Fortra: October 2025 Patch Tuesday: 196 CVEs & Notable Fixes

Name: Fortra: October 2025 Patch Tuesday: 196 CVEs & Notable Fixes
Uploaded: 2026-07-12T06:56:31-04:00
Duration: 2 min 34 s
Description: Microsoft’s October 2025 Security Updates have been addressed on Patch Tuesday. The largest patch bundles were for Microsoft Edge with 14 fixes, whilst there were nine for the Windows Kernel. Tyler Reguly looks at some of the highlights, including some...

Fortra

07/12/2026

0 (0%)

Report Like Favorite

Transcript

and I'm here to talk to you about the October Patch Tuesday. This record-setting Patch Tuesday included 196 CVEs, 175 from Microsoft, and 21 non-Microsoft CVEs. With so many CVEs, it shouldn't be a surprise that we had 5 CVEs with critical CVSS scores. But that's not what I'm going to talk to you about today. There were a few CVEs that I thought were really interesting, so I'm going to call those out instead. First, let's talk about CVE-2025-47827. This is a vulnerability in IGEL OS, which I had never heard of before and had to look up, and it can allow for a secure boot bypass. Now there's a really interesting GitHub repo that's linked in the blog post with a really detailed write-up and disclosure timeline for this vulnerability. I think the important part of this vulnerability is that it's been public since May of this year, because neither IGEL nor Microsoft were willing to do anything with it or patch it at the time. It's actually really refreshing to see that Microsoft has stepped up and is addressing the issue now, but this does have exploitation detected, so you have to wonder if that's what was the driving force behind them issuing the patch. I also want to talk about CVE-2025-2884, a vulnerability in the TPM 2.0 reference implementation. This vulnerability was first disclosed back in June by the Trusted Computing Group, who owns the TPM reference implementation, but there were also advisories from LibTPMS and also Intel. Anyone who used the reference implementation as their guide without addressing the vulnerability first will need to look into it and address it, which is why we see Microsoft issuing a patch now. Finally, I found Microsoft's solution to the two AGIER modem driver vulnerabilities, CVE-2025-59230 and CVE-2025-24990, to be rather interesting. The vulnerability, which allows administrator privilege escalation, was not actually fixed, but rather mitigated, and the way that Microsoft did this was by removing the vulnerable driver from the system. Now, they didn't remove the file completely, instead what they did is they actually overwrote the existing AGIER systems driver with a much smaller generic modem driver written by Microsoft. That's all I had for you this time. Once again, I'm Tyler Reculi, and this has been your Patch Tuesday Recap.

TL;DR

October 2025 Patch Tuesday set a record with 196 CVEs, including 175 from Microsoft and 21 non-Microsoft vulnerabilities, with five reaching critical severity.
CVE-2025-47827, a secure boot bypass in IGEL OS, was publicly disclosed in May but only patched after exploitation was detected, raising questions about vendor response priorities.
Microsoft addressed two AGIER modem driver vulnerabilities not by fixing the code but by replacing the vulnerable driver with a smaller generic modem driver.

Summary

Tyler Reguly, Associate Director of Security R&D at Fortra, provides analysis of Microsoft's October 2025 Patch Tuesday, which set a record with 196 CVEs addressed—175 from Microsoft and 21 non-Microsoft vulnerabilities. Rather than focusing on the five critical-severity issues, Reguly highlights three particularly notable vulnerabilities: a secure boot bypass in IGEL OS that was publicly disclosed in May but only patched after exploitation was detected, a TPM 2.0 reference implementation flaw originally disclosed by the Trusted Computing Group in June, and two AGIER modem driver vulnerabilities that Microsoft mitigated by replacing the vulnerable driver with a generic alternative rather than fixing the underlying code. The analysis emphasizes the importance of understanding vendor response timelines and unconventional mitigation strategies in enterprise patch management.

Chapters

0:00 - Introduction & Overview
0:30 - IGEL OS Secure Boot Bypass
1:15 - TPM 2.0 Reference Implementation Flaw
1:46 - AGIER Modem Driver Mitigation

Key Quotes

0:07 "This record-setting Patch Tuesday included 196 CVEs, 175 from Microsoft, and 21 non-Microsoft CVEs."
0:52 "I think the important part of this vulnerability is that it's been public since May of this year, because neither IGEL nor Microsoft were willing to do anything with it or patch it at the time."
2:11 "They didn't remove the file completely, instead what they did is they actually overwrote the existing AGIER systems driver with a much smaller generic modem driver written by Microsoft."

FAQ

Why did Microsoft wait until October to patch the IGEL OS secure boot bypass if it was disclosed in May?

According to the analysis, neither IGEL nor Microsoft were willing to address the vulnerability when it was first disclosed in May 2025. Microsoft only issued a patch after exploitation was detected, suggesting that active exploitation may have been the driving force behind the delayed response.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Becoming Agent Ready with Cyera: Essential Strategies and Insights

Verge.io: Can You Afford Your Next Storage Refresh?

Summer of Satori: FunFoneFarm's Transformation of Fraud into Seamless Integration

Invisible Data: Understanding What Needs Protection

Embracing AI Adoption While Maintaining Robust Security Measures