Loading story…
Microsoft has confirmed that the November 2025 non-security preview update KB5070311 and subsequent patches for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025 are causing RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. This issue primarily impacts enterprise users who rely on RemoteApp to stream individual applications, while full desktop sessions and personal devices running Windows Home or Pro are largely unaffected. The disruption stems from changes to Remote Desktop Protocol (RDP) shell handling introduced by the update, leading to widespread difficulties for organizations dependent on virtualized workloads.
To address the problem, Microsoft has provided two main mitigation options: a manual registry edit requiring administrative privileges, and the use of Known Issue Rollback (KIR), which automatically reverts the problematic update for Pro and Enterprise devices. Enterprise administrators managing updates via IT policies can also deploy a targeted Group Policy using a specific MSI package. Microsoft has urged affected organizations to implement these workarounds promptly to restore RemoteApp functionality and minimize operational impact.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft confirmed in December 2025 that recent updates were causing the Azure Virtual Desktop RemoteApp failures. The company provided a manual registry workaround and Known Issue Rollback guidance, including Group Policy deployment options for managed environments, while stating that a permanent fix is still being developed.
Starting with the November 2025 non-security preview update KB5070311, Windows 11 24H2/25H2 and Windows Server 2025 devices in Azure Virtual Desktop environments began experiencing RemoteApp connection failures. The issue affected enterprise RemoteApp sessions, while full desktop sessions and most Home or Pro devices were not impacted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft’s January 2026 Windows security updates introduced regressions that disrupted enterprise endpoints, including **Remote Desktop authentication failures** affecting access to *Azure Virtual Desktop* and *Windows 365*. After installing `KB5074109` on specific Windows client builds (noted as Builds **26200.7623** and **26100.7623**), users reported repeated credential prompt/sign-in failures in the **Windows App**, preventing successful remote session establishment; Microsoft acknowledged the issue and issued an **out-of-band** update intended to restore normal Remote Desktop connectivity. Separately, Microsoft confirmed another January patch-related issue on Windows 11 23H2 where some systems with **Secure Launch** enabled may **fail to shut down, restart, or hibernate**, leaving devices running and potentially draining batteries. As a workaround, Microsoft advised forcing shutdown via the command: ```cmd shutdown /s /t 0 ``` Microsoft indicated a permanent fix would be delivered in a future update, but did not provide scope/impact metrics for affected devices.
Jun 29, 2026
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms. Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
Jun 29, 2026
Microsoft's September 2026 cumulative updates are reportedly causing Remote Desktop Services (RDS) session hosts on Windows Server 2019, 2022, and 2025 to hang several hours after deployment or after user logoffs. Affected environments report RDP clients stuck at "Connecting," dropped or stalled sessions, blocked logoffs, unresponsive applications and Task Manager, and reboots requiring hard resets. Reports identify `KB5122871` for Windows Server 2025 and `KB5122882` for Windows Server 2022; administrators have also observed Event ID 20498 and Winlogon Event ID 6005. Administrators report that removing the affected cumulative update restores RDS functionality, but doing so also removes September security fixes, including patches for actively exploited zero-days and a critical RDS remote-code-execution vulnerability. Independent debugging has suggested a possible deadlock in `RDPSERVERBASE!WDLIB_Close` during session teardown, though this remains unconfirmed. Microsoft had not acknowledged the issue, determined a root cause, or published a mitigation at the time of reporting.
Sep 13, 2026