Critical Update: Microsoft Addresses 57 Security Vulnerabilities, 6 of Which Are Actively Exploited Zero-Days

On Tuesday, Microsoft rolled out security updates addressing a total of 57 vulnerabilities, including six that have been actively exploited in the wild. These updates are particularly crucial for organizations concerned about potential security breaches, as they rectify flaws that could be leveraged by malicious actors.

Among the 57 identified vulnerabilities, six have been marked as Critical, 50 as Important, and one as Low in severity. The updates target a mix of vulnerabilities, including 23 related to remote code execution and 22 associated with privilege escalation. This highlights the diverse nature of the security risks that organizations face.

This release builds on previous updates in February, which saw Microsoft address 17 vulnerabilities in its Chromium-based Edge browser. Notably, one of these vulnerabilities was a spoofing flaw classified as CVE-2025-26643, with a CVSS score of 5.4. Such ongoing updates are essential in maintaining the security posture of any organization that relies on these software systems.

The six actively exploited vulnerabilities detailed in this release include significant threats, such as CVE-2025-24983, a use-after-free vulnerability in the Windows Win32 Kernel Subsystem that allows attackers to elevate privileges locally, rated at 7.0 on the CVSS scale. This could enable unauthorized users to gain higher access rights than intended.

Furthermore, CVE-2025-24984 is noteworthy; this vulnerability involves information disclosure via the NTFS file system, exposing the system to threats if a physical attacker has access to a device. Other critical vulnerabilities include CVE-2025-24985 and CVE-2025-24993, both of which present integer overflow and buffer overflow risks, respectively, allowing unauthorized remote code execution.

The potential attack vectors linked to these vulnerabilities suggest that adversaries may employ tactics categorized under the MITRE ATT&CK framework, mainly focusing on initial access, privilege escalation, and execution. These tactics underpin the necessity for robust patch management processes and proactive monitoring to mitigate risks effectively.

CVE-2025-26633, which allows attackers to bypass security features in the Microsoft Management Console, raises additional concerns. The exploit pathways related to this vulnerability are particularly severe and have been associated with activity by threat actors identified as EncryptHub. This reflects the evolving landscape of cyber threats and reinforces the urgency for organizations to remain vigilant.

The cybersecurity community, including ESET, has linked CVE-2025-24983 to a backdoor known as PipeMagic, highlighting its exploitation through a trojan disguised as a legitimate application. This emphasizes the diverse nature of attack methods and the importance of user awareness and security protocols in preventing successful breaches.

As federal agencies are mandated to implement these fixes by April 1, 2025, it underscores the essential nature of timely updates in safeguarding sensitive data against ever-evolving threats. The focus on these vulnerabilities, combined with heightened scrutiny from organizations like CISA, further illustrates the critical need for continuous vigilance in cybersecurity practices.