Microsoft and Adobe Patch Tuesday, March 2025 Security Update Review | Qualys

Summary: Microsoft's March 2025 Patch Tuesday addressed 67 vulnerabilities, including six critical and 51 important, and fixed seven zero-day flaws, six of which were actively exploited and one publicly disclosed. Adobe released seven advisories covering 38 vulnerabilities across Acrobat Reader, Illustrator, InDesign and Substance 3D products, 28 of them rated critical. CISA added multiple Windows flaws to its Known Exploited Vulnerabilities Catalog - CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993 and CVE-2025-26633 - and set an April 1, 2025 patch deadline.
What's compelling: Six actively exploited zero-days in a single month, with CISA ordering federal agencies to patch by April 1, 2025, means the exploitation window is already open - and the Win32 Kernel Subsystem flaw (CVE-2025-24983) lets an authorized attacker gain SYSTEM privileges locally.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-24983 CVE-2025-24984 CVE-2025-24985 CVE-2025-24991 CVE-2025-24993
Related: Microsoft Patch Tuesday for March 2025 — Snort rules and prominent vulnerabilities Cyber Risks ·
Microsoft: 6 Zero-Days in March 2025 Patch Tuesday Cyber Risks ·
CVE-2025-24983: Microsoft Windows Win32k Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 11, 2025