Microsoft has taken a second shot at addressing a critical Windows Server vulnerability that a previous update didn't fully fix – and that's now being exploited in the wild.

The vulnerability, tracked as CVE-2025-59287, affects Windows Server Update Service (WSUS) in Windows Server (2012, 2016, 2019, 2022, and 2025).

WSUS is a component of the Windows Server operating system that is designed to simplify the management and distribution of Microsoft product updates and patches.

Instead of each PC handling this individually, WSUS downloads the updates and stores them, and then distributes them to all computers on the network.

However, a recent vulnerability allowed for insecure deserialization of untrusted data, which security experts have warned allows unauthenticated attackers to execute arbitrary code.

"CVE-2025-59287 is a critical RCE vulnerability in Microsoft Windows Server Update Services (WSUS), caused by unsafe deserialization of AuthorizationCookie data through BinaryFormatter in the EncryptionHelper.DecryptData() method," said Hawktrace.

"The vulnerability allows an unauthenticated attacker to achieve remote code execution with SYSTEM privileges by sending malicious encrypted cookies to the GetCookie() endpoint."

The company first issued a fix earlier this month. However, since then, security researchers, including Dutch cybersecurity firm Eye Security, said they have spotted exploitation of the flaw in the wild.

"A few days after the public release of the CVE and the blog by HawkTrace, we are now observing active & successful exploitation targeting Windows Server Update Services (WSUS) world-wide, including our customer base," the firm said.

“Our telemetry shows scanning and exploitation attempts from 207.180.254[.]242,and our scans reveal roughly 2,500 WSUS servers still exposed world-wide, including about 100 in the Netherlands and 250 in Germany."

Meanwhile, Huntress also said it has spotted attacks targeting WSUS instances with their default ports (8530/TCP and 8531/TCP) exposed online.

"We expect exploitation of CVE-2025-59287 to be limited; WSUS is not often exposing ports 8530 and 8531. Across our partner base, we have observed ~25 hosts susceptible."

Windows Server flaw prompts CISA advisory

Warnings have been issued by the Netherlands National Cyber Security Centre (NCSC-NL) and the US Cybersecurity and Infrastructure Security Agency (CISA).

"CISA strongly urges organizations to implement Microsoft’s updated Windows Server Update Service (WSUS) Remote Code Execution Vulnerability guidance, or risk an unauthenticated actor achieving remote code execution with system privileges," CISA said in an advisory.

Organizations are advised to identify servers that are currently configured to be vulnerable to exploitation - i.e., those with WSUS Server Role enabled and ports open to 8530/8531 – and deal with these first.

They should apply the out-of-band security update released on 23 October to all servers identified, and then reboot. If they can't apply the update immediately, system administrators should disable the WSUS Server Role and/or block inbound traffic to ports 8530/8531, the default listeners for WSUS, at the host firewall.

"Of note, do not undo either of these workarounds until after your organization has installed the update," CISA said.

MORE FROM ITPRO

• Why firms ignore vulnerabilities at their own risk
• Threat actors are exploiting flaws more quickly – here's what business leaders should do
• Patch management vs vulnerability management

Microsoft is facing a £1 billion lawsuit in the UK over claims that it's been overcharging customers for using rival cloud platforms.

Those using Amazon Web Services (AWS), Google Cloud Platform (GCP) or Alibaba Cloud rather than Microsoft Azure, it claims, were charged higher licensing fees for Windows Server.

Customers licensing Windows Server via AWS, Google Cloud Platform, or Alibaba are subject to the Services Provider License Agreement (SPLA). The lawsuit alleges users face differences in price and quality compared with the Microsoft Azure licensing deal.

The case has been filed in the UK’s Competition Appeal Tribunal by Dr Maria Luisa Stasi, a competition law and digital markets regulation expert, through the disputes resolution law firm Scott+Scott.

"Put simply, Microsoft is punishing UK businesses and organisations for using Google, Amazon and Alibaba for cloud computing by forcing them to pay more money for Windows Server,” said Stasi.

“By doing so, Microsoft is trying to force customers into using its cloud computing service Azure and restricting competition in the sector.

