Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday Zero-day

KB5053603

KB5053603: Cumulative update for Windows Server, version 2022, March 2025. Exploited file-system flaws and a console security bypass fixed

In short

Flaws in NTFS, Fast FAT, and Microsoft Management Console are being exploited. This update also fixes SSH startup and adds support for GB18030-2022.

Does it affect you? Applies to: Devices running Windows Server 2022. The update package is for x64 systems.

Build
20348.3328
Security
34 fixed · 5 critical · 5 exploited
Restart
Required

What changes

Fixes 2 changes

Open Secure Shell (OpenSSH)

  • The OpenSSH service starts again, so SSH connections work instead of stopping.1
    Fixes the sshd.exe service startup failure.

Azure Virtual Network

For: IT administrators using Azure Virtual Network

  • Azure Virtual Network metering can be turned off with a registry setting.2
    The MeteringDisabled DWORD registry value can be set to 1.

Improvements 2 changes

Daylight saving time (DST)

For: Windows Server 2022 devices using Paraguay time settings

  • Daylight saving time changes in Paraguay are supported.3

Servicing stack

  • The component that installs Windows updates gets quality improvements.4
    Includes servicing stack update KB5053666, build 20348.3320.

New feature 1 change

GB18030-2022

  • Adds support for the GB18030-2022 amendment.5

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to complete installation of the January 2025 Windows security update. Home users are not expected to be affected.6

    How to apply the workaround Workaround

    Update Citrix Session Recording Agent to version 2503 or later.6

  2. Open Affects: Everyone

    System Guard Runtime Monitor Broker service

    Event Viewer might show Event 7023 for the System Guard Runtime Monitor Broker service on devices with updates released January 14, 2025, or later. The error should not affect performance or security, and KB5055526 addresses it.7

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5051979, KB5052819, KB5049983, KB5048654
+14 earlier KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by
KB5055526
VersionBuildChannel
2022 20348.3328 General availability

Security

34 vulnerabilities fixed
5 exploited 5 critical 29 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-24084
Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability
 Critical 8.4
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24045
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24064
Windows Domain Name Service Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
387.2 MB
windows10.0-kb5053603-x64.msu Main update · KB5053603 SHA-1: 38c42a86…637547

Updated components

369 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display7
Secure Boot7
Networking6
Hyper-V and virtualization5
Kernel5
Printing4
Security and sign-in4
Storage and file systems4
Emoji and input2
Remote Desktop2
Audio1
File Explorer and shell1

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. Fixed: The service fails to start, which stops SSH connections. There is no detailed logging, and you must run the sshd.exe process manually. support.microsoft.com
  2. 2. Fixed: You can turn off the VNET metering feature with the following registry key. support.microsoft.com
  3. 3. This update supports (DST) changes in Paraguay. support.microsoft.com
  4. 4. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  5. 5. This update adds support for this amendment. support.microsoft.com
  6. 6. Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. support.microsoft.com
  7. 7. This issue is addressed in KB5055526. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake