Urgent Windows Update: 2-Week Security Deadline
▼ Summary
– CISA has issued a two-week deadline for federal agencies to patch two critical Microsoft Windows vulnerabilities, CVE-2025-59230 and CVE-2025-24990, and urges all organizations to update promptly.
– CVE-2025-59230 is a zero-day vulnerability in Windows Remote Access Connection Manager that allows local privilege escalation and has already been exploited in attacks.
– CVE-2025-24990 is another zero-day vulnerability in the legacy Agere Modem driver that comes pre-installed on all Windows systems and enables kernel-level privilege attacks.
– The Agere driver vulnerability affects nearly all Windows systems regardless of hardware use, and Microsoft is removing it entirely instead of patching due to its outdated, insecure code.
– Experts warn these vulnerabilities can be used in sophisticated attack chains to escape sandboxes, deploy malware, and compromise security tools, impacting 90-95% of Windows organizations.
Windows users face a critical two-week deadline to install urgent security updates addressing two actively exploited vulnerabilities, with federal agencies and private organizations urged to patch immediately to prevent system compromise.
The monthly ritual known as Patch Tuesday delivered an unprecedented volume of fixes this cycle, with Microsoft resolving a record-breaking 196 security flaws. While the total number is staggering, two specific vulnerabilities have triggered an urgent directive from the U.S. Cybersecurity and Infrastructure Security Agency. CISA has mandated that Federal Civilian Executive Branch agencies apply these patches within a two-week window, a strong signal that all users should treat this update as a top priority.
The first critical flaw, identified as CVE-2025-59230, is a zero-day vulnerability in the Windows Remote Access Connection Manager. Microsoft confirms this issue has already been exploited by attackers. It involves improper access control, allowing an authorized user to elevate their privileges locally on a machine. Security experts note that local privilege escalation is a powerful tool for attackers, often serving as a crucial step in a broader attack campaign, even if it doesn’t provide immediate full system control.
The second, and potentially more concerning, vulnerability is CVE-2025-24990. This is another zero-day threat, but it resides in a legacy component: the Agere Modem driver that ships natively with all supported Windows operating systems. The presence of this decades-old code in modern systems highlights the hidden risks of maintaining backward compatibility. Because this driver is installed by default on every Windows system, the potential attack surface is massive, affecting nearly every user regardless of whether they use or even possess the associated modem hardware.
The nature of this legacy flaw is particularly dangerous. It is an Untrusted Pointer Dereference vulnerability that enables attackers to manipulate memory with kernel-level privileges. This high level of access is the holy grail for cybercriminals. Security researchers emphasize that in sophisticated attacks, this vulnerability could be used to break out of security sandboxes, establish a persistent foothold on a network, deploy other malware with system-wide authority, move laterally across an organization, and even disable security software.
In a decisive move, Microsoft has chosen to remove the vulnerable Agere driver entirely rather than attempt to patch the antiquated code. This action prioritizes security over absolute compatibility. While this eliminates the vulnerability, it does mean that any organization still relying on Agere modem hardware will find that equipment ceases to function after applying the October update. The consensus among cybersecurity professionals is that this is the correct approach, as patching such old code is unreliable and removing it significantly reduces the overall attack surface.
The impact of CVE-2025-24990 is estimated to be incredibly broad, potentially affecting 90 to 95% of organizations using Microsoft Windows. The combination of its default installation and the powerful privileges it grants makes it a severe threat. With both vulnerabilities already being exploited in active attacks, the recommendation from security agencies and experts is unequivocal: apply the latest Windows security updates without delay to protect your systems from compromise.
(Source: Forbes)
