Microsoft Management Console Archives

Winsage

September 15, 2026

30 Days Until Windows 11 24H2 Support Ends; Excel Paste Glitch Surfaces Simultaneously

Microsoft announced on September 14 that the Windows 11 24H2 edition, including Home and Pro versions, has only 30 days of support remaining, with a deadline for updates set for October 13, 2026. Users are encouraged to upgrade to version 25H2 or later to continue receiving security updates. The Enterprise and Education editions will have support until October 12, 2027. Users have reported issues from September's security updates, particularly with the Office patch KB5002914, which disrupts the copy-and-paste function in Excel across multiple versions. Microsoft has acknowledged the issue but has not yet released a fix. A temporary workaround involves manually removing the problematic patch, though this also removes the associated security fixes. Additionally, users have experienced connection drops and unresponsiveness in Remote Desktop Services (RDS) across various Windows versions, including Windows 11 26H1 and Windows Server 2012. Microsoft confirmed that related tools may also stop responding, and restarting virtual machines may temporarily restore functionality. USB audio issues have been reported on certain USB Audio Class 1.0 devices across Windows 11 versions, with users experiencing loss of audio output and corrupted sound settings. Switching to 2-channel mode has helped some users, but Microsoft has not provided a timeline for a comprehensive fix. As Windows Server 2012 nears the end of its Extended Security Updates period on October 13, 2026, the RDS issues add pressure on administrators. Users on 24H2 need to prioritize migration to 25H2, while those with the latest updates should be cautious regarding Excel and Remote Desktop functionalities.

Winsage

September 14, 2026

Latest Windows Server Updates Cause Remote Desktop Issues

Organizations that implemented Microsoft’s September 2026 security updates are experiencing challenges with Remote Desktop Services (RDS) on Windows Server systems, leading to instability and connection failures. Issues typically arise hours after the update, causing ongoing Remote Desktop sessions to freeze, difficulties in disconnecting, and failures in establishing new connections. Affected systems include Windows Server 2012 through Windows Server 2025 and select Windows client versions, with problems such as failed RDP connections, sign-in difficulties, unresponsive management tools, and servers stalling during Remote Desktop configuration. Microsoft advises administrators to uninstall the September 2026 updates, which would remove security enhancements, and is investigating the root cause while providing Known Issue Rollback policies. For inaccessible virtual machines, restarting the affected VM is recommended as a temporary measure.

Winsage

September 14, 2026

Microsoft patches Windows and Excel – breaks audio, remote access, and paste

Microsoft's recent security updates have caused disruptions in several areas: 1. Remote Desktop Services (RDS): Users on Windows 11 26H1 and Windows Server 2012 are experiencing connectivity issues, including failed connections, freezing servers, and unresponsive tools like Microsoft Management Console (MMC). A temporary solution involves restarting the virtual machine, and Microsoft is working on a fix. 2. USB Audio Devices: Problems have been reported with USB Audio Class 1.0 devices on Windows 11 26H1, 25H2, and 24H2, leading to audio issues. A workaround includes switching to two-channel mode, and Microsoft is addressing the situation. 3. Excel Functionality: A fix for vulnerabilities in Excel has disrupted the paste operation across versions 2016, 2019, 2021, and 2024, leaving users unable to paste content correctly. Some users have resolved the issue by uninstalling and reinstalling Office or using commands to remove the security update, though this also removes the associated security fixes.

Winsage

April 7, 2025

EncryptHub’s dual life: Cybercriminal vs Windows bug-bounty researcher

EncryptHub has been linked to breaches affecting 618 organizations and is associated with the disclosure of two Windows zero-day vulnerabilities, CVE-2025-24061 and CVE-2025-24071, to Microsoft. The vulnerabilities were addressed during the March 2025 Patch Tuesday updates, and the reporter was acknowledged as 'SkorikARI with SkorikARI.' Investigations revealed a connection between EncryptHub and SkorikARI, following an incident where EncryptHub exposed their credentials. SkorikARI's accounts were used to report the vulnerabilities, contributing to Windows security. Evidence linking SkorikARI to EncryptHub includes password files exfiltrated from EncryptHub's system and a GitHub account associated with SkorikARI. EncryptHub has previously attempted to market zero-day vulnerabilities on underground forums and is believed to have affiliations with ransomware groups. The threat actor has executed social engineering campaigns, phishing attacks, and developed a custom infostealer known as Fickle Stealer. They created fictitious social media profiles and websites, such as a fake project management application called GartoriSpace, which installed malicious files on unsuspecting users. EncryptHub has also been implicated in exploiting a Microsoft Management Console vulnerability, CVE-2025-26633.

Winsage

March 26, 2025

Hackers Exploit Windows MMC Zero-Day Vulnerability to Execute Malicious Code

Russian threat actors are exploiting a zero-day vulnerability in the Microsoft Management Console (MMC), identified as CVE-2025-26633, allowing them to bypass security features and execute harmful code. The hacking group Water Gamayun, also known as EncryptHub and Larva-208, is behind this campaign, using a weaponized version of the vulnerability called “MSC EvilTwin” to deploy various malicious payloads, including information stealers and backdoors. The vulnerability affects multiple Windows versions, particularly older systems like Windows Server 2016. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-26633 to its Known Exploited Vulnerabilities Catalog, requiring federal agencies to patch affected systems by April 1, 2025. Microsoft included this vulnerability in its March 2025 Patch Tuesday update. Recommended mitigations include applying security patches, restricting network access to MMC ports, and monitoring for unusual MMC activity.