Microsoft Patch Tuesday March 2025

The release consists of:

• 6 Critical and 47 Important fixes.
• Coverage across Windows, Windows Components, MMC, Microsoft Office, Remote Desktop Services, Hyper-V & Visual Studio.
• A combined CVSS score of 386.3, with an average severity of 7.3 – slightly lower than last month’s.

Robert Brown, Senior Director of Professional Services at Absolute, emphasizes the importance of prioritization in vulnerability management.

Patch Tuesday Recap: Top 5 Vulnerabilities You Need to Know

As always, Patch Tuesday brings critical updates and security fixes to keep your systems protected. Here’s a breakdown of the most significant issues and why you should prioritise addressing them immediately.

1. CVE-2025-24985 – Windows Fast FAT File System Driver Remote Code ExecutionWeaponized, actively exploitedAttackers can execute arbitrary code on a targeted system by exploiting a flaw in the Windows Fast FAT File System Driver, potentially leading to full system compromise.
   • Severity: Important | CVSS Score: 7.8
   • Attack Vector: Local | Privileges Required: None
   • User Interaction: Required | Complexity: Low
   This vulnerability allows attackers to run malicious code on a system, potentially installing malware or gaining deeper system access. Since user interaction is required, phishing campaigns may be the primary attack vector. Microsoft has confirmed this vulnerability affects multiple versions of Windows, including Windows 10 and 11. No known workarounds are available, and immediate patching is recommended​.
2. CVE-2025-24993 – Windows NTFS Remote Code ExecutionWeaponized, actively exploitedA critical flaw in NTFS allows attackers to craft malicious files that, when opened, trigger remote code execution.
   • Severity: Important | CVSS Score: 7.8
   • Attack Vector: Local | Privileges Required: None
   • User Interaction: Required | Complexity: Low
   This vulnerability can be exploited via social engineering, tricking users into opening files that lead to full system compromise. It poses a significant risk in environments where file-sharing is common. Attackers can craft NTFS metadata to execute malicious code with system-level privileges. The exploit is actively being used in the wild, emphasizing the need for urgent patching​.
3. CVE-2025-24983 – Windows Win32 Kernel Subsystem Elevation of PrivilegeWeaponized, actively exploitedAttackers can escalate privileges from a standard user to an administrator, potentially taking full control of an affected system.
   • Severity: Important | CVSS Score: 7.0
   • Attack Vector: Local | Privileges Required: Low
   • User Interaction: None | Complexity: High
   Privilege escalation vulnerabilities are often used in tandem with other exploits to gain deeper access within a compromised system. Attackers leveraging this flaw can disable security tools and maintain persistence. The flaw stems from improper permission handling in the Win32 Kernel Subsystem, allowing low-privileged users to manipulate system resources. There are no mitigations, and patching is the only effective remediation​.
4. CVE-2025-26633 – Microsoft Management Console Security Feature BypassWeaponized, actively exploitedA security bypass in Microsoft Management Console (MMC) allows attackers to evade security policies, leading to unauthorized system modifications.
   • Severity: Important | CVSS Score: 7.0
   • Attack Vector: Local | Privileges Required: None
   • User Interaction: Required | Complexity: High
   While this vulnerability does not provide direct control, it can be exploited to weaken system security, making future attacks more effective. Admins should patch systems to prevent abuse. Exploiting this vulnerability requires user interaction with maliciously crafted MMC files. Microsoft has advised against opening MMC files from untrusted sources​.
5. CVE-2025-24991 – Windows NTFS Information DisclosureWeaponized, actively exploitedA flaw in NTFS allows attackers to access restricted data without proper authorization.
   • Severity: Important | CVSS Score: 5.5
   • Attack Vector: Local | Privileges Required: None
   • User Interaction: Required | Complexity: Low

Although this vulnerability does not directly lead to system compromise, attackers can use the exposed information for reconnaissance, aiding future privilege escalation or credential theft attacks. This flaw could allow attackers to extract sensitive system data that could assist in other exploits. Microsoft has not provided any workarounds, making patching critical​.

Final Thoughts: Act Now to Stay Secure

March’s Patch Tuesday highlights the ongoing risks of unpatched vulnerabilities, especially as attackers leverage AI and automation to identify new exploits faster than ever before.

1. Prioritize patches for actively exploited and publicly disclosed vulnerabilities.
2. Ensure your security team is equipped to respond quickly.
3. Consider leveraging automation and vulnerability management solutions to stay ahead of threats.

Need help implementing these patches or optimizing your cybersecurity strategy? Our team is here to assist, reach out today.

Until next time, Happy Patching!

See the March, 2025 Patch Tuesday Chart.