On March 14, Microsoft released its Patch Tuesday updates, addressing a total of 58 new vulnerabilities. Notably, six of these vulnerabilities in Windows are already being actively exploited in the wild.
Additionally, there is one publicly known vulnerability affecting Microsoft Office. The next Patch Tuesday is scheduled for April 8, 2025.
A significant portion of the vulnerabilities patched—37, in fact—are associated with various versions of Windows, including Windows Server, Windows 10, and Windows 11. Users are encouraged to upgrade to either Windows 10 (22H2) or Windows 11 (24H2) in order to continue receiving essential security updates.
Microsoft has acknowledged attacks targeting six Windows security vulnerabilities that were addressed in the recent patch. However, these vulnerabilities are not classified as critical, and the extent of these attacks remains unclear, as Microsoft has not disclosed specific details.
Reports indicate that over 600 organizations have been successfully targeted. Attackers are exploiting a flaw in handling MSC files, allowing them to bypass security mechanisms and execute code with user rights.
This includes a Remote Code Execution (RCE) vulnerability affecting the NTFS file system and another in the driver for the FAT file system. When combined with an Elevation of Privilege (EoP) vulnerability, there is a risk of total system compromise.
In contrast, Microsoft has identified five critical RCE vulnerabilities in Windows that have not yet been exploited. An attacker can exploit these by merely connecting to a vulnerable Remote Desktop Services (RDS) gateway.
In addition to Windows, Microsoft has addressed 11 vulnerabilities in its Office products, all of which are RCE vulnerabilities, including three each in Word and Excel. The latest update for Microsoft Edge is version 134.0.3124.51, released on March 6.
This version is based on Chromium 134.0.6998.45, following Google’s update for Chrome which addressed a zero-day vulnerability.