# KB5053887: March 2025 security update

KB5053887, released March 11, 2025, fixes 26 CVEs across 2 products. 7 of them are being exploited (CVE-2025-24054); 7 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/microsoft/kb5053887
- Platform: Microsoft
- Released: Mar 11, 2025
- Priority: Patch now (Closes CVE-2025-24054, exploited (CISA KEV))
- CVEs: 26, exploited: 7, on CISA KEV: 7
- Vendor advisory: https://support.microsoft.com/help/5053887

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Windows Server 2012 R2](https://patchblox.com/security/data/product/microsoft/windows-server-2012-r2.md) |  |  |
| [Windows Server 2012 R2 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2012-r2-server-core-installation.md) |  |  |

## CVEs this fix closes

| CVE | Priority | Component | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-24054](https://patchblox.com/security/data/cve/CVE-2025-24054.md) | Patch now | Windows NTLM | 6.5 | 0.6227 | CISA KEV |
| [CVE-2025-26633](https://patchblox.com/security/data/cve/CVE-2025-26633.md) | Patch now | Microsoft Management Console | 7.0 | 0.3039 | CISA KEV, Ransomware |
| [CVE-2025-24985](https://patchblox.com/security/data/cve/CVE-2025-24985.md) | Patch now | Windows Fast FAT Driver | 7.8 | 0.0389 | CISA KEV |
| [CVE-2025-24993](https://patchblox.com/security/data/cve/CVE-2025-24993.md) | Patch now | Windows NTFS | 7.8 | 0.0222 | CISA KEV |
| [CVE-2025-24991](https://patchblox.com/security/data/cve/CVE-2025-24991.md) | Patch now | Windows NTFS | 5.5 | 0.0202 | CISA KEV |
| [CVE-2025-24984](https://patchblox.com/security/data/cve/CVE-2025-24984.md) | Patch now | Windows NTFS | 4.6 | 0.0199 | CISA KEV |
| [CVE-2025-24983](https://patchblox.com/security/data/cve/CVE-2025-24983.md) | Patch now | Windows Win32 Kernel Subsystem | 7.0 | 0.0187 | CISA KEV |
| [CVE-2025-26645](https://patchblox.com/security/data/cve/CVE-2025-26645.md) | Urgent | Remote Desktop Client | 8.8 | 0.0318 |  |
| [CVE-2025-21247](https://patchblox.com/security/data/cve/CVE-2025-21247.md) | Urgent | Windows MapUrlToZone | 4.3 | 0.0305 | More likely |
| [CVE-2025-24035](https://patchblox.com/security/data/cve/CVE-2025-24035.md) | Urgent | Windows Remote Desktop Services | 8.1 | 0.0172 | More likely |
| [CVE-2025-24045](https://patchblox.com/security/data/cve/CVE-2025-24045.md) | Urgent | Windows Remote Desktop Services | 8.1 | 0.0133 | More likely |
| [CVE-2025-24064](https://patchblox.com/security/data/cve/CVE-2025-24064.md) | Urgent | Role: DNS Server | 8.1 | 0.0129 |  |
| [CVE-2025-24992](https://patchblox.com/security/data/cve/CVE-2025-24992.md) | Urgent | Windows NTFS | 5.5 | 0.0107 | More likely |
| [CVE-2025-21180](https://patchblox.com/security/data/cve/CVE-2025-21180.md) | Urgent | Windows exFAT File System | 7.8 | 0.0095 | More likely |
| [CVE-2025-24044](https://patchblox.com/security/data/cve/CVE-2025-24044.md) | Urgent | Windows Win32 Kernel Subsystem | 7.8 | 0.0060 | More likely |
| [CVE-2024-9157](https://patchblox.com/security/data/cve/CVE-2024-9157.md) | Urgent | Microsoft Windows | n/a | 0.0035 | More likely |
| [CVE-2025-24056](https://patchblox.com/security/data/cve/CVE-2025-24056.md) | High | Windows Telephony Server | 8.8 | 0.0158 |  |
| [CVE-2025-24051](https://patchblox.com/security/data/cve/CVE-2025-24051.md) | High | Windows Routing and Remote Access Service (RRAS) | 8.8 | 0.0149 |  |
| [CVE-2024-30098](https://patchblox.com/security/data/cve/CVE-2024-30098.md) | High | Windows Cryptographic Services | 7.5 | 0.0125 |  |
| [CVE-2025-24059](https://patchblox.com/security/data/cve/CVE-2025-24059.md) | High | Windows Common Log File System Driver | 7.8 | 0.0054 |  |
| [CVE-2025-24072](https://patchblox.com/security/data/cve/CVE-2025-24072.md) | High | Microsoft Local Security Authority Server (lsasrv) | 7.8 | 0.0054 |  |
| [CVE-2025-24071](https://patchblox.com/security/data/cve/CVE-2025-24071.md) | Routine | Windows File Explorer | 6.5 | 0.2333 |  |
| [CVE-2025-24996](https://patchblox.com/security/data/cve/CVE-2025-24996.md) | Routine | Windows NTLM | 6.5 | 0.0134 |  |
| [CVE-2025-24055](https://patchblox.com/security/data/cve/CVE-2025-24055.md) | Routine | Windows USB Video Driver | 4.3 | 0.0086 |  |
| [CVE-2025-24987](https://patchblox.com/security/data/cve/CVE-2025-24987.md) | Routine | Windows USB Video Driver | 6.6 | 0.0068 |  |
| [CVE-2025-24988](https://patchblox.com/security/data/cve/CVE-2025-24988.md) | Routine | Windows USB Video Driver | 6.6 | 0.0068 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo