The Update BureauKB5053598: Cumulative update for Windows 11, version 24H2, March 2025. Actively exploited NTFS and FAT flaws patched
Fixes 33 vulnerabilities, including five that attackers are actively exploiting. It also carries a known Remote Desktop issue that can disconnect some sessions after 65 seconds.
Does it affect you? Applies to: Devices running Windows 11, version 24H2, build 26100.3476. The package is available for x64 and Arm64 devices.
Microsoft publishes separate notes for this KB for Windows Server.
What changes
Known issues
-
Citrix
Devices with Citrix Session Recording Agent version 2411 might fail to complete installation of the January 2025 Windows security update and revert to their previous Windows updates.3
How to apply the workaround WorkaroundInstall Citrix Session Recording Agent version 2503 or newer; Citrix released version 2503 on April 28, 2025.3
-
Microsoft Copilot
On some devices, the Microsoft Copilot app is unintentionally uninstalled and unpinned from the taskbar. The Microsoft 365 Copilot app is not affected.4
How to apply the workaround WorkaroundMicrosoft says the issue is fixed and affected devices are being returned to their original state. You can also reinstall the app from Microsoft Store and pin it to the taskbar.4
-
Roblox
Players on Arm devices are unable to download and play Roblox from the Microsoft Store on Windows.5
How to apply the workaround WorkaroundDownload Roblox directly from Roblox.com until a resolution is available.5
-
Remote Desktop
Remote Desktop Protocol sessions might disconnect unexpectedly after 65 seconds when Windows 11, version 24H2 devices make UDP-based connections to Remote Desktop Services deployments running Windows Server 2016 or earlier. Windows Server 2025 is not affected as an RDS host, but might experience disconnects as an RDP client connecting to older servers.6
How to apply the workaround Group PolicyKB5053656 addresses the issue. Devices updated on or after March 27, 2025 do not need a Known Issue Rollback or special Group Policy. For devices updated before that date that have the issue, an IT administrator can install and configure the special Group Policy, then restart the devices.6
Step-by-step workaround instructionsShow steps Hide steps2 stepsStep-by-step procedure- For an affected device updated before March 27, 2025, install and configure the special Group Policy for its Windows version.
- Restart the device to apply the policy.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-03-11
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5052093, KB5051987, KB5050094, KB5050009
- Replaced by
- KB5055523
| Version | Build | Channel |
|---|---|---|
| 24H2 | 26100.3476 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2025-24985
Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
|
Important | 7.8 |
|
CVE-2025-24993
Exploited
Windows NTFS Remote Code Execution Vulnerability
|
Important | 7.8 |
|
CVE-2025-26633
Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
|
Important | 7.0 |
|
CVE-2025-24991
Exploited
Windows NTFS Information Disclosure Vulnerability
|
Important | 5.5 |
|
CVE-2025-24984
Exploited
Windows NTFS Information Disclosure Vulnerability
|
Important | 4.6 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Windows Remote Desktop Services Remote Code Execution Vulnerability
|
Critical | 8.1 |
The table lists the 8 exploited, publicly disclosed or critical vulnerabilities. See all 33 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
1,341 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| .NET networking | 38 |
| Graphics and display | 22 |
| Hyper-V and virtualization | 12 |
| WCF | 12 |
| Kernel | 9 |
| File Explorer and shell | 8 |
| Security and sign-in | 8 |
| Storage and file systems | 7 |
| .NET data access | 6 |
| .NET runtime (CLR) | 6 |
| Secure Boot | 6 |
| ASP.NET | 4 |
Sources
Cited passages from Microsoft's official notes (6)
-
1.
This update makes miscellaneous security improvements to internal OS functionality.
support.microsoft.com -
2.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
3.
The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions.
support.microsoft.com -
4.
We're aware of an issue with the Microsoft Copilot app affecting some devices. The app is unintentionally uninstalled and unpinned from the taskbar.
support.microsoft.com -
5.
We’re aware of an issue where players on Arm devices are unable to download and play Roblox from the Microsoft Store on Windows.
support.microsoft.com -
6.
Users might notice their RDP sessions unexpectedly disconnecting after 65 seconds when establishing UDP-based connections from Windows 11, version 24H2 devices to RDS deployments running versions Windows Server 2016 or earlier.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake