CVE-2025-24054
published 2025-03-11CVE-2025-24054: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
PriorityP182medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2025-05-08
Exploited in the wild
EPSS
58.97%
99.0th percentile
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft | windows_10_1607 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_10_1809 | < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft | windows_10_21h2 | < 10.0.19044.5608 | 10.0.19044.5608 |
| microsoft | windows_10_22h2 | < 10.0.19045.5608 | 10.0.19045.5608 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.20947 | 10.0.10240.20947 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7009 | 10.0.17763.7009 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.5608 | 10.0.19044.5608 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.5608 | 10.0.19045.5608 |
| microsoft | windows_11_22h2 | < 10.0.22621.5039 | 10.0.22621.5039 |
| microsoft | windows_11_23h2 | < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft | windows_11_24h2 | < 10.0.26100.3403 | 10.0.26100.3403 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5039 | 10.0.22621.5039 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5039 | 10.0.22631.5039 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.3476 | 10.0.26100.3476 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.27618 | 6.1.7601.27618 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.25368 | 6.2.9200.25368 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.22470 | 6.3.9600.22470 |
| microsoft | windows_server_2016 | < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.7876 | 10.0.14393.7876 |
| microsoft | windows_server_2019 | < 10.0.17763.7009 | 10.0.17763.7009 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2025-24054 is triggered by .library-ms files embedded in ZIP/RAR archives; Windows Explorer automatically interacts with the file upon extraction, initiating an outbound SMB connection to an attacker-controlled server without requiring the user to open the file. ↗
- →The exploit can also be triggered without an archive: simply downloading a standalone .library-ms file is sufficient to leak NTLMv2 hashes. ↗
- →Minimal user interaction triggers the exploit — selecting (single-clicking), right-clicking, or navigating to the folder containing the malicious file is sufficient; the file does not need to be opened or executed. ↗
- →Monitor for outbound SMB connections (TCP 445) to external/internet-routable IP addresses originating from Windows Explorer or shell processes, especially following file downloads or archive extraction. ↗
- →Malicious .library-ms files embed a UNC path pointing to an attacker-controlled SMB server (e.g., \\ATTACKER_IP\SHARE_NAME); hunt for .library-ms files containing UNC paths to external IPs. ↗
- →Campaigns bundle multiple NTLM hash-leak exploit files (.library-ms, .url, .website, .lnk) in a single archive for redundancy; detection of any one file type in a downloaded archive alongside others should raise suspicion. ↗
- →Phishing lures distributing CVE-2025-24054 exploits used Dropbox download links as the delivery vector; monitor for Dropbox-hosted ZIP archives delivered via email to government and private sector targets. ↗
- →The attacker-controlled server at 185.227.82.72 also hosted the AveMaria/Warzone RAT for distribution; correlate NTLM hash leakage to this IP with subsequent RAT payload delivery. ↗
- →The .url exploit file (CVE-2024-43451) used in the same campaign contains an IconFile UNC path pointing to the attacker's SMB server; detect .url files with IconFile= referencing external UNC paths. ↗
- →The .lnk exploit file targets \\159.196.128.120 as its Target Path; detect .lnk files with Target Path set to a UNC path pointing to an external IP. ↗
- →Exploitation was observed only eight days after the March 2025 Patch Tuesday fix was released; prioritize patching and monitor for NTLMSSP_AUTH messages on SMB traffic to external IPs. ↗
- →Microsoft is blocking .library-ms and .search-ms file types in Outlook Web and New Outlook for Windows starting July 2025; use this as a detection signal — receipt of these file types via email is anomalous and suspicious. ↗
- ·CVE-2025-24054 and CVE-2025-24071 were initially registered as two separate CVEs but were later consolidated under CVE-2025-24054; tooling or signatures referencing CVE-2025-24071 apply to the same vulnerability. ↗
- ·Microsoft initially assessed CVE-2025-24054 as 'less likely' to be exploited and did not mark it as actively exploited at patch release; this assessment was incorrect — active exploitation was observed within days. ↗
- ·One attacker-controlled IP (194.127.179.157) was previously linked to APT28 ('Fancy Bear'), but Check Point notes this alone is insufficient for confident attribution. ↗
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
vulncheck6.5MEDIUM
cisa5.4MEDIUM
vendor_msrc6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
cisa·2025-04-17·CVSS 5.4
CVE-2025-24054 [MEDIUM] CWE-73 Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Vulnerability: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Affected: Microsoft Windows
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24054
Remediation Due Date: 2025-05-08
Microsoft
NTLM Hash Disclosure Spoofing Vulnerability
vendor_msrc·2025-03-11·CVSS 6.5
CVE-2025-24054 [MEDIUM] CWE-73 NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing the file could trigger this vulnerability.
Windows NTLM: Windows NTLM
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5053596
Reference:
GHSA
GHSA-6v67-599p-fprc: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
ghsa_unreviewed·2025-03-11
CVE-2025-24054 [MEDIUM] CWE-73 GHSA-6v67-599p-fprc: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
VulnCheck
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
vulncheck·2025·CVSS 6.5
CVE-2025-24054 [MEDIUM] CWE-73 Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability
Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.cyfirma.com/research/rendershock-weaponizing-trust-in-file-rendering-pipelines/; https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscap
VulnCheck
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
vulncheck·2024·CVSS 6.5
CVE-2024-43451 [MEDIUM] CWE-73 Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
Affected: Microsoft Windows
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2024-Nov; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43451; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.clearskysec.com/0d-vulnerability-exploited-in-the_wild/; https:/
Suricata
ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)
suricata·2025-05-13·CVSS 6.5
CVE-2024-43451 [MEDIUM] ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)
ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)
Rule: alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT NTLM Hash Disclosure via InternetShortcut File Inbound with UNC Path Inbound (CVE-2024-43451)"; flow:established,to_client; file.data; content:"|5b|InternetShortcut"; fast_pattern; pcre:"/^(?:\x2e[AW])\x5d/R"; content:"|3d 5c 5c 5c 5c|"; reference:url,research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/; reference:cve,2024-43451; classtype:attempted-user; sid:2062313; rev:1; metadata:attack_target Client_Endpoint, created_at 2025_05_13, cve CVE_2024_43451, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_05_13
Exploit-DB
Windows 10.0.17763.7009 - spoofing vulnerability
exploitdb·2026-02-11·CVSS 6.5
CVE-2025-24054 [MEDIUM] Windows 10.0.17763.7009 - spoofing vulnerability
Windows 10.0.17763.7009 - spoofing vulnerability
---
# Exploit Title: Windows 10.0.17763.7009 - spoofing vulnerability
# Google Dork: N/A
# Date: 2025-10-06
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://www.microsoft.com
# Software Link: N/A
# Version: Not applicable (this is a generic Windows library file behavior)
# Tested on: Windows 10 (x64) / Windows 11 (x64) (lab environment)
# CVE: CVE-2025-24054
#
# Description:
# A proof-of-concept that generates a .library-ms XML file pointing to a network
# share (UNC). When opened/imported on Windows, the library points to the specified
# UNC path.
#
# Notes:
# - This PoC is provided for responsible disclosure only. Do not test against
# live/production websites or networks without explicit written permission.
# - Attach
Exploit-DB
windows 10/11 - NTLM Hash Disclosure Spoofing
exploitdb·2026-02-04·CVSS 6.5
CVE-2025-24054 [MEDIUM] windows 10/11 - NTLM Hash Disclosure Spoofing
windows 10/11 - NTLM Hash Disclosure Spoofing
---
# Exploit Title: windows 10/11 - NTLM Hash Disclosure Spoofing
# Date: 2025-10-06
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://www.microsoft.com
# Software Link: N/A
# Version: Not applicable (this is a generic Windows library file behavior)
# Tested on: Windows 10 (x64) / Windows 11 (x64) (lab environment)
# CVE: CVE-2025-24054
# Description:
# A proof-of-concept that generates a .library-ms XML file pointing to a network
# share (UNC). When opened/imported on Windows, the library points to the specified
# UNC path.
#
# Notes:
# - This PoC is provided for responsible disclosure only. Do not test against
# live/production websites or networks without explicit written permission.
# - Attach exactly one exploit file
Exploit-DB
Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
exploitdb·2025-08-18·CVSS 6.5
CVE-2025-50154 [MEDIUM] Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
---
# Exploit Title: Microsoft Windows 10.0.19045 - NTLMv2 Hash Disclosure
# Date: 13/08/2025
# Exploit Author: Ruben Enkaoua
# Author link: https://x.com/RubenLabs, https://github.com/rubenformation
# Original Blog: https://cymulate.com/blog/zero-click-one-ntlm-microsoft-security-patch-bypass-cve-2025-50154/
# Vendor Homepage: https://microsoft.com
# Software Link: https://www.microsoft.com/en-us/software-download
# Version: All versions prior to patch tuesday august 2025
# Tested on: Windows 10.0.19045
# CVE : CVE-2025-50154
# This exploit if for CVE-2025-24054 Patch Bypass
# Start a responder with:
# responder -I -v
param(
[Parameter(Mandatory=$true)]
[string]$path, # -path
[Parameter(Mandatory=$true)]
[string]$ip, # -ip
[Param
Exploit-DB
Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
exploitdb·2025-05-01·CVSS 6.5
CVE-2025-24054 [MEDIUM] Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
---
# Exploit title: Microsoft - NTLM Hash Disclosure Spoofing (library-ms)
# Exploit Author: John Page (aka hyp3rlinx)
# x.com/hyp3rlinx
# ISR: ApparitionSec
Back in 2018, I reported a ".library-ms" File NTLM information disclosure vulnerability to MSRC and was told "it was not severe enough", that being said I post it anyways.
Seven years passed, until other researchers re-reported it.
Subsequently this security flaw was finally deemed important by Microsoft and it received CVE-2025-24054, for which I was finally retroactively credited as the original reporter.
Circa 2025 updated:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
[References]
https://web.archive.org/web/20190106181024/https://hyp3rlinx.alterv
Securelist
Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
blogs_securelist·2025-11-26·CVSS 6.5
CVE-2024-43451 [MEDIUM] Old tech, new vulnerabilities: NTLM abuse, ongoing exploitation in 2025
Table of Contents
Just like the 2000s
How NTLM authentication works
NTLM is dead — long live NTLM
Persistent threats in NTLM-based authentication
Hash leakage
Coercion-based attacks
Credential forwarding
Man-in-the-Middle (MitM) attacks
NTLM exploitation in 2025
CVE-2024‑43451
BlindEagle campaign delivering Remcos RAT via CVE-2024-43451
Head Mare campaigns against Russian targets abusing CVE-2024-43451
CVE-2025-24054/CVE-2025-24071
Trojan distribution in Russia via CVE-2025-24054
CVE-2025-33073
Suspicious activity in Uzbekistan involving CVE-2025-33073
Protection and recommendations
Disable/Limit NTLM
Implement message signing
Enable Extended Protection for Authentication (EPA)
Monitor and audit NTLM traffic and authentication logs
Conclusions
Authors
Leandro Cuozzo
Securelist
How NTLM is being abused in 2025 cyberattacks
blogs_securelist·2025-11-26
How NTLM is being abused in 2025 cyberattacks
Table of Contents
- Just like the 2000s
- How NTLM authentication works
- NTLM is dead — long live NTLM
- Persistent threats in NTLM-based authentication
- NTLM exploitation in 2025
- Protection and recommendations
- Conclusions
Authors
- Leandro Cuozzo
## Just like the 2000s
Flip phones grew popular, Windows XP debuted on personal computers, Apple introduced the iPod, peer-to-peer file sharing via torrents was taking off, and MSN Messenger dominated online chat. That was the tech scene in 2001, the same year when Sir Dystic of Cult of the Dead Cow published SMBRelay, a proof-of-concept that brought NTLM relay attacks out of theory and into practice, demonstrating a powerful new class of authentication relay exploits.
Ever since that distant 2001, the weaknesses of the NTLM authenti
Bleepingcomputer
Microsoft Outlook to block more risky attachments used in attacks
blogs_bleepingcomputer·2025-06-10·CVSS 7.8
[HIGH] Microsoft Outlook to block more risky attachments used in attacks
## Microsoft Outlook to block more risky attachments used in attacks
## Sergiu Gatlan
Microsoft announced it will expand the list of blocked attachments in Outlook Web and the new Outlook for Windows starting next month.
The company said on Monday in a Microsoft 365 Message Center update that Outlook will block .library-ms and .search-ms file types beginning in July.
"As part of our ongoing efforts to enhance security in Outlook Web and the New Outlook for Windows, we're updating the default list of blocked file types in OwaMailboxPolicy," Microsoft said . "Starting in early July 2025, the [.library-ms and .search-ms] file types will be added to the BlockedFileTypes list."
