Microsoft Patch Tuesday, October 2025: the CVEs

Microsoft Patch Tuesday October 2025: the CVEs Microsoft published on 14 October 2025, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025, Dec 2024, Nov 2024, Oct 2024. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 9.8CVE-2025-59287KEVExploitEPSS >99.9%2025-10-14

   Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

2. 9.9CVE-2025-55315ExploitEPSS 67%2025-10-14

   Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

3. 9.9CVE-2025-49708EPSS 1.3%2025-10-14

   Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.