October 2025 Patch Tuesday Security Updates from Microsoft, Adobe, SAP, and Ivanti

Microsoft, Adobe, SAP, and Ivanti released a coordinated set of security updates addressing over 200 vulnerabilities as part of the October 2025 Patch Tuesday. Microsoft led the effort by patching more than 175 vulnerabilities, including three that are actively being exploited in the wild. Among the most severe issues is a critical remote code execution vulnerability in Windows Server Update Services, identified as CVE-2025-59287, which could allow unauthenticated attackers to execute arbitrary code via unsafe object deserialization. Two other exploited vulnerabilities, CVE-2025-24990 and CVE-2025-59230, are elevation-of-privilege flaws affecting Windows components. Additionally, Microsoft addressed a Secure Boot bypass vulnerability in Linux-based IGEL OS (CVE-2025-47827) and disclosed several publicly known issues, such as CVE-2025-0033 in AMD EPYC processors, which remains unpatched, as well as flaws in TPM 2.0 reference code and the Agere Modem driver. Seventeen of Microsoft’s patched vulnerabilities were rated as critical, underscoring the urgency for organizations to apply updates.

Adobe released 12 security bulletins covering 36 unique CVEs across a range of products, including Connect, Commerce, Creative Cloud Desktop, Bridge, Animate, Experience Manager Screens, Substance 3D Viewer, Substance 3D Modeler, FrameMaker, Illustrator, Dimension, and Substance 3D Stager. The most critical Adobe updates addressed five code execution vulnerabilities in Substance 3D Stager and four in Dimension. Illustrator’s patch fixed two code execution bugs, while Commerce’s update resolved five CVEs, including two security feature bypasses. FrameMaker’s update addressed two critical code execution vulnerabilities. Other Adobe products, such as Animate and Substance 3D Viewer, also received patches for critical issues. Notably, none of the Adobe vulnerabilities were publicly known or under active attack at the time of release.

SAP contributed by issuing 17 security notes, with four addressing critical command execution vulnerabilities in NetWeaver. Ivanti released patches for Endpoint Manager Mobile and Neurons for MDM, though none of these vulnerabilities had been exploited prior to the update. Security teams are strongly advised to prioritize the deployment of these patches to mitigate the risk of exploitation, especially for those vulnerabilities already being targeted by threat actors. The breadth of affected products highlights the ongoing need for comprehensive patch management across diverse enterprise environments. The updates reflect a continued trend of attackers focusing on privilege escalation and remote code execution flaws, which can have significant impact if left unaddressed. Organizations should also be aware of the unpatched AMD EPYC processor vulnerability and monitor for future updates. The coordinated release of these patches demonstrates the industry’s commitment to addressing security risks in a timely manner. Regular review of vendor advisories and prompt application of updates remain critical components of an effective cybersecurity strategy. The October 2025 Patch Tuesday serves as a reminder of the evolving threat landscape and the importance of maintaining up-to-date defenses. Security professionals should review the detailed advisories for each product to ensure all relevant patches are applied. The inclusion of both actively exploited and critical vulnerabilities in this cycle underscores the need for vigilance and rapid response. By addressing these vulnerabilities, organizations can significantly reduce their exposure to cyber threats.