Windows Server 2022 Archives

Winsage

March 4, 2026

PoC Exploit Released for Microsoft Windows Error Reporting ALPC Privilege Escalation

A proof-of-concept exploit for CVE-2026-20817, a local privilege escalation vulnerability in the Windows Error Reporting (WER) service, has been released by security researcher oxfemale on GitHub. This vulnerability allows low-privileged users to gain SYSTEM-level access through crafted Advanced Local Procedure Call (ALPC) messages. The flaw is located in the WER service's SvcElevatedLaunch method, which fails to validate caller privileges before executing WerFault.exe with user-supplied command line parameters. The CVSS v3.1 base score for this vulnerability is 7.8, indicating a high severity level. It affects unpatched versions of Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022 prior to the January 2026 update. Demonstrations have shown successful exploitation on Windows 11 23H2. Security teams are advised to monitor for unusual processes related to WerFault.exe, investigate missing SeTcbPrivilege in SYSTEM tokens, and review WER-related activities from low-privilege users. Immediate application of the January 2026 security patches is recommended, and a temporary workaround involves disabling the WER service.

Winsage

March 3, 2026

PoC Exploit Released for Windows Error Reporting ALPC Privilege Escalation

A critical local privilege escalation vulnerability, tracked as CVE-2026-20817, affects Microsoft Windows through the Windows Error Reporting (WER) service. This flaw allows authenticated users with low-level privileges to execute arbitrary code with full SYSTEM privileges. The vulnerability resides in the SvcElevatedLaunch method (0x0D) and fails to validate user permissions, enabling attackers to launch WerFault.exe with malicious command-line parameters from a shared memory block. The exploit affects all versions of Windows 10 and Windows 11 prior to January 2026, as well as Windows Server 2019 and 2022. Microsoft addressed this vulnerability in the January 2026 Security Update. Organizations are advised to apply security patches and monitor for unusual WerFault.exe processes.

Winsage

February 11, 2026

Microsoft Patch Tuesday: February 2026

Microsoft has identified several vulnerabilities affecting its products, particularly within Windows Server and Office suites. The affected products and their corresponding vulnerabilities include: - Windows Server 2025: CVE-2026-21510, CVE-2026-21513, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533; updates under article numbers 5075899 and 5075942. - Windows Server 2022, 23H2: Same vulnerabilities as above; update article number 5075897. - Windows Server 2022: Same vulnerabilities; update article number 5075906. - Windows Server 2019: Same vulnerabilities; update article number 5075904. - Windows Server 2016: Same vulnerabilities; update article number 5075999. - Windows Server 2012 R2: CVE-2026-21510, CVE-2026-21513, CVE-2026-21525, CVE-2026-21533; update article number 5075970. - Windows 11 and Windows 10: Various versions (26H1, 25H2, 24H2, 22H2) affected; update articles range from 5077179 to 5075912. - Microsoft Office LTSC for Mac 2024 and Mac 2021: Affected by CVE-2026-21514; release notes available. - Microsoft Office LTSC 2024 and 2021: CVE-2026-21509 and CVE-2026-21514; release notes provided. - Microsoft 365 Apps for Enterprise: Affected by CVE-2026-21509 and CVE-2026-21514; release notes available.

Winsage

January 20, 2026

Microsoft issues emergency patch for latest Windows bugs

Microsoft released the January Patch Tuesday update on January 13, 2026, addressing over 110 security vulnerabilities. The update introduced bugs affecting Windows 11, Windows 10, and Windows Server. The first issue involves authentication failures when connecting to a Cloud PC via Remote Desktop, primarily affecting Windows 11 25H2, Windows 10 22H2 ESU, and Windows Server 2025. The second issue affects systems with Secure Launch enabled, causing unexpected restarts instead of shutting down or entering hibernation mode, specifically impacting Windows 11 23H2. Microsoft has released emergency patches for the affected versions, which include: - Windows 11, versions 25H2 and 24H2 (KB5077744) - Windows 11, version 23H2 (KB5077797) - Windows 10, version 22H2 ESU and Windows 10 Enterprise LTSC 2021 (KB5077796) - Windows Server 2025 (KB5077793) - Windows Server 2022 (KB5077800) - Windows Server 2019 and Enterprise LTSC 2019 (KB5077795)

