MDM Monthly: October 2025 Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for October 2025, covering Microsoft Intune and Windows, Apple iOS and macOS, Android Enterprise and Jamf.

October was the end of Windows 10 as a free-update platform, and it came with an exploited flaw in WSUS, the server many organizations use to deliver patches. Intune announced the retirement of legacy Apple update policies, and Jamf agreed to be acquired. The details follow.

Executive Summary

Windows 10 reached end of support on October 14, and Microsoft’s first-year commercial Extended Security Updates price is 61 dollars per device, or 45 dollars with cloud activation through Intune or Autopatch.
Microsoft’s October Patch Tuesday fixed 172 flaws and six zero-days, and on October 23 it issued an out-of-band update for an exploited WSUS remote code execution flaw, CVE-2025-59287.
Intune is retiring legacy Apple MDM software update policies in favor of declarative device management, and Jamf agreed on October 29 to be acquired by Francisco Partners for about 2.2 billion dollars.

Executive view: cost and risk

Opex: Extended Security Updates add a per-device charge and a tracking job, and the WSUS fix means patching and rebooting every WSUS server this week. Moving Apple update policies to declarative management is the engineering item, and it has no end date from Microsoft.
Capex: Windows 10 devices that can’t run Windows 11 either go on the paid bridge or get replaced, so build the refresh list by model and decide per group. Jamf customers should check renewal terms before the next contract date.
Enterprise impact: An unauthenticated remote code execution flaw in WSUS, exploited and listed by CISA, puts a server that sits at the center of Windows patching at risk. Devices left on Windows 10 without Extended Security Updates stop receiving security fixes.
Decision needed: Decide per device group whether Windows 10 devices buy Extended Security Updates or are replaced, and confirm every WSUS server is patched.

Download the one-page executive brief (PDF)

Windows 10 reaches end of support

Windows 10 reached end of support on October 14, the same day as the October Patch Tuesday. BleepingComputer reports that it was the last free security update, that consumers can buy one year of Extended Security Updates and that enterprises can buy up to three years. Microsoft’s announced first-year commercial price is 61 dollars per device, or 45 dollars with a cloud activation license for organizations using Intune or Windows Autopatch. Intune keeps Windows 10 as an allowed version, but says functionality isn’t guaranteed.

Microsoft: six zero-days and an exploited WSUS flaw

BleepingComputer counts 172 flaws and six zero-days in the October 14 Patch Tuesday. Three were exploited:

CVE-2025-24990: An elevation of privilege flaw in the Agere modem driver. Microsoft removed the ltmdm64.sys driver, which disables the related fax modem hardware, so test before deploying.
CVE-2025-59230: An elevation of privilege flaw in Windows Remote Access Connection Manager that gives SYSTEM privileges.
CVE-2025-47827: A Secure Boot bypass in IGEL OS.

Three were publicly disclosed: CVE-2025-0033, an AMD SEV-SNP flaw rated Critical, CVE-2025-24052 in the same Agere driver, and CVE-2025-2884, an out-of-bounds read in the TCG TPM 2.0 reference implementation.

The same update fixed CVE-2025-59287, a critical remote code execution flaw in Windows Server Update Service. It didn’t hold. On October 23 Microsoft released an out-of-band update, and CISA’s alert says the earlier update did not fully mitigate the flaw, and that CISA added it to the Known Exploited Vulnerabilities catalog on October 24. It affects Windows Server 2012 through 2025. CISA’s priority is servers with the WSUS Server Role enabled and ports 8530 and 8531 open. If you can’t patch immediately, disable the WSUS role or block inbound traffic to those ports, and don’t reverse the workaround until the update is installed.

Intune: legacy Apple update policies are being retired

The 2510 release rolled out the week of October 20. The notable items from the what’s new archive:

Apple updates: Legacy MDM software update policies, restrictions and reports are being retired in favor of declarative device management, following Apple’s OS 26 deprecations. No date is given.
Remote Help on macOS: Client 1.0.2510071 adds macOS 26 support, and earlier clients aren’t compatible. Updates arrive through Microsoft AutoUpdate.
Endpoint Privilege Management: A new “Elevate as current user” option, and new user-readiness insights on the dashboard.
Windows: Windows 11 25H2 settings are available in the settings catalog.
Reporting: The enrollment time grouping failures report is generally available for Android and Windows.

Jamf: Pro 11.22 and a sale

On October 29 Jamf announced a definitive agreement to be acquired by Francisco Partners for 13.05 dollars per share in cash, a transaction value of about 2.2 billion dollars. Closing is expected in the first quarter of 2026, subject to stockholder and regulatory approval, and Vista Equity Partners, which holds about 34 percent of the shares, has agreed to vote in favor.

On the product side, Pro 11.21.1 arrived October 9. Pro 11.22.0 arrived October 28 with MDM server migration with app preservation for iOS and iPadOS, and Jamf Conditional Access.app can now report Microsoft Entra ID Platform SSO registration status.

Android and Apple: quiet months

Google published its October bulletin on October 6, and patch level 2025-10-05 or later addresses all of its issues. Apple published no security releases in October, according to its security releases page, and the next was iOS 26.1 on November 3.

What to watch

November 11: Patch Tuesday, and the first Extended Security Updates for Windows 10.
January 13, 2026: The Enrollment Status Page quality update setting becomes available.
First quarter of 2026: Jamf’s sale is expected to close.
June 2026: The first 2011 Secure Boot certificates begin to expire.
No date given: Intune ends legacy Apple software update policies.

My take

My position: Windows 10 Extended Security Updates are a bridge you pay for per device, so decide which devices cross it and which are retired.

Windows 10 end of support is a decision per device, not per company. A device that can run Windows 11 should move. A device that can’t has two honest options: pay for the bridge, or retire it. The mistake is leaving the choice open, because an open choice defaults to no updates.

The WSUS flaw is the other lesson. A server that distributes patches to every Windows device is itself a target, and Microsoft needed a second update to close it. Patch it first and reboot it, and ask whether you still need it.

I’d build a three-column list this month: devices moving to Windows 11, devices on paid Extended Security Updates, and devices to retire, each with a date. Then check whether WSUS can be replaced by Autopatch or another cloud path for the devices you manage.

My prediction: by the end of 2027 Microsoft will announce an end-of-support date for WSUS.

What to do next

Patch and reboot every WSUS server with the October 23 update, or disable the role until you can.
Build the Windows 10 list: move to Windows 11, buy Extended Security Updates, or retire, with dates.
Test the removal of the ltmdm64.sys driver on any hardware that uses a fax modem.
Update Remote Help clients on Macs before macOS 26 arrives on your fleet.
List Apple update policies that use legacy MDM commands and plan the move to declarative updates.
If you use Jamf, check renewal terms and ask your account team about the sale.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.