Microsoft’s March Patch Tuesday has introduced a significant wave of challenges for system administrators, unveiling over 50 new vulnerabilities that require immediate attention. Among these, seven zero-day vulnerabilities stand out, with six of them currently being exploited in the wild.
Notable Vulnerabilities
The vulnerabilities of particular concern include:
- CVE-2025-26633: A security feature bypass in Microsoft Management Console, assigned a CVSS score of 7.0.
- CVE-2025-24993: A remote code execution (RCE) vulnerability in Windows NTFS, with a CVSS score of 7.8.
- CVE-2025-24991: An information disclosure vulnerability in Windows NTFS, rated at a CVSS score of 5.5.
- CVE-2025-24985: An RCE vulnerability in the Windows Fast FAT File System Driver, also scoring 7.8.
- CVE-2025-24984: Another information disclosure bug in Windows NTFS, with a CVSS score of 4.6.
- CVE-2025-24983: An elevation of privilege (EoP) vulnerability in the Windows Win32 Kernel Subsystem, rated at 7.0.
In addition, Microsoft has disclosed a zero-day vulnerability, CVE-2025-26630, which is a remote code execution vulnerability in Microsoft Access. This vulnerability carries a CVSS score of 7.8, categorizing it as “important.” Chris Goettl, VP of security product management at Ivanti, noted that while the disclosure may offer attackers some insights for potential exploitation, the absence of code samples would complicate their efforts. “Risk-based prioritization would indicate a slightly higher risk for a disclosure without functional code, but not enough to bump this CVE up to critical,” he explained.
This month’s patch list includes a total of 23 EoP and 23 RCE vulnerabilities. Notably, all six vulnerabilities rated as “critical” are RCE vulnerabilities, including CVE-2025-24084, which impacts the Windows Subsystem for Linux (WSL2) kernel. Rapid7 lead software engineer Adam Barnett elaborated on the potential risks, stating, “The advisory describes multiple possible attack vectors, but in the worst case, there is no requirement for user interaction, since simply receiving a malicious email would be enough to trigger the vulnerability.” The implications of this “magic email” attack vector are particularly concerning, prompting a call for prompt patching.
Another critical RCE vulnerability addressed this month is CVE-2025-26645, which affects the widely used remote desktop client (RDP). Barnett cautioned that this flaw could enable threat actors to easily navigate laterally through a victim’s network. “How much do you trust the RDP server you’re about to connect to?” he queried. “An attacker in control of a malicious RDP server simply has to wait for a client vulnerable to CVE-2025-26645 to connect in order to achieve remote code execution on the client.”