"This lawsuit aims to challenge Microsoft’s anti-competitive behavior, push them to reveal exactly how much businesses in the UK have been illegally penalized, and return the money to organisations that have been unfairly overcharged."

According to Stasi, many thousands of businesses and organizations in the UK are likely to have been affected by the charges, with small businesses hit particularly hard.

Microsoft’s cloud computing practices, including those addressed in the claim, are already under investigation in the UK and elsewhere.

Communications regulator Ofcom, for example, last year referred the company to the Competition and Markets Authority (CMA), saying it was concerned that "cloud providers are using their strong position in software products to distort competition". A ruling is likely next summer.

Similarly, earlier this year Microsoft paid €20 million to CISPE to settle an antitrust complaint about its cloud computing licensing practices, thus avoiding an EU antitrust investigation.

It also promised to make changes to some of its software licensing practices within nine months.

"Collective actions level the playing field and allow organisations to fight back against anti-competitive behaviour from some of the biggest companies in the world," said James Hain-Cole, partner at Scott+Scott.

"Dr Stasi’s case against Microsoft aims to do exactly that. We are proud to support her efforts to secure compensation for the class and hold Microsoft to account for its conduct that affects businesses and organisations across the UK economy."

Microsoft has resolved an issue that saw companies running Windows Server 2022 and Server 2019 unexpectedly upgrading to Windows Server 2025 — despite not paying for the upgrade.

Windows Server 2025 was released earlier this month with new features including upgrades to security in Active Directory, hotpatching for hybrid and on-prem clouds, and more. However, it also came with a few notable bugs, including one that crashed computers.

Shortly after the release, users spotted that older versions of Windows Server were suddenly upgrading to Windows Server 2025.

One employee of a small business in the UK posted on Reddit that Windows 2022 Servers had upgraded themselves to the new version, or were about to do so.

"This obviously came as a shock as we're not at the point to do so for many reasons and the required licensing would not be present," the user wrote.

Unwanted Windows Server 2025 upgrades

Microsoft said in an update that there were two scenarios in which this happened. The first involved devices automatically upgrading to the new OS.

"This was observed in environments that use third-party products to manage the update of clients and servers," Microsoft explained.

The tech giant noted the issue had been mitigated, but also advised users to ensure third-party software designed to manage updates be configured to not automatically deploy them.

Microsoft updated the release under the upgrade classification "optional" — suggesting there was an issue with how the software was classified for admins and third-party software.

That was backed up in a separate post by a technical manager at security and update software company Heimdal, which noted that the "KB" label appeared to be incorrect. Whether that caused the unexpected updates or not, Microsoft has fixed the "KB" issue.

"The Windows Server 2025 feature update was made generally available on November 1, 2024, as KB5044284, which was the same KB number used for Windows 11, version 24H2," Microsoft said in its update.

"This was the KB numbering for both these client and server Windows updates available at that time. Future updates released for Windows Server 2025 and Windows 11, version 24H2 will share the same KB numbers, but will have different release note sites and links."

Regardless of whether third-party management software is to blame or Microsoft itself, plenty of admins had a tough week.

"It's not been a great week at work, too much time lost on this, and the outcome is that in some instances backups have come into play however Windows Server 2025 licensing will have to be purchased for others," the small business employee noted in their post.

The second unexpected upgrade scenario involved a banner displayed on the device's Windows Update page in Settings, offering an upgrade to the new OS.

"This message is intended for organizations that want to execute an in-place upgrade," the company said, adding that the issue had since been resolved.

Recurring issues

Microsoft quickly spotted three bugs in Server 2025 - one that meant English text was shown during installation, even if it wasn't the default language, and a second that limited the OS from running on devices with a high core count, sparking crashes, blue screens and long restarts.

Similarly, a third error popped up saying "boot device inaccessible" in iSCSI environments.

Microsoft has acknowledged all three issues, saying it is working on a resolution for each, and promising a solution in a future Windows monthly update for the core count and iSCSI bugs, and merely more information for the English text issue.

Microsoft has released the latest version of its server operating system, Windows Server 2025 — but it comes alongside a trio of bugs.