Winsage

January 19, 2026

The Last Windows Security Updates of January 2026 Are Here

Microsoft released its first set of security updates for the Windows operating system and various products in January 2026, addressing over 110 vulnerabilities. The updates are available for all supported versions of Windows, with Windows 10 receiving fixes only through the Extended Security Updates (ESU) program. Windows 11 versions 24H2 and 25H2 are the main consumer releases benefiting from these updates. Approximately 112–114 security updates were released, with around 8 rated as Critical. At least one zero-day vulnerability is actively exploited. The updates include security fixes for Windows, Office, Edge, Azure, and server components. Windows 11 versions 23H2, 24H2, and 25H2, as well as Windows Server 2023 and 2025, have known issues. Windows 11 version 24H2 and 25H2 received security fixes for multiple vulnerabilities, while version 23H2 continues to receive support through enterprise servicing channels. Windows 10 updates are limited to ESU-enrolled systems, with general support ending in October 2025. Windows Server 2016, 2019, 2022, 2023, and 2025 received January security updates, addressing important vulnerabilities without disclosing any critical ones. Microsoft also released updates for Office products and SharePoint Server components. Known issues after the January updates include credential prompt failures and authentication issues in Azure Virtual Desktop and Windows 365, particularly affecting the new Windows App. Workarounds involve using the classic Remote Desktop client or the web-based RDP client. Additionally, devices with Secure Launch enabled may experience shutdown and sleep mode failures. Microsoft has provided out-of-band fixes for certain affected systems as of January 18, 2026. Users can manually install updates through the Windows Update feature, and it is recommended to create a full system backup before proceeding with updates.

Winsage

January 16, 2026

Windows Remote Assistance Vulnerability Allow Attacker to Bypass Security Features

Critical security updates have been released to address CVE-2026-20824, a vulnerability in Windows Remote Assistance that allows attackers to bypass the Mark of the Web (MOTW) defense system. This affects various Windows platforms, including Windows 10 and Windows Server 2025, and is rated with an Important severity level. The flaw enables unauthorized local attackers to circumvent MOTW defenses, posing risks to confidentiality. The vulnerability requires local access and user interaction for exploitation, often using social engineering tactics. Microsoft has issued security updates for 29 Windows configurations, including specific KB articles for affected versions of Windows 10, Windows 11, and Windows Server. Users are advised to apply the necessary patches, which are classified as “Required” customer actions. The vulnerability remains unexploited in the wild and was not publicly disclosed before the patches were released. Microsoft’s assessment categorizes it as “Exploitation Less Likely.”

Winsage

January 16, 2026

Microsoft Ends Windows Server 2008 Support on January 13, 2026

Microsoft has officially ceased all support for Windows Server 2008 as of January 13, 2026, including paid extended security updates. This end-of-life scenario poses significant security risks for organizations still using the outdated operating system, making them vulnerable to cyberattacks. The transition away from Windows Server 2008 requires careful planning, as many organizations face challenges in migrating legacy applications to modern systems. The lack of ongoing patches means that any new vulnerabilities will remain unaddressed, potentially leading to data breaches and compliance failures, particularly in regulated sectors like healthcare and finance. Microsoft has encouraged migration to Azure, offering incentives for early adopters, but the transition can be complex and costly. The end of support also affects global supply chains and compatibility with newer software applications. Organizations are advised to conduct audits of their software portfolios and consider hybrid environments to enhance flexibility and security.

Winsage

December 25, 2025

Native NVMe support in Windows Server 2025 promises dramatic speed gains

Microsoft has introduced native NVMe support in Windows Server 2025, enhancing the performance of modern NVMe devices, including PCIe Gen5 SSDs and high-end Host Bus Adapters (HBAs). This feature eliminates the translation layers that previously routed NVMe I/O through SCSI, resulting in reduced processing overhead and latency. Testing shows that Windows Server 2025 can achieve up to 80% higher 4K random read IOPS and approximately 45% fewer CPU cycles per I/O compared to Windows Server 2022. The enhancements benefit enterprise applications such as SQL Server, OLTP workloads, and virtualization environments using Hyper-V, as well as analytics and AI/ML workloads. To utilize native NVMe, system administrators must use the in-box Windows NVMe driver, and the feature requires an opt-in process with the latest cumulative update and registry key or Group Policy configuration. Organizations should validate the implementation to assess its impact on their production environments.

Winsage

December 17, 2025

Microsoft Desktop Windows Manager Out-Of-Bounds Vulnerability Let Attackers Escalate Privileges

Microsoft has identified a significant out-of-bounds vulnerability (CVE-2025-55681) in the Desktop Window Manager (DWM) that allows local attackers to escalate privileges to SYSTEM on affected Windows systems. This vulnerability is found in the dwmcore.dll component and affects all versions of Windows 10, Windows 11, and various Windows Server editions (2016, 2019, 2022, and 2025). The flaw originates from the CBrushRenderingGraphBuilder::AddEffectBrush function, enabling attackers with local access to exploit improper buffer handling without user interaction. The vulnerability has a CVSS v3.1 score of 7.8, indicating high severity. Microsoft has released security patches, and organizations are advised to apply them promptly while implementing strict access controls until the patches are installed.

Winsage

December 16, 2025

Microsoft admits Windows 10’s extended updates are causing issues, MSMQ won’t work

Microsoft has acknowledged a significant issue with the December 2025 Patch update (KB5071546) for Windows 10, affecting the Message Queuing (MSMQ) component, which is primarily used by enterprise applications. The update altered MSMQ's operational dynamics and modified NTFS permissions for its storage directory, requiring write access that many real-world implementations do not have. This has led to operational failures, with users experiencing error messages indicating insufficient resources. Reports indicate that uninstalling the update restores MSMQ functionality. Microsoft is investigating these issues, which also impact clustered MSMQ environments under load, but does not affect Windows 11. Users are advised to uninstall the update to resolve MSMQ issues.