# Microsoft Patch Tuesday October 2025 critical RCE fixes

Published: 2026-06-09 · Severity: routine · Sectors: government-national, defense, technology, financial-services, healthcare, energy, manufacturing, telecommunications, education, transportation, retail, infrastructure, non-profit, media
Canonical: https://vorant.io/reports/11a5b281-293a-5a4b-8242-9cb40a89828d/microsoft-patch-tuesday-october-2025-critical-rce-fixes

> Microsoft issued critical patches for dozens of products including Windows, Exchange, and Azure; no active exploitation reported yet.

On October 14, 2025, Microsoft released critical security updates addressing multiple remote code execution vulnerabilities across a wide range of products. The most severe vulnerabilities could allow an attacker to execute arbitrary code with the privileges of the logged-in user. If a user has administrative rights, successful exploitation could lead to complete system compromise, including installation of malware, data theft or destruction, and account creation. The advisory lists over 60 affected components spanning Windows core services (kernel, SMB, RDP, Hyper-V, BitLocker), Azure services (Connected Machine Agent, Entra ID, Monitor Agent), Microsoft Office applications (Word, Excel, PowerPoint, Visio), .NET and ASP.NET Core, Microsoft Exchange Server, Visual Studio, and various drivers (modem, USB video, NDIS). As of the advisory date, there are no confirmed reports of these vulnerabilities being exploited in the wild. Defenders should prioritize patching after appropriate testing, with particular attention to administrative-access systems and internet-facing services. The advisory emphasizes applying Principle of Least Privilege and implementing network segmentation to limit exposure.

## Detection guidance (public sample)

### Office Application Spawning Shell or Script Interpreter

ATT&CK: T1203

Office apps (Word, Excel, PowerPoint, Visio) spawning cmd, PowerShell or script hosts, a common post-exploitation pattern for client-side RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Shell or Script Interpreter
id: fd7129ff-5edd-53ca-9cae-b709d5438d97
status: experimental
description: Detects Office applications spawning command shells or script interpreters.
  This is the typical child-process pattern after exploitation of a client-side code
  execution flaw in Office components (Word, Excel, PowerPoint, Visio). The report
  is a patch advisory with no observed in-the-wild exploitation, so this is a generic
  behavioural hunt for post-exploitation rather than a specific exploit signature.
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-14-2025_2025-096
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \VISIO.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Office macros or add-ins in some organisations that deliberately launch cmd or PowerShell
  for reporting automation
- Legacy line-of-business Excel workbooks that call scripts via shell
level: medium
author: Vorant
```

### IIS Worker Process Spawning Shell or Download Utility

ATT&CK: T1190

w3wp.exe (IIS, ASP.NET Core, Exchange front end) spawning cmd, PowerShell or LOLBins, indicating web-shell or exploitation of an internet-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Shell or Download Utility
id: 40c91878-4916-5f1a-b1f1-18655d3047dc
status: experimental
description: Detects the IIS worker process w3wp.exe spawning command interpreters
  or download utilities. This is a common outcome of exploiting internet-facing ASP.NET
  or Exchange components or of web shell use. The report is a patch advisory without
  observed exploitation, so this is a generic behavioural detection for the affected
  product classes.
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-14-2025_2025-096
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter_appcmd:
    CommandLine|contains: appcmd.exe
  condition: selection and not filter_appcmd
falsepositives:
- Web applications that intentionally shell out to cmd.exe for administrative tasks
- Legacy ASP applications invoking batch files from the worker process
level: high
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-october-14-2025_2025-096

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/11a5b281-293a-5a4b-8242-9cb40a89828d/microsoft-patch-tuesday-october-2025-critical-rce-fixes.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup