# Microsoft Patch Tuesday: Critical RCE flaws actively exploited

Published: 2026-06-09 · Severity: high · Sectors: government-national, defense, financial-services, healthcare, technology, infrastructure
Canonical: https://vorant.io/reports/567b4b08-6669-5baa-9817-55e60e5790fd/microsoft-patch-tuesday-critical-rce-flaws-actively-exploited

> Microsoft patches critical remote code execution bugs across Windows, Office, and Azure; six CVEs confirmed exploited in the wild.

On March 11, 2025, Microsoft released patches for multiple critical vulnerabilities affecting a broad range of products including Windows, Office, Azure services, Visual Studio, and Edge. The most severe flaws enable remote code execution in the context of the logged-in user, potentially allowing attackers to install programs, modify or delete data, or create new accounts with full privileges. Microsoft confirmed that CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, and CVE-2025-26633 are being actively exploited in the wild. A seventh vulnerability, CVE-2025-24054, was later reported as exploited in the wild since March 19, 2025; it allows attackers to leak NTLM hashes or user passwords and compromise systems.

Vulnerable components span critical infrastructure including Windows kernel-mode drivers, NTLM authentication, Remote Desktop Services, RRAS, Hyper-V, DNS Server, Azure services, and the Windows Telephony Server. The impact scales with user privilege level; systems running non-administrative accounts experience less severe compromise than those where users hold admin rights. CIS recommends immediate patching after testing, implementation of least-privilege access controls, endpoint detection and response capabilities, and user security awareness training to mitigate exploitation risk.

## Mentioned in this report

- Vulnerabilities: CVE-2025-24054 (KEV), CVE-2025-24983 (KEV), CVE-2025-24984 (KEV), CVE-2025-24985 (KEV), CVE-2025-24991 (KEV), CVE-2025-24993 (KEV), CVE-2025-26633 (KEV)

## Detection guidance (public sample)

### Library-ms File Dropped by Archive Tool, Browser or Mail Client (NTLM Leak Pattern)

ATT&CK: T1187

A .library-ms file written by an archiver, browser or Outlook outside the user Libraries folder, the delivery pattern for NTLM hash-leak exploitation such as CVE-2025-24054. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Library-ms File Dropped by Archive Tool, Browser or Mail Client (NTLM Leak
  Pattern)
id: 271feadd-4858-51ea-88d6-5e849300638e
status: experimental
description: Detects creation of .library-ms files by archive extraction tools, web
  browsers or Outlook outside the normal user Libraries folder. Opening or previewing
  such a file can force an SMB/NTLM authentication to a remote server, leaking the
  user's NTLM hash (CVE-2025-24054 style). Generalises on the file type and the unusual
  creating process, not on any specific filename.
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-march-11-2025_2025-022
tags:
- attack.credential-access
- attack.t1187
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .library-ms
    Image|endswith:
    - \7zFM.exe
    - \7zG.exe
    - \WinRAR.exe
    - \chrome.exe
    - \msedge.exe
    - \firefox.exe
    - \OUTLOOK.EXE
  filter_libraries:
    TargetFilename|contains: \Microsoft\Windows\Libraries\
  condition: selection and not filter_libraries
falsepositives:
- Users legitimately downloading or extracting Windows library definition files shared
  by IT
- Backup or profile migration tools restoring library files via an archive utility
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-march-11-2025_2025-022

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/567b4b08-6669-5baa-9817-55e60e5790fd/microsoft-patch-tuesday-critical-rce-flaws-actively-exploited.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup