Microsoft · Security update · March 11, 2025
KB5053627: March 2025 security update
KB5053627, released March 11, 2025, fixes 21 CVEs across 2 products. 6 of them are being exploited (CVE-2025-24054); 6 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.
Patch now6 on CISA KEVKnown ransomware useUnsupported product
CVEs closed
21
3 rated Critical
Exploited
6
CVE-2025-24054
Exploitation more likely
5
Vendor assessment
Highest EPSS
0.6227
99th percentile
Priority of the 21 CVEs
Patch now 6
Urgent 7
High 4
Routine 4
Applies to
| Product |
|---|
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 |
| Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) |
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2025-24054 | Windows NTLM | Spoofing | 6.5 | 0.6227 | KEVExploited |
| Patch now | CVE-2025-26633 | Microsoft Management Console | Security Feature Bypass | 7.0 | 0.3039 | KEVRansomwareExploited |
| Patch now | CVE-2025-24985 | Windows Fast FAT Driver | Remote Code Execution | 7.8 | 0.0389 | KEVExploited |
| Patch now | CVE-2025-24993 | Windows NTFS | Remote Code Execution | 7.8 | 0.0222 | KEVExploited |
| Patch now | CVE-2025-24991 | Windows NTFS | Information Disclosure | 5.5 | 0.0202 | KEVExploited |
| Patch now | CVE-2025-24983 | Windows Win32 Kernel Subsystem | Elevation of Privilege | 7.0 | 0.0187 | KEVExploited |
| Urgent | CVE-2025-26645 | Remote Desktop Client | Remote Code Execution | 8.8 | 0.0318 | Exploitation Less Likely |
| Urgent | CVE-2025-21247 | Windows MapUrlToZone | Security Feature Bypass | 4.3 | 0.0305 | More likely |
| Urgent | CVE-2025-24035 | Windows Remote Desktop Services | Remote Code Execution | 8.1 | 0.0172 | More likely |
| Urgent | CVE-2025-24064 | Role: DNS Server | Remote Code Execution | 8.1 | 0.0129 | Exploitation Less Likely |
| Urgent | CVE-2025-24992 | Windows NTFS | Information Disclosure | 5.5 | 0.0107 | More likely |
| Urgent | CVE-2025-21180 | Windows exFAT File System | Remote Code Execution | 7.8 | 0.0095 | More likely |
| Urgent | CVE-2024-9157 | Microsoft Windows | Elevation of Privilege | n/a | 0.0035 | More likely |
| High | CVE-2025-24056 | Windows Telephony Server | Remote Code Execution | 8.8 | 0.0158 | Exploitation Less Likely |
| High | CVE-2025-24051 | Windows Routing and Remote Access Service (RRAS) | Remote Code Execution | 8.8 | 0.0149 | Exploitation Less Likely |
| High | CVE-2025-24059 | Windows Common Log File System Driver | Elevation of Privilege | 7.8 | 0.0054 | Exploitation Less Likely |
| High | CVE-2025-24072 | Microsoft Local Security Authority Server (lsasrv) | Elevation of Privilege | 7.8 | 0.0054 | Exploitation Less Likely |
| Routine | CVE-2025-24996 | Windows NTLM | Spoofing | 6.5 | 0.0134 | Exploitation Less Likely |
| Routine | CVE-2025-24055 | Windows USB Video Driver | Information Disclosure | 4.3 | 0.0086 | Exploitation Less Likely |
| Routine | CVE-2025-24987 | Windows USB Video Driver | Elevation of Privilege | 6.6 | 0.0068 | Exploitation Less Likely |
| Routine | CVE-2025-24988 | Windows USB Video Driver | Elevation of Privilege | 6.6 | 0.0068 | Exploitation Less Likely |
Showing 1 to 21 of 21
1