MDM Monthly: August 2025 Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for August 2025, covering Microsoft Intune and Windows, Apple iOS and macOS, Android Enterprise and Omnissa.

August put a second approver in front of the Wipe action in Intune, and it showed how exploited flaws arrive on different platforms in the same month. Apple fixed an exploited ImageIO flaw, Android’s bulletin carried fixes for Qualcomm flaws flagged as possibly exploited, and Windows had a disclosed Kerberos flaw with no exploitation noted. The details follow.

Executive Summary

Intune’s August release put Multi Admin Approval on the Wipe action and on role and permission changes, so one stolen admin credential no longer wipes devices alone.
Apple fixed an exploited ImageIO flaw, CVE-2025-43300, on August 20, and says it may have been used in an extremely sophisticated attack against specific targeted individuals.
Microsoft’s August Patch Tuesday fixed 107 CVEs and one publicly disclosed Kerberos flaw, and Android’s August bulletin carries fixes for two Qualcomm flaws that Qualcomm had earlier flagged as possibly under limited, targeted exploitation.

Executive view: cost and risk

Opex: Second-admin approval adds a few minutes to each wipe and an approver rota. Measuring time-to-patch for exploited flaws costs reporting work once, then runs on its own. Platform SSO on macOS going generally available means a project for Mac fleets still using older sign-in flows.
Capex: Ubuntu 20.04 devices can no longer enroll new in Intune, so Linux fleets on that release are an upgrade item. No other hardware spend is driven by this month.
Enterprise impact: A flaw Apple says may have been exploited against targeted individuals puts executives and other high-risk roles first. A stolen UEM admin credential that can wipe devices without a second approver puts the whole fleet at risk.
Decision needed: Turn on Multi Admin Approval for Wipe and for role changes. Agree a target number of days for exploited-flaw patches and start reporting it.

Download the one-page executive brief (PDF)

Intune: Multi Admin Approval reaches Wipe

The what’s new archive records these changes in the week of August 18, the 2508 service release, and nearby:

Multi Admin Approval: It now covers the Wipe remote action. Changes to roles, permissions, admin groups and member groups also require a second administrator’s approval.
Apple update reporting: New per-device and summary reports cover declarative software updates on iOS and iPadOS 17 and later and macOS 14 and later, including an operational report with failure reasons. The older per-device macOS “Software updates” report is deprecated.
Apple settings catalog: Day-zero additions include new declarative Safari settings.
Windows: Windows Backup for Organizations entered public preview, and Managed Installer policies can target individual user and device groups.
Linux: Support for Ubuntu 20.04 LTS ended. Devices already enrolled stay enrolled, and new enrollments fail. Ubuntu 22.04 and 24.04 are supported.
Platform SSO: In the week of August 11, Platform SSO for macOS became generally available, with Kerberos TGT single sign-on configurable in the settings catalog on Company Portal 5.2508.0 or later.
Microsoft Tunnel: Upgrade to the March 19, 2025 release or later to use the new endpoints. Downgrading isn’t possible afterward, and legacy endpoints may cause service disruptions.

Apple: an exploited ImageIO flaw

On August 20 Apple released iOS and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, Sonoma 14.7.8 and Ventura 13.7.8. The Register reports that they fix CVE-2025-43300, an out-of-bounds write in ImageIO, and that Apple said the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals.” Apple released iOS 18.6.1 and watchOS 11.6.1 on August 14 with no published CVE entries.

Microsoft: a disclosed Kerberos flaw

BleepingComputer counts 107 CVEs in the August 12 Patch Tuesday, with 13 critical. The one zero-day was publicly disclosed and not marked exploited: CVE-2025-53779, a Windows Kerberos elevation of privilege flaw that lets an authenticated attacker gain domain administrator privileges. It requires elevated access to two delegated managed service account attributes, and Akamai’s Yuval Gordon is credited. Domain controllers are the priority. A critical NTLM elevation of privilege flaw, CVE-2025-53778, belongs in the same patch window.

The same report notes an Exchange flaw, CVE-2025-53786, rated Important, that Microsoft warned could be used to hijack cloud environments.

Android Enterprise: Qualcomm fixes arrive

Google’s August bulletin, published August 4 with patch levels 2025-08-01 and 2025-08-05, includes a critical System remote code execution flaw, CVE-2025-48530, on Android 16. It needs other bugs chained to be exploited. It also carries CVE-2025-21479, rated Critical, and CVE-2025-27038, both Qualcomm flaws. Qualcomm had said earlier that Google’s Threat Analysis Group had indications that these and a third flaw, CVE-2025-21480, may be under limited, targeted exploitation, and CISA added two of them to its Known Exploited Vulnerabilities catalog on June 3. The bulletin itself doesn’t note exploitation.

Omnissa: Workspace ONE UEM updates

Tech Orchard reported on August 6 on Omnissa’s recent Workspace ONE UEM updates:

Managed Device Attestation for iOS, iPadOS and macOS uses the Secure Enclave to verify device integrity, so UEM can restrict access or wipe a device that fails.
An enterprise wipe or delete can also release the device from Apple Business Manager.
Freestyle Orchestrator, a low-code workflow builder, is generally available for iOS and Android.
Windows Config Refresh enforces policies every 30 minutes instead of every 8 hours, and Windows Server management is in beta.
Apps and profiles deploy up to 10 times faster, and the admin console is refreshed.

What to watch

September 9: Patch Tuesday.
Early September: The old Graph permissions for script endpoints stop working.
Fall: Apple’s OS 26 releases are expected.
October 14: Windows 10 reaches end of support.

My take

My position: Track how long exploited flaws stay open on your fleet, and put a second approver in front of wipe.

A fleet isn’t patched when the patch ships. It’s patched when the last exposed device is fixed, and the days in between are your exposure. August delivered an iOS and macOS flaw Apple said may have been used against targeted people, and Android fixes for flaws Qualcomm flagged in June. If you can’t say how long those stayed open on your fleet, you can’t tell whether your process works.

The second control is cheaper. Multi Admin Approval on Wipe means one stolen administrator credential can’t erase devices alone. The cost is a few minutes and an approver rota.

I’d report two numbers each month: the median and worst days from an exploited-flaw release to fleet fixed, per platform. Then turn on approval for Wipe and for role changes, and test it once with a real request.

My prediction: by the end of 2027 at least one of the big three UEM vendors, Microsoft, Jamf or Omnissa, will ship a first-party console report of time from exploited-flaw disclosure to fleet patched.

What to do next

Turn on Multi Admin Approval for Wipe and for role and group changes, and run a test request.
Pick a target number of days for exploited-flaw patches and start reporting the actual number.
Check your Linux fleet for Ubuntu 20.04 devices before new enrollments fail.
Upgrade Microsoft Tunnel servers to the March 19, 2025 release or later.
Prioritize domain controller patching for the Kerberos flaw.
Check Android fleets for patch level 2025-08-05.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.