Microsoft's March Patch Tuesday revealed over 50 new vulnerabilities, including seven zero-day vulnerabilities, six of which are currently being exploited. Key vulnerabilities include:
- CVE-2025-26633: Security feature bypass in Microsoft Management Console, CVSS score 7.0.
- CVE-2025-24993: Remote code execution (RCE) vulnerability in Windows NTFS, CVSS score 7.8.
- CVE-2025-24991: Information disclosure vulnerability in Windows NTFS, CVSS score 5.5.
- CVE-2025-24985: RCE vulnerability in Windows Fast FAT File System Driver, CVSS score 7.8.
- CVE-2025-24984: Information disclosure vulnerability in Windows NTFS, CVSS score 4.6.
- CVE-2025-24983: Elevation of privilege (EoP) vulnerability in Windows Win32 Kernel Subsystem, CVSS score 7.0.
- CVE-2025-26630: RCE vulnerability in Microsoft Access, CVSS score 7.8.
This month's patch list includes 23 EoP and 23 RCE vulnerabilities, with all six critical vulnerabilities being RCEs. Notably, CVE-2025-24084 affects the Windows Subsystem for Linux (WSL2) kernel, and CVE-2025-26645 impacts the remote desktop client (RDP), allowing attackers to achieve remote code execution on vulnerable clients.