Loading story…
Microsoft confirmed that Windows 11 preview and cumulative updates can leave some users at a black screen after sign-in because the Windows Explorer desktop shell fails to start. The regression predominantly affects Azure Virtual Desktop hosts using FSLogix profile containers, particularly for certain existing user profiles, following the August 27 non-security preview release and later updates.
Affected releases include Windows 11 26H1 through KB5120996 (OS Build 28000.2804) and Windows 11 25H2/24H2 through KB5120998. Microsoft has deployed Known Issue Rollback mitigations for enterprise-managed devices and advised users to manually start explorer.exe as a temporary workaround; a permanent fix is in development.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft identified the September 2026 Patch Tuesday updates KB5124008 and KB5122880 as also being associated with the Windows desktop-loading issue.
The August 27, 2026 non-security preview updates, including KB5120996 for Windows 11 26H1 and KB5120998 for 24H2/25H2, introduced a regression that can prevent Windows Explorer from launching after sign-in. The issue was observed primarily on Azure Virtual Desktop hosts using FSLogix and can leave users at a black screen.
Microsoft confirmed the black-screen and Explorer-crash issue, advised users to manually launch explorer.exe as a temporary workaround, and marked the incident mitigated. It released Known Issue Rollback Group Policies KB5124006 for Windows 11 26H1 and KB5124010 for 24H2/25H2 while developing a permanent update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has confirmed that the November 2025 non-security preview update KB5070311 and subsequent patches for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025 are causing RemoteApp connection failures in Azure Virtual Desktop (AVD) environments. This issue primarily impacts enterprise users who rely on RemoteApp to stream individual applications, while full desktop sessions and personal devices running Windows Home or Pro are largely unaffected. The disruption stems from changes to Remote Desktop Protocol (RDP) shell handling introduced by the update, leading to widespread difficulties for organizations dependent on virtualized workloads. To address the problem, Microsoft has provided two main mitigation options: a manual registry edit requiring administrative privileges, and the use of Known Issue Rollback (KIR), which automatically reverts the problematic update for Pro and Enterprise devices. Enterprise administrators managing updates via IT policies can also deploy a targeted Group Policy using a specific MSI package. Microsoft has urged affected organizations to implement these workarounds promptly to restore RemoteApp functionality and minimize operational impact.
Jun 29, 2026
Microsoft’s January 2026 Patch Tuesday release for Windows 11 (notably **KB5074109** for 24H2/25H2) delivered roughly 100+ security fixes (including reported **zero-days**) but also introduced significant reliability regressions. Reported impacts include **system lockups**, **black screens** on systems with Nvidia/AMD GPUs, graphics-related hangs in GPU/DirectX-intensive applications, and application failures such as **Outlook Classic** freezing or failing to launch; additional issues were reported with File Explorer behavior and cloud-backed storage workflows (e.g., OneDrive/Dropbox) causing apps to become unresponsive when saving or syncing data.
Jun 29, 2026
Microsoft confirmed that September Windows 11 security updates **KB5124008** and **KB5124012** can disable USB Audio Class 1.0 devices on Windows 11 24H2 and later systems. Affected devices may fail to start with Device Manager error `Code 10`, produce no sound, and leave volume controls or Sound settings unresponsive; microphones, 3D audio, and multichannel configurations are also affected. Organizations have reported that changing multichannel devices to 2-channel mode can restore service, but Microsoft has not released a permanent fix. KB5124008, which advances Windows 11 25H2 and 24H2 systems to builds 26200.9445 and 26100.9445, respectively, has also been confirmed to disrupt applications using HCS-managed Linux VMs with Plan9 shared folders, including Anthropic Claude Cowork workspace access, and to cause Remote Desktop Services instability. Additional reports cite Explorer crashes or black screens in virtual-desktop and profile-container deployments, File History failures with external drives, and AMD Radeon driver timeouts. Microsoft is investigating the issues; enterprises should test the updates against USB audio, VDI, RDS, Linux VM, backup, and AMD-dependent workflows while weighing mitigations against the updates' security fixes.
Sep 16, 2026