Windows Library files (.library-ms), which define virtual collections of folders and files in the Windows file sy
Checkpoint
21st April – Threat Intelligence Report
blogs_checkpoint·2025-04-21
CVE-2025-24054 21st April – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 21st April – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st April, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
Retail giant Ahold Delhaize has suffered a cyber-attack resulting in data theft of customer information from its US business systems. The attack, claimed by ransomware group INC Ransom, impacted Ahold Delhaize USA brands and services including e-commerce operations and pharmacies.
Check Point Threat Emulation provides protec
Bleepingcomputer
Windows NTLM hash leak flaw exploited in phishing attacks on governments
blogs_bleepingcomputer·2025-04-17·CVSS 6.5
CVE-2025-24054 [MEDIUM] Windows NTLM hash leak flaw exploited in phishing attacks on governments
## Windows NTLM hash leak flaw exploited in phishing attacks on governments
## Bill Toulas
A Windows vulnerability that exposes NTLM hashes using .library-ms files is now actively exploited by hackers in phishing campaigns targeting government entities and private companies.
The flaw tracked as CVE-2025-24054 was fixed in Microsoft's March 2025 Patch Tuesday . Initially, it was not marked as actively exploited and was assessed as 'less likely' to be.
However, Check Point researchers report having observed active exploitation activity for CVE-2025-24054 only a few days after patches became available, culminating between March 20 and 25, 2025.
Although one IP address behind these attacks was previously linked to the Russia state-sponsored threat group APT28 ('Fancy Bear'), it is not eno
Checkpoint
CVE-2025-24054, NTLM Exploit in the Wild
blogs_checkpoint·2025-04-16·CVSS 5.4
CVE-2025-24054 [MEDIUM] CVE-2025-24054, NTLM Exploit in the Wild
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## CVE-2025-24054, NTLM Exploit in the Wild
## Key Points
.library-ms
Around March 20–21, 2025 , a campaign targeted government and private institutions in Poland and Romania . Attackers u
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review
blogs_qualys·2025-03-11
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for March 2025
Adobe Patches for March 2025
Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withPatch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
Risk Reduction via TruRisk Eliminate
Qualys Monthly Webinar Series
March 2025 Patch Tuesday is here, and Microsoft has rolled out critical security updates that address multiple vulnerabilities across its product suite. Here’s a quick breakdown of what you need to know.
## Microsoft Patch Tu
Qualys
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys
blogs_qualys·2025-03-11
Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for March 2025
- Adobe Patches for March 2025
- Zero-day Vulnerabilities Patched in March Patch Tuesday Edition
- Critical Severity Vulnerabilities Patched in March Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
- Rapid Response withPatch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- Risk Reduction via TruRisk Eliminate
- Qualys Monthly Webinar Series
March 2025 Patch Tuesday is here, and Microsoft has rolled out critical security updates that address multiple vulnerabilities across its product suite. Here’s a quick breakdown of what you need to know.
## Micr
Bleepingcomputer
Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
blogs_bleepingcomputer·2025-03-11·CVSS 7.0
[HIGH] Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
## Microsoft March 2025 Patch Tuesday fixes 7 zero-days, 57 flaws
## Lawrence Abrams
23 Elevation of Privilege Vulnerabilities
3 Security Feature Bypass Vulnerabilities
23 Remote Code Execution Vulnerabilities
4 Information Disclosure Vulnerabilities
1 Denial of Service Vulnerabilities
3 Spoofing Vulnerabilities
The above numbers do not include Mariner flaws and 10 Microsoft Edge vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5053598 & KB5053602 cumulative updates and the Windows 10 KB5053606 update .
## Six actively exploited zero-days
This month's Patch Tuesday fixes six actively exploited zero-days and one that was publicly exposed, for a total of seven zero-days.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054http://seclists.org/fulldisclosure/2025/Apr/28https://www.exploit-db.com/exploits/52478https://www.exploit-db.com/exploits/52480https://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-detection-scripthttps://www.vicarius.io/vsociety/posts/cve-2025-24054-spoofing-vulnerability-in-windows-ntlm-by-microsoft-mitigation-scripthttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24054
2025-03-11
Published
2025-04-17
Added to CISA KEV
Exploited in the wild