Loading story…
Microsoft has acknowledged that recent Windows security updates have introduced significant issues affecting enterprise environments. The December 2025 Patch Tuesday updates have caused failures in the Message Queuing (MSMQ) service on Windows 10 22H2, Windows Server 2019, and Windows Server 2016, resulting in inactive queues, failed IIS sites, and applications unable to write to queues due to new security model changes that restrict necessary folder permissions. Additionally, recent updates to Windows 11 have broken VPN networking for users of the Windows Subsystem for Linux (WSL), particularly impacting enterprise VPN solutions like OpenVPN and Cisco Secure Client, with users experiencing "No route to host" errors due to virtual network interfaces not responding to ARP requests.
Microsoft is actively investigating both issues but has not yet provided a timeline for fixes or workarounds. The MSMQ problem primarily affects non-administrative users and clustered environments under load, while the WSL VPN issue mainly impacts enterprise users relying on mirrored mode networking to access corporate resources. Administrators are advised to monitor for further updates from Microsoft and consider the risks of applying recent patches in critical environments until resolutions are available.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft said business customers affected by the MSMQ-related IIS and application failures should contact Microsoft Support for temporary mitigation steps. The company still had no public patch available, but offered a support-assisted workaround while the investigation continued.
Microsoft publicly acknowledged that the December 2025 security updates were causing MSMQ functionality to break on some Windows systems and said it was investigating. At the time, the company had not provided a permanent fix or timeline, and administrators were advised to consider rollback with associated security tradeoffs.
Recent Windows 11 security updates, including KB5067036 and later KB5072033, caused enterprise WSL users with mirrored networking enabled to lose VPN access to corporate resources. Microsoft-linked reporting said third-party VPN interfaces such as OpenVPN and Cisco Secure Client were not responding to ARP requests, producing errors like 'No route to host.'
After installation of December 2025 Patch Tuesday security updates, including KB5071546, KB5071544, and KB5071543, Message Queuing (MSMQ) began failing on affected Windows 10 22H2, Windows Server 2019, and Windows Server 2016 systems. The issue was tied to security-model and NTFS permission changes that caused inactive queues, failed message writes, IIS and enterprise application outages, and problems in clustered MSMQ environments.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms. Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
Jun 29, 2026
A recent Microsoft security update released in December 2025 has caused significant issues with the Message Queuing (MSMQ) service on Windows 10 and older Windows Server versions. The update introduced changes to the MSMQ security model and NTFS permissions, specifically affecting the `C:\Windows\System32\MSMQ\storage` folder, which now requires write access for MSMQ users. As a result, MSMQ queues may become inactive, Internet Information Services (IIS) sites can fail with resource errors, and applications may be unable to write to queues, despite system resources being available. The issue primarily impacts enterprise and managed IT environments, especially those running clustered MSMQ under load, while personal devices are largely unaffected. Administrators have reported a range of failures, including point-of-sale systems unable to issue receipts and building fire alarm systems going offline, potentially linked to the MSMQ malfunction. Microsoft has acknowledged the problem and suggested contacting their support team for a workaround, though some users have found that uninstalling the update resolves the issue. The lack of a detailed public workaround and the critical nature of affected applications have raised concerns among IT professionals about the reliability of recent security updates and the support process for urgent enterprise disruptions.
Jun 29, 2026
Microsoft released an emergency out-of-band update to address a critical issue with Message Queuing (MSMQ) on Windows 10 systems, which emerged after the December 9, 2025, security updates. The bug caused MSMQ queues to become inactive, preventing applications from writing to queues and resulting in error messages related to insufficient resources, disk space, or memory. The problem was particularly severe in enterprise and clustered MSMQ environments, especially those running Internet Information Services (IIS) sites that rely on MSMQ for asynchronous processing, leading to potential service disruptions. The out-of-band update (KB5074976) is available via the Microsoft Update Catalog and is not distributed through Windows Update or WSUS. Microsoft recommends that affected organizations, especially those with managed IT infrastructures or Azure-hosted devices, prioritize deploying the update and ensure the latest servicing stack update is installed to avoid deployment issues. Regular users with Windows Home or Pro editions are largely unaffected. Administrators are advised to test the patch in staging environments before production rollout to ensure stability and prevent further complications.
Jun 29, 2026