Weekly briefing

Week 43 · 20 Oct – 26 Oct 2025 UTC · assess the changes, then plan the next dates.

What to assess first

20 Oct – 26 Oct · dates to 25 Nov Check coverage

Act on2

20Oct
Exploited20 Oct 2025
Apple Multiple Products Unspecified Vulnerability
CVE-2022-48503
20Oct
Exploited20 Oct 2025
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
CVE-2025-61884
Related evidence (2)
- Oracle Security Alert for CVE-2025-61884 - 11 October 2025
  Public source · Shared CVE CVE-2025-61884
- Oracle Security Alert CVE-2025-61884
  Public source · Shared CVE CVE-2025-61884

Coming up8

27Oct
CISA KEV deadlineDue 27 Oct 2025
Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
CVE-2010-3962
Same day: CISA KEV deadline: Microsoft Windows Remote Code Execution Vulnerability; CISA KEV deadline: Microsoft Windows Out-of-Bounds Write Vulnerability; CISA KEV deadline: Microsoft Windows Privilege Escalation Vulnerability
30Oct
Message Center action dateDue 30 Oct 2025
MC1137611: Deception feature in Microsoft Defender for Endpoint will be retired from public previewMicrosoft 365 Message Center Archive by Merill Fernando
Same day: Message Center action date: MC1154787: Microsoft Purview: Paid public preview of Inline Protection of Sensitive Text transmitted in Edge for Business
31Oct
Message Center action dateDue 31 Oct 2025
MC1163767: Microsoft Power Platform: AI Builder capacity packs end of sale and transition to Copilot Studio creditsMicrosoft 365 Message Center Archive by Merill Fernando
Same day: Message Center action date: MC994282: Legacy Microsoft Outlook for Mac: Support will end
1Nov
Message Center action dateDue 1 Nov 2025
MC1163757: Microsoft Exchange Online: New limit for dynamic distribution groups (DDGs)Microsoft 365 Message Center Archive by Merill Fernando
4Nov
CISA KEV deadlineDue 4 Nov 2025
Microsoft Windows Untrusted Pointer Dereference Vulnerability
CVE-2025-24990
Same day: CISA KEV deadline: Microsoft Windows Improper Access Control Vulnerability
10Nov
CISA KEV deadlineDue 10 Nov 2025
Microsoft Windows SMB Client Improper Access Control Vulnerability
CVE-2025-33073
11Nov
Patch TuesdayScheduled for 11 Nov 2025
Patch Tuesday, 11 November 2025
The second Tuesday of the month, when Microsoft releases security updates for Windows, Office, and servers.
11Nov
Message Center action dateDue 11 Nov 2025
MC1183612: Action Required to Enable Extended Security Update for local devices accessing Windows 365Microsoft 365 Message Center Archive by Merill Fernando

Changed2

24Oct
Security24 Oct 2025
Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
CVE-2025-59287
Related evidence (1)
- WAF - WAF Release - 2025-10-24 - Emergency
  Public source · Shared CVE CVE-2025-59287
24Oct
Security24 Oct 2025
WAF - WAF Release - 2025-10-24 - Emergency
Cloudflare WAF changelog
Related evidence (1)
- Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability
  Public source · Shared CVE CVE-2025-59287

How this list is chosen

Changes from 20 Oct 2025 – 26 Oct 2025 UTC and dates due up to 25 Nov 2025. Dates are the source's own, or labelled as the day ChangeIntel observed a change; never inferred effective dates.

Ranked by kind: exploited vulnerabilities, then up to 7 dates, open known issues, and other notable changes, with at most one entry per feed. Service incidents are on the status board; security baseline downloads, first captures of a document, and metadata-only documentation checks are left out. This is a view of retained evidence, not a reconstruction of everything known at the time.

The briefing is selective. Browse every dated change, review upcoming dates or check the period's coverage.