Loading story…
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms.
Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A Windows 10 update identified as KB5071546 was reported to disrupt Microsoft Message Queuing functionality because of insufficient permissions. The issue posed a risk to enterprise environments that depend on MSMQ for message-based communication and workflow processing.
Microsoft acknowledged that KB5067036, affecting OS builds 26200.7019 and 26100.7019, caused VPN virtual interfaces to fail to respond to ARP requests in WSL mirrored networking mode. As of the report, no fix had been released, and users were advised to disable mirrored networking or switch to bridged networking as a workaround.
Following Microsoft's October 2025 non-security update KB5067036, Windows Subsystem for Linux users began reporting 'No route to host' errors when using mirrored networking with third-party VPNs. The issue affected access to corporate VPS resources and was especially disruptive in enterprise remote-work environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has acknowledged that recent Windows security updates have introduced significant issues affecting enterprise environments. The December 2025 Patch Tuesday updates have caused failures in the Message Queuing (MSMQ) service on Windows 10 22H2, Windows Server 2019, and Windows Server 2016, resulting in inactive queues, failed IIS sites, and applications unable to write to queues due to new security model changes that restrict necessary folder permissions. Additionally, recent updates to Windows 11 have broken VPN networking for users of the Windows Subsystem for Linux (WSL), particularly impacting enterprise VPN solutions like OpenVPN and Cisco Secure Client, with users experiencing "No route to host" errors due to virtual network interfaces not responding to ARP requests. Microsoft is actively investigating both issues but has not yet provided a timeline for fixes or workarounds. The MSMQ problem primarily affects non-administrative users and clustered environments under load, while the WSL VPN issue mainly impacts enterprise users relying on mirrored mode networking to access corporate resources. Administrators are advised to monitor for further updates from Microsoft and consider the risks of applying recent patches in critical environments until resolutions are available.
Jun 29, 2026
A recent Microsoft security update released in December 2025 has caused significant issues with the Message Queuing (MSMQ) service on Windows 10 and older Windows Server versions. The update introduced changes to the MSMQ security model and NTFS permissions, specifically affecting the `C:\Windows\System32\MSMQ\storage` folder, which now requires write access for MSMQ users. As a result, MSMQ queues may become inactive, Internet Information Services (IIS) sites can fail with resource errors, and applications may be unable to write to queues, despite system resources being available. The issue primarily impacts enterprise and managed IT environments, especially those running clustered MSMQ under load, while personal devices are largely unaffected. Administrators have reported a range of failures, including point-of-sale systems unable to issue receipts and building fire alarm systems going offline, potentially linked to the MSMQ malfunction. Microsoft has acknowledged the problem and suggested contacting their support team for a workaround, though some users have found that uninstalling the update resolves the issue. The lack of a detailed public workaround and the critical nature of affected applications have raised concerns among IT professionals about the reliability of recent security updates and the support process for urgent enterprise disruptions.
Jun 29, 2026
Microsoft's cumulative Windows 11 security update `KB5124008` is reportedly preventing certificate-based Always On VPN tunnels from connecting on some enterprise endpoints running Windows 11 24H2 and 25H2. Administrators using Intune-deployed VPN profiles with RRAS, NPS, and certificate authentication found that uninstalling the update and rebooting restored connectivity, indicating a likely client-side regression; Microsoft had not listed the issue in its known-issues documentation. The failure creates an operational and security tradeoff for affected organizations: pausing or removing the update may restore remote access, but `KB5124008` remediates numerous vulnerabilities, including two elevation-of-privilege zero-days reported to be actively exploited. Enterprises should identify affected Always On VPN clients, test mitigation options, and monitor Microsoft for an acknowledged issue and supported fix before broadly rolling back the security release.
Sep 11, 2026