Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday Zero-day

KB5053598

KB5053598: Cumulative update for Windows Server, version 2025, March 2025. Exploited NTFS, Fast FAT and MMC flaws patched

In short

Attackers are exploiting flaws in NTFS, Fast FAT, and Microsoft Management Console. The KB page also lists Remote Desktop freezes and Azure Arc setup hangs, later resolved by KB5055523.

Does it affect you? Applies to: Devices running Windows Server 2025, x64.

Build
26100.3476
Security
35 fixed · 5 critical · 5 exploited
Restart
Required

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fixes 5 changes

Live kernel debug files (dumps)

Verified in package
  • Unwanted live kernel debug files are no longer created.1
    Fixes win32kbase.sys creating live kernel debug files when it should not.

Scanning apps

  • Some scanners that are connected but not detected can now be detected.2
    Addresses an issue where certain connected scanners were not detected.

Service for User to Self (S4U2self)

For: Domain-joined devices with Credential Guard off and RC4 disallowed

  • Sign-in using S4U2self works in configurations where it could fail.3
    Fixes possible S4U2self authentication issues when Credential Guard is off and an Active Directory domain does not allow the RC4 cipher.

sfc /scannow command

  • The sfc /scannow command no longer returns errors every time it runs.4

Winlogon

  • A stop error during shutdown is fixed.5

Improvements 3 changes

Networking

Verified in package

For: Devices with Wi-Fi network names encoded using UTF-8

  • Wi-Fi network names with Unicode characters, such as emoji, display properly in command output.6
    netsh wlan show networks can read SSIDs encoded using UTF-8.

Daylight savings time (DST)

For: Devices using Paraguay time

  • Time changes for daylight saving time in Paraguay are supported.7

Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)

Verified in package
  • More drivers at risk of use in attacks are added to the blocklist.8
    Adds drivers at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks to DriverSiPolicy.p7b.

New features 3 changes

Narrator

2 items
  • Narrator can copy its last spoken content to the clipboard with a keyboard shortcut.9
    Press the Narrator key + Ctrl + X.
  • Narrator can now read email messages in the new Outlook.10
    This works in a similar way to classic Outlook.

Virtual hard disk (VHD/VHDx)

Verified in package

For: People managing virtual hard disks

  • Settings adds a button to detach a virtual hard disk.11
    Find the button in Settings > System > Storage > Disks & Volumes, in the VHD or VHDx properties.

Known issues

  1. Open Affects: Organizations and IT administrators

    Citrix

    Devices with Citrix Session Recording Agent version 2411 might fail to install the January 2025 security update. At restart, the device might undo the update.12

    How to apply the workaround Workaround

    Upgrade Citrix Session Recording Agent to version 2503 or later.12

  2. Open Affects: Everyone

    Remote desktop

    Remote Desktop sessions on Windows Server 2025 might freeze shortly after connection. Mouse and keyboard input can stop responding, so users must disconnect and reconnect.13

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Everyone

    Azure Arc Setup wizard app

    The Azure Arc Setup wizard app might stop responding when opened from Start or the taskbar. The application event log might show Event ID 1000 for AzureArcSetup.exe.14

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-03-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5051987, KB5050009, KB5048667, KB5046617
+2 earlier KB5043080, KB5044284
Replaced by
KB5055523
VersionBuildChannel
2025 26100.3476 General availability

Security

35 vulnerabilities fixed
5 exploited 5 critical 30 important
VulnerabilitySeverityCVSS
CVE-2025-24985 Exploited
Windows Fast FAT File System Driver Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-24993 Exploited
Windows NTFS Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-26633 Exploited
Microsoft Management Console Security Feature Bypass Vulnerability
 Important 7.0
CVE-2025-24991 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 5.5
CVE-2025-24984 Exploited
Windows NTFS Information Disclosure Vulnerability
 Important 4.6
CVE-2025-26645
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2025-24084
Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability
 Critical 8.4
CVE-2025-24035
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24045
Windows Remote Desktop Services Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-24064
Windows Domain Name Service Remote Code Execution Vulnerability
 Critical 8.1

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 35 vulnerabilities →

Updated components

8,062 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings135
Graphics and display54
Bluetooth50
Networking47
Printing43
Audio42
.NET networking38
Security and sign-in38
Hyper-V and virtualization32
Remote Desktop31
File Explorer and shell29
Storage and file systems24

Verified in package: changed files confirm Live kernel debug files (dumps), Networking, Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b), Virtual hard disk (VHD/VHDx).

Sources

Updated
Cited passages from Microsoft's official notes (14)
  1. 1. Fixed: The win32kbase.sys creates live kernel debug files when it should not. support.microsoft.com
  2. 2. Fixed: This update addresses the issue where certain scanners were not being detected despite being connected. support.microsoft.com
  3. 3. This occurs if Credential Guard is off, and the device joins an Active Directory domain that doesn't allow the RC4 cipher. support.microsoft.com
  4. 4. Fixed: You get errors every time you run the command. support.microsoft.com
  5. 5. Fixed: A stop error occurs during shutdown. support.microsoft.com
  6. 6. The netsh wlan show networks command can now read SSIDs that are encoded using UTF-8. support.microsoft.com
  7. 7. This update supports (DST) changes in Paraguay. support.microsoft.com
  8. 8. This update adds more drivers to the list that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. support.microsoft.com
  9. 9. To copy the last spoken content by Narrator to the clipboard, press Narrator key + Ctrl + X. support.microsoft.com
  10. 10. It will now auto read the contents of an email message in the new Outlook, similar to how it works in classic Outlook. support.microsoft.com
  11. 11. In the properties for your VHD or VHDx, go to Settings > System > Storage > Disks & Volumes. support.microsoft.com
  12. 12. The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. support.microsoft.com
  13. 13. After installing the February 2025 Security update (KB5051987), released February 11, 2025, and later updates, on Windows Server 2025 devices, you might experience Remote Desktop sessions freezing shortly after connection. support.microsoft.com
  14. 14. After installing this update, you might face issues with the Azure Arc Setup wizard application. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 14 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake