Loading story…
Microsoft has acknowledged a Windows 11 bug that can cause the CapabilityAccessManager.db-wal file under C:\ProgramData\Microsoft\Windows\CapabilityAccessManager\ to grow abnormally, consuming tens or even hundreds of gigabytes of disk space. The file is tied to the Capability Access Manager service, which logs app-permission activity for privacy-sensitive features including the camera, microphone, location, and screen capture. Affected systems may show the lost capacity under System files or System & reserved storage rather than as user data, making the issue difficult to spot until free space drops sharply.
Microsoft said the problem was addressed in the June 23 optional preview update and that the fix will also be rolled out broadly in the July Patch Tuesday release. Users can verify exposure by inspecting the CapabilityAccessManager folder or checking whether the db-wal file has grown unusually large; some reports cited sizes approaching 500GB. As a temporary workaround before the broader fix arrives, users can rename the affected file so Windows regenerates it.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft acknowledged the Windows 11 storage bug in release notes for KB5095093 and said a fix would be included for all users in the July 14, 2026 Patch Tuesday release.
Microsoft addressed a Windows 11 bug that could cause the CapabilityAccessManager.db-wal file to grow abnormally and consume large amounts of disk space in the optional preview update released on June 23, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcezdnet.com
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's cumulative update **KB5063878** for **Windows 11 24H2** has been linked to reports of hard drive and SSD malfunctions, including disks disappearing from the file system and possible data corruption or loss. The issue was highlighted by CSIRT.SK, which said the failures were observed after installation of the August Patch Tuesday package associated with OS build `26100.4946`. According to the advisory, damage may occur during sustained write operations involving tens of gigabytes, raising concern for systems handling heavy disk activity. CSIRT.SK said the problem appears tied to a Microsoft Defender update bundled with the release, while Microsoft had not yet published a confirmed root cause or mitigation in the referenced support material; administrators and users were urged to back up data and watch official Microsoft channels for further guidance.
Jul 24, 2026
Microsoft released the Windows 11 optional preview cumulative update **KB5074105** (for **Windows 11 24H2 and 25H2**) with multiple fixes and changes, including resolving a known issue where the **password sign-in option/icon could disappear** from lock screen sign-in options after installing updates dating back to the August 2025 preview update line. Affected users could still authenticate by hovering over the blank area where the password option should appear to reveal the hidden button; Microsoft reports the issue is addressed in KB5074105. The same KB5074105 preview update also introduces a local hardening change to reduce unauthorized interaction with sensitive system information by adding a **mandatory User Account Control (UAC) prompt** when accessing **Settings > System > Storage**. This change is intended to prevent non-admin users (or threat actors with local/remote access to a non-admin session) from viewing or manipulating detailed storage and temporary-file/system-file information without administrative approval, and is being rolled out as an optional “C-release” preview ahead of broader deployment.
Jun 29, 2026
Microsoft released Windows 11 cumulative update **KB5089573** to permanently fix an installation bug introduced by **KB5089549** that caused some systems running versions **24H2** and **25H2** to fail during reboot. Affected devices typically stalled at about **35–36%** completion, rolled back the update, and returned error `0x800f0922`, with logs indicating insufficient free space in the **EFI System Partition (ESP)**. Microsoft had already applied a Known Issue Rollback and provided a registry-based workaround for enterprise administrators before issuing the permanent fix. The update raises Windows 11 builds to **26100.8524** and **26200.8524**, includes servicing stack and AI component updates, and is available through **Windows Update**, **Microsoft Update Catalog**, **Windows Update for Business**, and **WSUS**. Microsoft said no known issues were identified at release and indicated that the fix will also be included in subsequent cumulative updates, reducing the need for users and administrators to manually resize the ESP or remove security updates.
Jun 29, 2026