Two New Windows Zero-Days Exploited in the Wild - One Affects Every Version Ever Shipped

"Of the 183 vulnerabilities, eight of them are non-Microsoft issued CVEs. As many as 165 flaws have been rated as Important in severity, followed by 17 as Critical and one as Moderate. The vast majority of them relate to elevation of privilege vulnerabilities (84), with remote code execution (33), information disclosure (28), spoofing (14), denial-of-service (11), and security feature bypass (11) issues accounting for the rest of them."

"The two Windows zero-days that have come under active exploitation are as follows - CVE-2025-24990 (CVSS score: 7.8) - Windows Agere Modem Driver ("ltmdm64.sys") Elevation of Privilege Vulnerability CVE-2025-59230 (CVSS score: 7.8) - Windows Remote Access Connection Manager (RasMan) Elevation of Privilege Vulnerability Microsoft said both issues could allow attackers to execute code with elevated privileges, although there are currently no indications on how they are being exploited and how widespread these efforts may be. In the case of CVE-2025-24990, the company said it's planning to remove the driver entirely, rather than issue a patch for a legacy third-party component."

"Microsoft on Tuesday released fixes for a whopping 183 security flaws spanning its products, including three vulnerabilities that have come under active exploitation in the wild, as the tech giant officially ended support for its Windows 10 operating system unless the PCs are enrolled in the Extended Security Updates ( ESU) program."

Microsoft released fixes for 183 security vulnerabilities across its products and ended Windows 10 support for unmanaged PCs unless enrolled in the Extended Security Updates (ESU) program. Eight of the CVEs are non-Microsoft issued. Severity ratings include 165 Important, 17 Critical, and one Moderate. Vulnerability types include 84 elevation-of-privilege, 33 remote code execution, 28 information disclosure, 14 spoofing, 11 denial-of-service, and 11 security feature bypass issues. Two Windows zero-days (CVE-2025-24990 and CVE-2025-59230, both CVSS 7.8) are under active exploitation. Microsoft plans to remove the Agere modem driver instead of patching it. Chromium-based Edge received 25 additional fixes since September 2025.

Read at The Hacker News