Windows Server 2025 is Microsoft's latest version of its server OS, following on from Windows Server 2022. The new version is arriving alongside System Center 2025, which Microsoft said means it's possible to "make the most” of new features immediately.

The tech giant promises better security, performance, and "cloud agility" with the latest version, but warned admins to be wary of three bugs during the installation process that include an issue that causes blue screen errors in systems with a high core count.

"Generally available today, Windows Server 2025 builds on our mission to deliver a secure and high-performance Windows Server platform tailored to meet customers’ diverse needs," wrote Ian LeGrow, corporate vice president for Azure Edge and Platform, in a blog post.

"This release will enable you to deploy apps in any environment, whether on-premises, hybrid environments, or in the cloud."

Key features in Windows Server 2025

On the security front, Microsoft has beefed up security in Active Directory, including new cryptographic support, and added new techniques for preventing a range of attacks against server message block (SMB), including hardened firewall defaults and protections against brute force, spoofing, and man in the middle attacks.

For cloud users, Microsoft highlighted a few notable features, such as hotpatching for hybrid and on-prem clouds, though this will require an additional subscription fee.

"Customers operating fully in the cloud have inherent modern security advantages like automatic software updates and back-up and recovery," LeGrow wrote.

"Now we’re bringing some of those capabilities to Windows Server 2025 for on-premises customers with a new hotpatching subscription service, enabled by Azure Arc. With hotpatching, customers will experience fewer reboots and minimal disruption to operations."

Alongside that, Microsoft has integrated Azure Arc for easier onboarding and operational flexibility, unified network policy management, and software-defined network multisite features for easier migration and management.

Microsoft of course can't fail to mention AI. LeGrow said Windows Server 2025 was designed for demanding workloads including AI and machine learning.

"Windows Server 2025 delivers up to 60% more storage IOPs performance compared to Windows Server 2022 on identical systems," he said. "Windows Server 2025 introduces massive performance and scalability improvements that come from Azure."

Alongside the new features, Microsoft is also killing off a few. That includes WordPad, Windows PowerShell 2.0 engine, and the SMTP service.

Watch out for the bugs

Microsoft has warned about three particular issues that may crop up during installation. The tech giant confirmed it is working on addressing all three bugs, which have varying levels of seriousness.

The first bug might show English text during installation, regardless of the language selected. As Microsoft points out, that won't affect English-language users, but "will be noticeable if a language other than English is selected for installation."

However, this error only happens if using a CD or USB drive to install Windows Server 2025.

The second means Windows Server 2025 might not run properly on devices with a high core count. Microsoft said it appears to be happening on servers with more than 256 cores, and is causing the installation or upgrade to fail or stop, long restarts of three hours or more, and a blue screen error.

The issue doesn't seem to happen on all systems with high core counts, but if it does, limit the number of cores below 256 for installation.

Finally, the third issue includes an error saying "boot device inaccessible" may be displayed in iSCSI environments during startup after installation of Windows Server 2025.

Key details

Windows Server 2025 is available immediately, alongside System Centre 2025. As a long-term release, it will have extended support until 2034, and mainstream support until 2029.

It is possible to upgrade directly to Windows Server 2025 from as far back as Windows Server 2012 R2. Windows Server 2022 will be supported until October 2026.

Windows Server 2025 will work with most 64-bit processors, and Microsoft has released a full list of certified processors.

Microsoft has released emergency out-of-band (OOB) updates to fix Kerberos authentication issues that were affecting a large proportion of enterprise users.

The tech giant released the updates on 17 and 18 November for all domain controllers (DCs) in affected environments. Microsoft aimed to fix an issue which could cause sign-in failures in Kerberos, Microsoft's longstanding default authentication protocol.

System administrators' complaints began last week when many reported various processes breaking within their organisation. Faults in Kerberos can lead to issues relating to user sign-ins, Internet Information Services (IIS Web Server), remote desktop connections, and accessing shared folders, among others.

“You do not need to install any update or make any changes to other servers or client devices in your environment to resolve this issue,” said Microsoft. “If you used any workaround or mitigations for this issue, they are no longer needed, and we recommend you remove them.”

Users can access the updates by searching for the Microsoft knowledge base (KB) number in the Microsoft Update Catalog. Alternatively, the updates can be imported manually into Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager for those organisations that use the tools to manage their IT estate.

There are cumulative updates available:

• Windows Server 2022: KB5021656
• Windows Server 2019: KB5021655
• Windows Server 2016: KB5021654

Users don’t need to apply any previous updates before installing these ones. Microsoft said that users don’t have to uninstall the affected updates before installing any later updates either.

There are also standalone updates available:

• Windows Server 2012 R2: KB5021653
• Windows Server 2012: KB5021652
• Windows Server 2008 R2 SP1: KB5021651 (released November 18, 2022)
• Windows Server 2008 SP2: KB5021657

Users that are deploying security-only updates for these Windows Server versions only have to install the standalone updates for November 2022. They will also need to install previous security updates to be fully up-to-date since these aren’t cumulative.

What were the issues affecting Kerberos?

Microsoft was forced to introduce an emergency update to fix a number of updates it implemented on 8 November.

The tech giant said that users could encounter a number of issues with Kerberos authentication. This could affect domain user sign-in, group managed service accounts (gMSA), and remote desktop connections.

Additionally, users might have been unable to access shared folders on workstations and file shares on servers, as well as printing that needed domain user authentication.

When encountering the issue, Microsoft said that admins might receive a Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 error event in the event log system section on a DC, displaying the text: 'While processing an AS request for target service {service}, the account {account name} did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 1). The requested etypes : 18 3. The accounts available etypes : 23 18 17. Changing or resetting the password of {account name} will generate a proper key'.

The tech giant said that the issue isn’t part of a security hardening for Netlogon and Kerberos which began with the November security update. Devices used at home by consumers, or those that aren’t linked to an on-premise domain, won’t be affected by the problem.

IT administrators are reporting authentication issues after installing the most recent May 2022 Patch Tuesday security updates, released this week.

Online discussions suggest that a number of businesses are experience issues, specifically those that installed the updates on Windows Servers that also serve the domain controller (DC) and Active Directory Certificate Services (ACDS) roles.

According to some admins, Network Policy Server (NPS) policies were reported to be failing, returning an error which read that ‘authentication failed due to a user credential mismatch. Either the user name provided does not map to an existing account or the password was incorrect’.

Others said their Windows Server, which was serving only the DC role, not the ACDS role too, experienced the same issues with failing NPS policies. Removing the KB5013941 update reportedly fixed the issue.

One individual reported that in their environment they run separate servers for DC and NPS, and came to the conclusion that the NPS servers may be patchable, but DC servers may need to have the update rolled back, after testing the updates on each.

“FYI we're aware of the NPS issue,” said Steve Syfuhs, senior software engineer focusing on cryptography, authentication, and identity at Microsoft. “It's not related to NPS specifically but rather with how we're distinguishing between different kinds of names in the certificates. Only a subset of folks are affected by this.”

Syfuhs addressed users in a separate Twitter discussion and confirmed that Microsoft is looking into the issues that are being reported by numerous IT admins.

“After installing updates released May 10, 2022 on your domain controllers, you might see authentication failures on the server or client for services such as Network Policy Server (NPS), Routing and Remote access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP),” Microsoft said in an issues document. “An issue has been found related to how the mapping of certificates to machine accounts is being handled by the domain controller.”

The issues currently experienced by Windows Server administrators are due to the way in which Microsoft fixed two ‘high severity’ privilege escalation vulnerabilities, tracked as CVE-2022-26931 and CVE-2022-26923, in Tuesday's round of monthly security fixes.

Online discussions in the early hours after the security patches were released appeared to show users were able to apply the updates without issues, only for Windows Server issues to emerge later.

Earlier this year, many Windows Server administrators collectively agreed to forgo the security patches issued by Microsoft, citing numerous issues that led to operational disruption so severe that they thought they were better left unprotected from the security patches than to update and apply workarounds.

Microsoft has issued a recommended mitigation for admins who want a workaround to the issue with the certificates but do not want to roll back the latest update as others already have done, leaving themselves unprotected.

The workaround involves manually mapping certificates to a machine account in Active Directory, Microsoft said. If the recommended mitigation does not work, admins are encouraged to examine the related support document for other potential methods to resolve the issues they are experiencing.

Microsoft has released an emergency out-of-band (OOB) update full to address an array of issues found in last week's Windows Server patch, but IT administrators are in agreement that they will not apply them.

Last week's Patch Tuesday fixed a host of issues across Microsoft products, including a number of zero-day vulnerabilities, but Windows Server administrators have complained that some of the patches released have created even more problems.

Because of the issues introduced by the most recent cumulative patches, IT administrators discussing the issues on Reddit are mostly in agreement that forgoing the patches and waiting for the next cumulative update in February is the best course of action to minimise operational disruption and complexity.

The patches issued last week have been breaking a number of key components in business environments and the solution many administrators have turned to is to uninstall the updates entirely.

Four main flaws

The latest out-of-band update from Microsoft issued this week aims to address the issues faced by businesses running Windows Servers but in some cases, it first requires administrators to install the broken patch from last week.

The issues businesses are currently facing include domain controllers unexpectedly restarting and entering boot loops every few minutes. The issue is thought to affect all supported Windows Server versions and the failure in the LSASS.exe process means Windows cannot run correctly.

Microsoft Hyper-V is also affected by the patches, with enterprise virtual machines (VMs) failing to start on some Windows Servers. In addition, ReFS-formatted removable media is failing to mount post-patch, which has caused issues for administrators thinking their external drives were corrupted. Numerous reports of experts formatting their drives after applying last week's patches, only to realise it was in vain, have appeared on social media, too.

To cap off a bug-laden release of patches, some L2TP VPN connections are also failing across Windows 11, Windows 10, and certain Windows Server versions.

Microsoft has issued fixes the all of the aforementioned issues and aside from the ReFS-formatted media issues, they are cumulative updates which means they do not require administrators to install the broken patch from last week first.

The updates are available in the Microsoft Update Catalogue which also has instructions on how to install the updates manually into Windows Server Update Service (WSUS).

A risky response?

Despite most of the updates being cumulative, IT admins are seemingly still in agreement that they will be waiting until February, or until a fully safe wave of patches arrives, to fix the Windows Server issues.

One user said: "I'll be waiting on the cumulative... I'm not reinstalling a broken patch I just removed from a bunch of servers to then have to immediately apply a fix to said patch."

Another user said installing the out-of-band update made matters worse: "[We] received the bad updates this morning, and Exchange wouldn't see the Active Directory (AD) environment anymore. I saw the optional OOB update and installed that - [it] actually made the problem worse. I removed all of the updates and AD was back to being seen and Exchange was finally working."

Weighing in on the matter, outside experts have said the idea of forgoing updates is one that shouldn't be taken lightly and the risks of leaving environments open to known vulnerabilities need to be considered on balance with the potential disruption the updates themselves could cause an organisation.

"This is very much a question of risk management and risk assessment," said Andy Norton, European cyber risk officer at Armis to IT Pro. "Clearly the risk from installing the patch is one of disruption to the organisation. If you balance that with the risk from a cyber attack stemming from the issues that are not addressed by failing to patch, you then have both sides of the equation and are able to make a decision.

"There were six zero-day flaws addressed in the January patch, however, none of these zero-days are actively being exploited currently, and so it may appear that the consensus is to delay the patching process as it is riskier than being exposed to the zero days."

Alan Calder, CEO at GRC International Group, added: "If it were my business, and a sysadmin said they thought it might be ok to continue with critical vulnerabilities unpatched until Patch Tuesday in February, we would have had a very blunt conversation about taking cyber security seriously."

In a statement given to IT Pro, Microsoft said: "We recommend customers install updates released on January 17."

Microsoft has fixed a total of 98 security vulnerabilities as part of its January 2022 Patch Tuesday update released this week, including 29 remote code execution (RCE) flaws and six zero-days.

