticalCVSS 7.8Remote code execution

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office · KB5002792 · MSRC

CVE-2025-59500CriticalCVSS 7.7Elevation of privilege

Azure Notification Service Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-59273CriticalCVSS 7.3Elevation of privilege

Azure Event Grid System Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-55315ImportantCVSS 9.9Security feature bypass

ASP.NET Security Feature Bypass Vulnerability

Developer tools (.NET, Visual Studio …) · KB5068331 KB5068332 · MSRC

CVE-2025-58715ImportantCVSS 8.8Elevation of privilege

Windows Speech Runtime Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-58716ImportantCVSS 8.8Elevation of privilege

Windows Speech Runtime Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-58718ImportantCVSS 8.8Remote code execution

Remote Desktop Client Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-59213ImportantCVSS 8.8Elevation of privilege

Configuration Manager Elevation of Privilege Vulnerability

System Center and Defender · MSRC

CVE-2025-59228ImportantCVSS 8.8Remote code execution

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft Office · KB5002788 KB5002796 KB5002786 · MSRC

CVE-2025-59237ImportantCVSS 8.8Remote code execution

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft Office · KB5002788 KB5002796 KB5002786 · MSRC

CVE-2025-59249ImportantCVSS 8.8Elevation of privilege

Microsoft Exchange Server Elevation of Privilege Vulnerability

Windows ESU (Extended Security Updates), Server software (Exchange, SharePoint …) · KB5066369 KB5066368 KB5066367 KB5066366 · MSRC

CVE-2025-59295ImportantCVSS 8.8Remote code execution

Windows URL Parsing Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-53782ImportantCVSS 8.4Elevation of privilege

Microsoft Exchange Server Elevation of Privilege Vulnerability

Windows ESU (Extended Security Updates), Server software (Exchange, SharePoint …) · KB5066367 KB5066368 KB5066366 KB5066369 · MSRC

CVE-2025-59250ImportantCVSS 8.1Spoofing

JDBC Driver for SQL Server Spoofing Vulnerability

SQL Server · MSRC

CVE-2025-24052ImportantCVSS 7.8Publicly disclosedElevation of privilege

Windows Agere Modem Driver Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-50152ImportantCVSS 7.8Elevation of privilege

Windows Kernel Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066586 KB5066782 KB5066791 KB5066793 · MSRC

CVE-2025-50175ImportantCVSS 7.8Elevation of privilege

Windows Digital Media Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066586 KB5066782 KB5066791 KB5066793 · MSRC

CVE-2025-53150ImportantCVSS 7.8Elevation of privilege

Windows Digital Media Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066791 KB5066793 · MSRC

CVE-2025-53768ImportantCVSS 7.8Elevation of privilege

Xbox IStorageService Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066586 KB5066791 KB5066793 KB5066835 · MSRC

CVE-2025-55328ImportantCVSS 7.8Elevation of privilege

Windows Hyper-V Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-55339ImportantCVSS 7.8Elevation of privilege

Windows Network Driver Interface Specification (NDIS) Driver Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066782 KB5066793 KB5066780 · MSRC

CVE-2025-55677ImportantCVSS 7.8Elevation of privilege

Windows Device Association Broker Service Elevation of Privilege Vulnerability

Windows · KB5066835 · MSRC

CVE-2025-55680ImportantCVSS 7.8Elevation of privilege

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-55692ImportantCVSS 7.8Elevation of privilege

Windows Error Reporting Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-55694ImportantCVSS 7.8Elevation of privilege

Windows Error Reporting Service Elevation of Privilege Vulnerability

Windows · KB5066835 KB5066780 · MSRC

CVE-2025-55696ImportantCVSS 7.8Elevation of privilege

NtQueryInformation Token function (ntifs.h) Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066586 KB5066782 KB5066791 KB5066793 · MSRC

CVE-2025-55697ImportantCVSS 7.8Elevation of privilege

Azure Local Elevation of Privilege Vulnerability

Windows · KB5066835 KB5066780 · MSRC

CVE-2025-55701ImportantCVSS 7.8Elevation of privilege

Windows Authentication Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-58714ImportantCVSS 7.8Elevation of privilege

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-58720ImportantCVSS 7.8Information disclosure

Windows Cryptographic Services Information Disclosure Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-58722ImportantCVSS 7.8Elevation of privilege

Microsoft DWM Core Library Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066782 KB5066791 · MSRC

CVE-2025-58724ImportantCVSS 7.8Elevation of privilege

Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2025-58728ImportantCVSS 7.8Elevation of privilege

Windows Bluetooth Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5066835 KB5066586 KB5066791 KB5066793 · MSRC

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed