Patch Tuesday updates Archives

Winsage

June 1, 2026

Microsoft fixes KB5089549 Windows security update install issues

Microsoft resolved an issue causing installation failures and error code 0x800f0922 during the deployment of the May 2026 Windows 11 security update (KB5089549), which was linked to insufficient free space on the EFI System Partition (ESP). The problem mainly affected devices with 10 MB or less available space, leading to automatic rollbacks of the update. The resolution was provided through the release of the Windows 11 KB5089573 preview cumulative update on May 26, 2026. Users installing updates released on or after this date will not need a workaround, while those with earlier updates can use the Known Issue Rollback feature. Additionally, IT administrators in enterprise settings can manually address the issue through Group Policy configurations. The KB5089573 update introduced 30 changes to improve performance and reliability.

Winsage

May 18, 2026

Old Windows Flaw Returns to Spotlight With MiniPlasma Exploit

Security researcher Chaotic Eclipse has introduced a Windows exploit called MiniPlasma, which may allow privilege escalation from standard user accounts to SYSTEM level access, even on patched versions of Windows. This exploit is linked to CVE-2020-17103, a flaw in the Windows Cloud Filter driver that was addressed by Microsoft in December 2020. Tests have reportedly demonstrated the exploit functioning on a patched Windows 11 Pro system, achieving SYSTEM access from a standard user account. The exploit involves an undocumented registry-key path within the .DEFAULT user hive, raising concerns about the effectiveness of the 2020 fix. There is a discrepancy between public and Canary builds of Windows 11, with the exploit working on the public build but not on the Canary build. Microsoft’s April 2026 Patch Tuesday updates included another entry related to the Windows Cloud Files Mini Filter Driver elevation-of-privilege issue. Defenders are advised to monitor the CVE-2020-17103 record for further clarification regarding the status of the original fix and the implications of the MiniPlasma exploit.

Winsage

May 17, 2026

New Windows ‘MiniPlasma’ zero-day exploit gives SYSTEM access, PoC released

A cybersecurity researcher, known as Chaotic Eclipse, has released a proof-of-concept exploit for a Windows privilege escalation zero-day vulnerability called "MiniPlasma," which allows attackers to gain SYSTEM privileges on fully patched Windows systems. The vulnerability affects the cldflt.sys Cloud Filter driver and was reported by Google Project Zero in September 2020, assigned the identifier CVE-2020-17103, and claimed to be resolved by Microsoft in December 2020. However, Chaotic Eclipse asserts that the vulnerability remains unpatched. Testing confirmed that the exploit works on Windows 11 Pro, enabling command prompt access with SYSTEM privileges from a standard user account. Will Dormann, a vulnerability analyst, verified the exploit's effectiveness but noted it did not work in the latest Windows 11 Insider Preview Canary build. The exploit leverages the undocumented CfAbortHydration API to manage registry key creation improperly. Chaotic Eclipse has previously disclosed other Windows zero-day vulnerabilities and claims their actions are a protest against Microsoft's handling of vulnerabilities.

Winsage

May 15, 2026

Windows 11’s May update is causing install failures and slow internet — here’s what we know

Microsoft's Patch Tuesday update for Windows 11, KB5089549, released on May 13, 2026, has caused installation issues for some users, who receive an error message indicating a rollback. Additionally, a smaller group has reported decreased internet performance after the update. Users facing installation failures may see the system revert to the previous version automatically and can attempt to reinstall the update or troubleshoot by clearing the SoftwareDistribution cache or using the Windows Update troubleshooter.

Winsage

May 13, 2026

Windows 11 security update fixes critical Bing and Azure flaws

Microsoft released its May 2026 Patch Tuesday updates for Windows 11, addressing 97 security vulnerabilities across various components, including Windows, Microsoft Office, Azure services, SQL Server, SharePoint, Hyper-V, and .NET. The updates are encapsulated in KB5089549 for Windows 11 versions 24H2 and 25H2, elevating systems to builds 26100.8457 and 26200.8457. Notable vulnerabilities include CVE-2026-32169, a critical flaw in Azure Cloud Shell with a CVSS score of 10.0, and CVE-2026-21536, a critical remote code execution vulnerability in the Microsoft Devices Pricing Program with a CVSS score of 9.8. Other critical vulnerabilities include CVE-2026-32191 and CVE-2026-32194, impacting Microsoft Bing Images, both with CVSS scores of 9.8. The update also addresses multiple Windows privilege escalation vulnerabilities and remote code execution vulnerabilities in Microsoft Office and Excel. Microsoft has warned of upcoming Secure Boot certificate expirations starting in June 2026 and has improved boot reliability related to BitLocker recovery issues. Users can install the updates via Settings → Windows Update, with a system restart required.

Winsage

May 1, 2026

Microsoft now lets admins choose pre-installed Store apps to uninstall

Microsoft has updated its Windows 11 operating system to enhance the management of preinstalled applications. The new RemoveDefaultMicrosoftStorePackages policy allows IT administrators to remove any preinstalled MSIX/APPX applications by referencing their Package Family Name (PFN) through Group Policy Object (GPO) or custom OMA-URI for mobile device management (MDM). This feature requires devices to have at least the April 2026 Windows non-security update. It is available for Windows 11 version 24H2 Enterprise and Education editions, whereas it was initially exclusive to version 25H2 or later. A comprehensive list of supported applications and instructions for applying the policy are provided in Microsoft's documentation. Additionally, a new policy setting enables the uninstallation of the AI-powered Copilot digital assistant from enterprise devices after the April 2026 Patch Tuesday updates. The dynamic list option for this policy will be rolled out in the coming months.

Winsage

April 27, 2026

Microsoft Adds Policy to Let IT Admins Uninstall Copilot From Enterprise Windows 11 Devices

Microsoft has introduced a policy allowing IT administrators to remove the Microsoft Copilot app from managed enterprise devices. This "Remove Microsoft Copilot App" policy will be available as a Policy CSP and Group Policy after the April 2026 Windows security updates for Windows 11 devices on the 25H2 update, specifically for Enterprise, Professional, and Education editions. The policy will uninstall Copilot under certain conditions: both Microsoft 365 Copilot and Microsoft Copilot must be installed, the user must not have manually installed the app, and the app must not have been launched in the past 28 days. Administrators can enable the policy through the Group Policy Editor or configure it via Microsoft Intune and SCCM after the April 2026 updates. The policy aligns with Microsoft's recent changes in managing Copilot, including the cessation of automatic installations and the cancellation of plans to integrate Copilot into system notifications and other features. The policy was initially available to Windows Insiders in January before becoming generally accessible in April 2026.

Tech Optimizer

April 21, 2026

Microsoft quietly reveals whether you need a third-party antivirus software in Windows 11

Microsoft has stated that third-party antivirus software is not necessary for Windows 11, as its built-in antivirus solution, Windows Defender, is sufficient for most users. This assertion was made public on April 9, when Microsoft declared Windows 11 the most secure version of its operating system. Windows Defender is effective when users regularly install Security Intelligence Updates, apply monthly Patch Tuesday updates, and activate SmartScreen for filtering harmful downloads. While third-party antivirus solutions may be beneficial in certain scenarios, such as enterprise environments or for users seeking additional features, Microsoft advises relying on a single real-time antivirus solution, which is typically Windows Defender. Microsoft Defender is a comprehensive protection stack that includes real-time scanning, cloud-delivered protection, and automatic updates. Independent tests have shown that Microsoft Defender achieves high protection rates, comparable to leading paid antivirus solutions. The built-in Windows Security application includes features like SmartScreen, Smart App Control, and ransomware protection, providing extensive coverage without additional costs. The consensus is that most users will not need third-party antivirus software in 2026, as Windows Security offers robust protection against modern threats.

Winsage

April 20, 2026

Microsoft releases emergency updates to fix Windows Server issues

Microsoft has confirmed that some administrators are experiencing difficulties installing the KB5082063 security update on Windows Server 2025. This month's Patch Tuesday updates have caused certain Windows servers, especially those with domain controller roles, to enter a restart loop due to failures in the Local Security Authority Subsystem Service (LSASS). Microsoft has released emergency out-of-band updates, including KB5091157 for Windows Server 2025, to address both the installation failure and the restart issues. Additionally, some Windows Server 2025 devices may boot into BitLocker recovery mode after installing the KB5082063 update. A bug affecting Windows Server 2019 and Windows Server 2022 that caused unexpected upgrades to Windows Server 2025 has also been resolved. Microsoft has issued various emergency updates throughout the year to address other issues, including a Bluetooth device visibility bug and vulnerabilities in the Routing and Remote Access Service (RRAS).

Winsage

April 14, 2026

Microsoft’s April Windows update fixes 165 flaws, one exploited zero-day

Microsoft has released its April 2026 Patch Tuesday updates for Windows 11, addressing a total of 165 vulnerabilities, including one zero-day exploit that has been actively targeted by malicious actors. The update aims to enhance security and improve overall system performance. Users are encouraged to promptly install the updates to mitigate risks associated with these vulnerabilities.