Microsoft · ServicingStack update · March 11, 2025
KB5053636: March 2025 cumulative update for Windows 11 24H2
KB5053636, released March 11, 2025, fixes 36 CVEs across 4 products. 6 of them are being exploited (CVE-2025-24054); 6 on CISA KEV. Patch Radar priority: Patch now.
Patch now6 on CISA KEVKnown ransomware use
CVEs closed
36
5 rated Critical
Exploited
6
CVE-2025-24054
Exploitation more likely
11
Vendor assessment
Highest EPSS
0.6227
99th percentile
Priority of the 36 CVEs
Patch now 6
Urgent 14
High 10
Routine 6
Applies to
| Product | Build after install |
|---|---|
| Windows 11 Version 24H2 for ARM64-based Systems | 26100.3403 |
| Windows 11 Version 24H2 for x64-based Systems | 26100.3403 |
| Windows Server 2025 | 26100.3403 |
| Windows Server 2025 (Server Core installation) | 26100.3403 |
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Patch now | CVE-2025-24054 | Windows NTLM | Spoofing | 6.5 | 0.6227 | KEVExploited |
| Patch now | CVE-2025-26633 | Microsoft Management Console | Security Feature Bypass | 7.0 | 0.3039 | KEVRansomwareExploited |
| Patch now | CVE-2025-24985 | Windows Fast FAT Driver | Remote Code Execution | 7.8 | 0.0389 | KEVExploited |
| Patch now | CVE-2025-24993 | Windows NTFS | Remote Code Execution | 7.8 | 0.0222 | KEVExploited |
| Patch now | CVE-2025-24991 | Windows NTFS | Information Disclosure | 5.5 | 0.0202 | KEVExploited |
| Patch now | CVE-2025-24984 | Windows NTFS | Information Disclosure | 4.6 | 0.0199 | KEVExploited |
| Urgent | CVE-2025-26645 | Remote Desktop Client | Remote Code Execution | 8.8 | 0.0318 | Exploitation Less Likely |
| Urgent | CVE-2025-21247 | Windows MapUrlToZone | Security Feature Bypass | 4.3 | 0.0305 | More likely |
| Urgent | CVE-2025-24035 | Windows Remote Desktop Services | Remote Code Execution | 8.1 | 0.0172 | More likely |
| Urgent | CVE-2025-24045 | Windows Remote Desktop Services | Remote Code Execution | 8.1 | 0.0133 | More likely |
| Urgent | CVE-2025-24064 | Role: DNS Server | Remote Code Execution | 8.1 | 0.0129 | Exploitation Less Likely |
| Urgent | CVE-2025-24061 | Windows Mark of the Web (MOTW) | Security Feature Bypass | 7.8 | 0.0121 | More likely |
| Urgent | CVE-2025-24992 | Windows NTFS | Information Disclosure | 5.5 | 0.0107 | More likely |
| Urgent | CVE-2025-21180 | Windows exFAT File System | Remote Code Execution | 7.8 | 0.0095 | More likely |
| Urgent | CVE-2025-24066 | Windows Kernel-Mode Drivers | Elevation of Privilege | 7.8 | 0.0071 | More likely |
| Urgent | CVE-2025-24067 | Microsoft Streaming Service | Elevation of Privilege | 7.8 | 0.0071 | More likely |
| Urgent | CVE-2025-24084 | Windows Subsystem for Linux | Remote Code Execution | 8.4 | 0.0070 | Exploitation Less Likely |
| Urgent | CVE-2025-24044 | Windows Win32 Kernel Subsystem | Elevation of Privilege | 7.8 | 0.0060 | More likely |
| Urgent | CVE-2025-24995 | Kernel Streaming WOW Thunk Service Driver | Elevation of Privilege | 7.8 | 0.0058 | More likely |
| Urgent | CVE-2024-9157 | Microsoft Windows | Elevation of Privilege | n/a | 0.0035 | More likely |
| High | CVE-2025-24076 | Windows Cross Device Service | Elevation of Privilege | 7.3 | 0.0321 | Exploitation Less Likely |
| High | CVE-2025-24056 | Windows Telephony Server | Remote Code Execution | 8.8 | 0.0158 | Exploitation Less Likely |
| High | CVE-2025-24051 | Windows Routing and Remote Access Service (RRAS) | Remote Code Execution | 8.8 | 0.0149 | Exploitation Less Likely |
| High | CVE-2025-24994 | Windows Cross Device Service | Elevation of Privilege | 7.3 | 0.0119 | Exploitation Less Likely |
| High | CVE-2025-25008 | Microsoft Windows | Elevation of Privilege | 7.1 | 0.0061 | Exploitation Less Likely |
Showing 1 to 25 of 36
1Next