Weekly Update: Microsoft Resolves 57 Security Vulnerabilities – Including Active Zero-Hour Threats
In its latest update for March 2025, Microsoft has fixed 57 vulnerabilities, which increases to nearly 70 when considering third-party susceptibilities. This release targets critical security flaws that demand immediate attention. Notably, it addresses six zero-hour threats actively exploited by cybercriminals.
- CVE-2025-26633: An exploit in Microsoft Management Console that enables hackers to circumvent standard safeguards. These attackers typically deceive recipients into opening specifically crafted files or websites via email or messaging services. Rated as Important, with a threat score of 7.8 out of 10. Microsoft clarifies, “In scenarios involving email or instant messaging attacks, the assailant could send a tailored file aimed at exploiting the vulnerability to the targeted user.” The statement continues, “In any case, the attacker lacks means to enforce user viewing of controlled content; instead, the user must be persuaded to take action. For instance, the attacker might entice the user to click a link directing them to the attacker’s site or dispatch a malicious attachment.”
- CVE-2025-24993: A memory glitch in Windows that grants hackers the liberty to execute any code on the system. Despite Microsoft labeling this as “remote,” someone or something must physically interact with your computer to exploit it. Threat score: 7.8. Microsoft explains, “An attacker can manipulate a local user on a vulnerable system into mounting a crafted VHD that triggers the vulnerability.”
- CVE-2025-24991: A Windows loophole enabling hackers to access snippets of your computer’s memory. To accomplish this, they must trick you into opening a specific disk image file. Moderately hazardous at 5.5.
- CVE-2025-24985: A computational error within Windows’ file system that empowers attackers to execute malicious code on your system. The malicious actors would require you to initiate a harmful disk image file first. Threat score: 7.8.
- CVE-2025-24984: A Windows vulnerability inadvertently disclosing sensitive data in log files. To exploit this, hackers would require physical access to your computer to introduce a malevolent USB drive. Lower threat level at 4.6.
- CVE-2025-24983: A Windows vulnerability permitting individuals with computer access to attain full system control by leveraging a timing flaw. Threat score: 7.0.
Additionally, there is a seventh vulnerability – a remote code execution flaw found in Windows Access – which has been disclosed publically but hasn’t been actively exploited yet.
True to its custom, Microsoft adhered to tradition and refrained from sharing any digital traceability that could aid security teams in identifying potential attacks.
Updated Security Risks, notably in Remote Desktop Client
Microsoft has also spotlighted various severe bugs that could enable hackers to initiate malicious code over networks. The most concerning aspect is that they can execute these actions without requiring user involvement.
One standout is CVE-2025-26645, a path traversal susceptibility in Remote Desktop Client. This poses a major threat because upon connection to a compromised Remote Desktop Server using a vulnerable client, the attacker could directly execute code on your system. Catastrophic.
Windows system administrators are strongly urged by Microsoft to prioritize the patching of significant remote code execution weaknesses affecting Windows Subsystem for Linux, Windows DNS Server, Remote Desktop Service, and Microsoft Office.
Access our adaptable patch management policy, authored by Scott Matteson for TechRepublic Premium, which delivers guidelines for effective patch implementation within an organization.
This article was crafted by TechnologyAdvice contributing author Allison Francis.
About Author