Of the 98 total vulnerabilities, nine were rated 'critical' - having a CVE score of nine or greater. Among the most severe security issues patched by Microsoft were a pair of RCEs both with scores of 9.8/10 affecting Windows Servers and systems with internet key exchange (IKE).

The flaw affecting Windows servers that are configured as a webserver, tracked as CVE-2022-21907, allows unauthenticated cyber attackers to send specially crafted packets to targeted servers utilising the HTTP Protocol Stack. Microsoft also said the issue is wormable and recommends patching all affected servers as a priority task.

Another of the more serious flaws Microsoft patched this week was one found affecting internet key exchange (IKE), though Microsoft has been tight-lipped on the full details of the problem.

"CVE-2022-21907 is a particularly dangerous CVE because of its ability to allow for an attacker to affect an entire intranet once the attack succeeds," said Danny Kim, principal architect at Virsec, to IT Pro.

"Although Microsoft has provided an official patch, this CVE is another reminder that software features allow opportunities for attackers to misuse functionalities for malicious acts," he added. "Instead of trying to continuously patch and identify these vulnerabilities, enterprises should look for a real-time monitoring solution to safeguard applications and their functionalities from these types of attacks."

The RCE vulnerability, tracked as CVE-2022-21849, can be exploited with 'low complexity', according to Microsoft's patch notes, and allows unauthenticated attackers to trigger multiple vulnerabilities when the IPSec service is running on Windows.

Microsoft Exchange Server also received five separate fixes for one critical-rated RCE vulnerability, tracked as CVE-2022-21846, rated 9.0/10, with an 'adjacent' attack vector which means the attack is limited at the protocol level. This particular flaw was first flagged to Microsoft by the National Security Agency (NSA), which has raised attention to other Microsoft Exchange security issues throughout 2021.

In order to achieve exploitation, cyber attackers would have to first gain a foothold onto a victim's environment, such as being on the same shared physical network, like Bluetooth or IEEE 802.11. This type of flaw is common with man-in-the-middle setups, Microsoft said.

Numerous flaws affecting the Microsoft Office suite were also patched by Microsoft but perhaps the most serious one, tracked as CVE-2022-21840, addressed 26 individual critical-rated flaws in one vulnerability. It has a CVE score of 8.8/10 and attackers could achieve remote code execution on a victim's machine if they opened a specially crafted file.

The flaw is thought to be slightly less likely to exploit given that some user interaction is required (opening the file), but Microsoft still categorised it as a 'low complexity' exploit, meaning cyber attackers can expect repeatable success against the vulnerable component.

Microsoft has issued updates for Windows machines, all of which are advised to be installed, but certain Mac users will have to wait for patches as they are not immediately available.

A full list of the now-patched security issues has been published by Microsoft with RCE flaws affecting products including Windows Server, Microsoft Exchange Server, SharePoint Server, the Microsoft Office suite, DirectX, Windows Remote Desktop Protocol, Windows Resilient File System, and other areas.

"This massive Patch Tuesday comes during a time of chaos in the security industry whereby professionals are working overtime to remediate Log4Shell – reportedly the worst vulnerability seen in decades," said Bharat Jogi, director, vulnerability and threat research at Qualys to IT Pro. "Unpredictable events such as Log4Shell add significant stress to the security professionals dealing with such outbreaks – and bring to the forefront the importance of having an automated inventory of everything that is used by an organisation in their environment.

"It is the need of the hour to automate deployment of patches for events with defined schedules, such as Microsfot's Patch Tuesday, so security professionals can focus energy to respond efficiently to unpredictable events that pose dastardly risk to an organisation’s crown jewels."

Six zero-day vulnerabilities

In addition to the array of security vulnerabilities affecting Microsoft products, six zero-days are also now patched, though no evidence suggests any of them were actively exploited.

• CVE-2022-21919 - Windows User Profile Service Elevation of Privilege Vulnerability
• CVE-2022-21836 - Windows Certificate Spoofing Vulnerability
• CVE-2022-21839 - Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
• CVE-2022-21874 - Windows Security Center API Remote Code Execution Vulnerability
• CVE-2021-22947 - Open Source Curl Remote Code Execution Vulnerability
• CVE-2021-36976 - Libarchive Remote Code Execution Vulnerability

None of the above zero-days were actively exploited, but publicly available proof of concept (PoC) code is available so businesses should still patch these as a matter of priority before exploitation attempts do start occurring.

