Loading story…
Microsoft confirmed a Windows 11 issue affecting certain Samsung Galaxy Book 4 laptops and Samsung desktop models where users lose access to the C:\ system drive and receive "C:\ is not accessible – Access denied" errors. The problem prevents file access and blocks the launch of applications including Outlook, Office apps, web browsers, system utilities, and Quick Assist; in more severe cases, users also cannot elevate privileges, uninstall updates, or collect diagnostic logs. Reports indicate the issue appeared on affected Samsung systems running Windows 11 24H2/25H2, with one report tying onset to the February 2026 security update KB5077181.
Microsoft said a joint investigation with Samsung traced the issue to the Samsung Galaxy Connect app, also described in reporting as a Samsung Share-related application used for screen mirroring, file sharing, and data transfer between Galaxy devices and Windows PCs. To limit further impact, Microsoft removed the app from the Microsoft Store, while Samsung republished a stable earlier version to prevent new installations from triggering the failure. Recovery options for already affected devices remain limited, and Microsoft and Samsung are still working on remediation guidance and a permanent fix.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft later issued recovery instructions telling affected users to uninstall Samsung Galaxy Connect or Samsung Continuity Service and run a script to restore default C: drive permissions without deleting personal files. Users were also advised to contact Samsung for device-specific assistance.
Samsung rolled back by republishing a previous stable version of the Galaxy Connect app to limit further impact on new devices. However, this did not fully resolve recovery for systems that were already affected.
To prevent additional systems from being affected, Microsoft pulled the current Samsung Galaxy Connect app from the Microsoft Store. This mitigation followed the investigation linking the app to the C: drive permission corruption issue.
As of March 13, 2026, Microsoft said no official fix or workaround had been released and warned users not to use an unofficial method that reassigns C: drive ownership to the Everyone group. The company said that workaround would weaken Windows security protections.
Microsoft said a joint investigation with Samsung found the root cause was Samsung Galaxy Connect software, not the March 2026 Patch Tuesday update or a broader Windows monthly update. The bug was reported on Windows 11 24H2 and 25H2 systems and caused failures in app launches, file access, privilege elevation, update removal, and log collection.
Complaints about Samsung Windows 11 systems losing access to the C: drive and suffering widespread app and permission failures were observed as early as mid-February 2026. The issue affected routine actions such as opening files, launching applications, and performing administrative tasks.
After installation of the February 2026 Windows 11 security update KB5077181, some Samsung Galaxy Book 4 and certain Samsung desktop devices began showing "C:\ is not accessible – Access denied" errors. The update timing initially led some to suspect Windows itself was responsible.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcetechrepublic.com
Open sourceghacks.net
Open sourcetomshardware.com
Open sourcepcgamer.com
Open sourcewindowslatest.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's cumulative update **KB5063878** for **Windows 11 24H2** has been linked to reports of hard drive and SSD malfunctions, including disks disappearing from the file system and possible data corruption or loss. The issue was highlighted by CSIRT.SK, which said the failures were observed after installation of the August Patch Tuesday package associated with OS build `26100.4946`. According to the advisory, damage may occur during sustained write operations involving tens of gigabytes, raising concern for systems handling heavy disk activity. CSIRT.SK said the problem appears tied to a Microsoft Defender update bundled with the release, while Microsoft had not yet published a confirmed root cause or mitigation in the referenced support material; administrators and users were urged to back up data and watch official Microsoft channels for further guidance.
Jul 24, 2026
Microsoft’s Windows 11 cumulative update `KB5094126` is causing serious post-installation failures on some systems after its release with roughly 200 security fixes, including 33 critical flaws and five zero-days. Users reported freezes shortly after boot, black screens, boot loops, BSODs, and repeated BitLocker recovery prompts, including on devices where BitLocker was believed to be disabled. Reports indicate the problems are hitting some HP models particularly hard, with Secure Boot certificate changes and interactions with BIOS/UEFI settings and undersized or crowded EFI partitions emerging as likely factors. The update is also disrupting enterprise and productivity workflows by breaking File Explorer integration for OneDrive and, in some cases, Dropbox and iCloud Drive, while some affected machines reportedly lose LAN access even though internet connectivity remains available. Administrators and users have resorted to Windows Recovery Environment to remove the patch, and some systems reportedly required full Windows reinstalls after recovery complications. A widely shared workaround has been to temporarily disable Secure Boot, complete boot and update recovery, then re-enable Secure Boot after updating BIOS/UEFI firmware, though Microsoft had not formally acknowledged the full scope of the issues in the update documentation at the time of reporting.
Jun 29, 2026
Microsoft confirmed that the Windows 11 cumulative update `KB5079473` is causing Microsoft account sign-in failures in several Microsoft applications, including **Teams, OneDrive, Edge, Excel, Word,** and **Microsoft 365 Copilot**. Affected users are shown a misleading message stating that the device is not connected to the Internet, even when connectivity is working, preventing normal sign-in activity across those services. The issue has been linked to a specific network connectivity state and appears to affect Windows 11 systems on versions **24H2** and **25H2** that use Microsoft accounts, while organizations authenticating with **Entra ID** are not impacted. Microsoft said it is developing a permanent fix and, in the meantime, recommends restarting affected PCs while they remain connected to the Internet, noting that the problem can return if a device is rebooted without an active connection.
Jun 29, 2026