Zero-day — All products

Exploited Shell bypass addressed; 24H2 Home and Pro reach end of updates

Addresses an actively exploited Windows Shell security feature bypass and fixes several problems, including Explorer startup failures and game input stuttering. It is the final update for 24H2 Home and Pro.

Exploited Windows Shell bypass patched; Explorer crashes fixed

Attackers are exploiting a Windows Shell security bypass, and the update fixes Explorer crashes after sign-in on some multi-user systems.

Exploited Windows Shell bypass flaw addressed; File History issue addressed

An actively exploited Windows Shell security-feature bypass is addressed. The update also addresses File History backup and restore failures.

Windows Shell flaw under active attack gets patched

An actively exploited Windows Shell security-feature bypass gets patched, alongside changes to time zones, ReFS security, storage, and File History.

Windows Shell exploit covered; BitLocker access restored

An exploited Windows Shell security bypass is covered, and older systems can access drives encrypted on newer systems again. The update also addresses File History and Storage Spaces problems.

Actively exploited Windows Shell flaw patched; storage issues addressed

An actively exploited Windows Shell flaw is patched, alongside fixes for File History and offline Storage Spaces Direct disks. Free support for these 2016 LTSB editions ends on release day.

Exploited Windows Shell flaw patched; server recovery feature added

An actively exploited Windows Shell security-feature bypass is patched. Windows Server 2025 also gains Quick machine recovery, which is off by default.

Exploited Shell flaw patched; Exchange mail issues mitigated

An exploited Windows Shell security bypass is addressed. Some Exchange servers may still have sign-in and email delivery problems, with a temporary mitigation available.

Actively exploited Windows Shell flaw patched; Exchange issue mitigated

An actively exploited Windows Shell security bypass is patched. Exchange users might still have sign-in and email problems, but a registry mitigation is available.

Windows Shell flaw exploited; Exchange email issues remain

An actively exploited Windows Shell security-bypass flaw is addressed, while some on-premises Exchange servers still face email failures despite a temporary mitigation.

An exploited Windows Update Stack flaw is closed

An actively exploited Windows Update Stack flaw gets a security fix, and Teams and Outlook crashes on Arm64 PCs are addressed. The update also changes Morocco time and improves remote-session audio.

Windows Update flaw exploited; mouse and desktop display fixes

An actively exploited flaw in the Windows Update stack gets a security fix, alongside fixes for mouse settings, black desktop backgrounds, and app crashes on Arm64 PCs.

An exploited Windows Update flaw gets an access fix

An actively exploited Windows Update flaw could let attackers gain higher access. The update also addresses remote audio problems and adjusts Morocco's time zone.

Windows ALPC flaw under attack; remote audio issue addressed

An actively exploited Windows ALPC flaw is among the security fixes. The update also addresses Remote Desktop audio and a BitLocker recovery-key issue.

Exploited ALPC flaw patched; remote-session audio addressed

Attackers are exploiting a Windows ALPC flaw to gain higher access. Remote-session audio also gets a fix, though some USB audio problems remain.

Windows ALPC flaw under attack; Remote Desktop audio addressed

Attackers are exploiting a Windows ALPC privilege flaw. The update also addresses Remote Desktop audio problems and adds Secure Boot certificate targeting data.

Windows Update Stack flaw under active attack

An actively exploited Windows Update Stack flaw is among the security fixes. The update also improves networking, Remote Desktop audio, and Sysmon.

Exploited ALPC flaw patched; Hyper-V restart issue fixed

Patches an actively exploited flaw in Windows ALPC and fixes a Hyper-V issue that could unexpectedly restart some virtual machines.

An exploited ALPC flaw is patched; Remote Desktop audio is addressed

An exploited Windows ALPC flaw is patched, and Remote Desktop audio redirection is addressed for some configurations. USB Audio Class 1.0 devices can still have sound problems.

Actively exploited ALPC flaw; Remote Desktop audio addressed

An actively exploited ALPC flaw could let attackers gain higher privileges. The update also addresses remote-session audio problems, but some USB audio issues remain.

Exploited WinSock flaw patched; Drop Tray removed

An actively exploited flaw in the WinSock driver is patched, and Drop Tray and its Settings control are removed.

Secure Boot targeting expands; Drop Tray is removed

Secure Boot updates reach more eligible PCs, while Drop Tray and its Multitasking setting are removed. The update also closes an actively exploited WinSock driver flaw.

WinSock driver flaw patched; File History backups improve

A flaw in the WinSock support driver listed as exploited is addressed, and File History backups to network shares become more reliable.

Exploited Winsock driver flaw patched; File History backups fixed

Attackers are exploiting a flaw in the Winsock Ancillary Function Driver that can let them gain higher access. Scheduled File History backups to network shares also work again.

Exploited networking flaw; File History backups fixed

Attackers are exploiting a Windows networking flaw to gain higher privileges. File History backups to SMB network shares also work again.