Loading story…
Microsoft said it has fixed a known issue that caused some Windows Server 2019 and Windows Server 2022 systems to upgrade automatically to Windows Server 2025 without administrator approval. The company confirmed the resolution in a Windows release health update and re-enabled the Windows Server 2025 upgrade offer in the Windows Update settings panel, allowing organizations to resume supported in-place upgrades through normal settings workflows.
The issue was first acknowledged after administrators reported servers being upgraded overnight, in some cases to versions their organizations were not licensed to use. Microsoft had previously suggested that some cases involved misconfigured third-party update management tools, but update vendors disputed that explanation and said the problem stemmed from Microsoft's release speed or update classification process. The fix closes a problem that had persisted since 2024 and affected enterprise patching and change-control expectations for Windows Server environments.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
In a Windows release health update published on Tuesday, Microsoft said it had fixed the issue causing unexpected upgrades from Windows Server 2019 and 2022 to Windows Server 2025. The company also re-enabled the Windows Server 2025 upgrade offer in the Windows Update settings panel and published guidance for in-place upgrades.
After Microsoft suggested improperly configured third-party update management software contributed to the problem, update management vendors disputed that claim and said the issue stemmed from a procedural error by Microsoft involving release speed or update classification.
Microsoft acknowledged in September 2024 that a known issue was causing some Windows Server 2019 and 2022 devices to unexpectedly upgrade to Windows Server 2025. The company said the upgrade had been offered through a banner in the Windows Update settings page for organizations seeking in-place upgrades.
Windows administrators reported that some Windows Server 2019 and Windows Server 2022 systems were automatically upgraded overnight to Windows Server 2025, including cases where organizations did not hold licenses for the newer version.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **165 vulnerabilities** across Windows, Office, SharePoint, Defender, SQL Server, Azure, .NET, and other products in one of its largest Patch Tuesday updates on record. The most urgent issue was **CVE-2026-32201**, an **actively exploited** improper input validation flaw in **SharePoint Server** that enables unauthenticated network-based spoofing and was immediately added to **CISA's Known Exploited Vulnerabilities** catalog. Microsoft also patched **CVE-2026-33825**, a publicly known **Microsoft Defender** privilege-escalation bug with proof-of-concept code, and **CVE-2026-33824**, a critical **remote code execution** flaw in **Windows IKE Service Extensions** affecting IPsec/VPN infrastructure. Researchers flagged **CVE-2026-33827** in **Windows TCP/IP** as potentially **wormable** under certain IPv6 and IPSec configurations. Other high-impact fixes include **CVE-2026-33120**, a **SQL Server remote code execution** flaw that paired with a separate privilege escalation bug (**CVE-2026-32176**) could enable full server compromise, and **CVE-2026-32220**, a **UEFI Secure Boot bypass** that could allow untrusted code to load during the boot process. The release also addressed elevation of privilege flaws across Desktop Window Manager, WinSock, TDI Translation Driver, Windows Push Notifications, Function Discovery Service, WSUS, Remote Desktop Licensing, Azure Monitor Agent, and Windows kernel components; security feature bypasses in Windows Hello, PowerShell, BitLocker, and Windows Shell; information disclosure bugs in Windows GDI, Print Spooler, Web Account Manager, UPnP Device Host, and the Windows kernel; and denial-of-service issues in .NET/Visual Studio and Windows RDBSS. Cumulative updates for Windows Server 2022 and 23H2 bundled security hardening for Kerberos, RDP, Secure Boot, and WDS, with Microsoft warning that Secure Boot certificates begin expiring in June 2026.
Aug 10, 2026
Microsoft released September security updates addressing **973 vulnerabilities** across Windows, Office, SQL Server, Exchange, SharePoint, Azure, and developer tools. The release fixes two actively exploited, Important-rated Windows elevation-of-privilege vulnerabilities: `CVE-2026-85880` in Advanced Local Procedure Call (ALPC) and `CVE-2026-81963` in the Windows Update Stack. It also includes Critical fixes affecting Windows Secure Kernel Mode, Virtualization-Based Security enclave components, and remote-code-execution flaws in Excel and Word; elevation-of-privilege issues account for 438 of the vulnerabilities and RCE issues for 258. For Windows 11, Microsoft issued cumulative updates `KB5124008` for versions 24H2 and 25H2, advancing them to builds 26100.9445 and 26200.9445, and `KB5122880` for version 23H2. The updates introduce phased changes including Administrator Protection, which applies just-in-time administrative privileges and separates administrator profiles, along with Microsoft Execution Containers process isolation and Autopilot enhancements. Organizations should urgently deploy and verify patches for the exploited flaws, validate product applicability and known issues in representative groups, and use staged rollout procedures with reboot and installation monitoring.
Sep 15, 2026
Microsoft confirmed a Windows Server Update Services (**WSUS**) issue that caused synchronization delays, scan failures, and timeouts, preventing some organizations from deploying recent Windows updates through **WSUS** or **Configuration Manager**. The problem affects client systems running **Windows 10 version 1607 and later** and server systems running **Windows Server 2012 and later**, with broader impact reported from July 13 as publishing metadata accumulated and disrupted normal update synchronization. Microsoft said a service-side mitigation restored normal behavior for newly installed or rebuilt WSUS servers, but existing deployments could remain affected. The company then published manual remediation guidance for administrators, including backing up `SUSDB`, running a cleanup query to remove problematic metadata, and restoring `MaxXMLPerRequest` to its default value; administrators on forums such as **r/sysadmin** reported stalled client reporting and approved updates failing to reach hundreds of endpoints until fixes were applied.
Jul 22, 2026