Microsoft has issued an out-of-band patch for Windows Server to fix a problem that could potentially stop remote desktop users logging into the system.

The flaw causes performance issues with Windows Server, which would result either in a slow sign-in process, general slowness, or at worst a black screen, Microsoft said.

Windows Server 2019 is at risk, and Microsoft has published KB5010196 to address this edition. The bug also affects Windows Server 2012 Release 2, which the company has addressed with KB5010215.

Also affected are Window Server 2022 and 2016, which the company said it would address in the coming days.

The bug stemmed from the KB5008218 update that Microsoft released during a regular Patch Tuesday update on December 14. This update introduced some security changes for Windows.

The out-of-band updates will not install automatically as part of the Windows Update service, meaning that administrators must install them manually by importing it into the Windows Server Update Service (WSUS). They can get the Windows Server 2019 patch by visiting the Microsoft Update Catalog website. Windows Server 2012 Release 2 users can go here.

The latest updates are cumulative, and the Windows Server 2019 update inherits three other less urgent Windows issues identified by Microsoft. This includes errors for devices using Asian language packs, and a temporary problem starting the Windows Cluster Service that disappears when rebooting after approximately 20 minutes. There is also an issue with versions of Windows Server used as Key Management Services hosts that might prevent some client Windows 10 operating systems from activating. The company will fix these in future releases, it said.

Out-of-band patches for Windows Server are rare. Microsoft issued one in November last year, addressing a bug in Windows Server when used as a domain controller. The flaw prevented servers from authenticating legitimate users who tried to access resources using a single sign-on token.

Microsoft has expanded its Secured-core PC initiative to its server products in a bid to combat ransomware attacks on infrastructure.

Secured-core will now be expanded to reach Windows Server, Microsoft Azure Stack HCI, and Azure-certified IoT devices.

Businesses can search for Secured-core servers in the Azure Stack HCI and Windows Server online catalogues. There are currently four all-HPE products that run Azure Stack HCI and 42 options from a variety of vendors that meet the Windows Server spec.

All servers come “fully equipped with industry-leading security mitigations built into the hardware, firmware, and the operating system to help thwart some of the most advanced attack vectors,” Microsoft said.

Secured-core servers are built around three distinct security pillars:

1. To protect the server infrastructure with a hardware-based root of trust
2. To defend sensitive workloads against firmware-level attacks
3. To prevent access and the execution of unverified code on the systems

“Partnering with leading original equipment manufacturers (OEMs) and silicon vendors, Secured-core servers use industry-standard hardware-based root of trust coupled with security capabilities built into today’s modern central processing units (CPUs),” said Microsoft in a blog post.

“Secured-core servers use the Trusted Platform Module 2.0 and Secure boot to ensure that only trusted components load in the boot path.”

It’s thought the new hardware will help tackle specific parts of ransomware attacks and help detect intrusions earlier, with the hope that attacks can be mitigated before any real damage is done.

Microsoft used a typical REvil ransomware kill chain as an example. REvil was one of the most prolific ransomware gangs of 2021 before it shuttered following a string of arrests of alleged REvil associates.

Using the kill chain used by REvil on Kaseya earlier this year, Microsoft explained that certain features in Secured-core servers like Hypervisor-protected Code Integrity (HVCI) can block drivers that tamper with the kernel, like with Mimikatz, via a code integrity security policy.

By preventing credential theft, an early stage of the ransomware kill chain, Microsoft said Secured-core server can make it very difficult for attackers to move laterally around a potential victim’s network.

“Continuing to raise the security bar for critical infrastructure against attackers makes it easier for organisations to meet that higher bar, which is an important priority for both customers and Microsoft,” said Microsoft.

“Successfully protecting systems requires a holistic approach that builds security from the chip to the cloud across hardware, firmware, and the operating system.”

Microsoft debuted the Secured-core initiative in 2019 on Windows PCs which saw computers ship with enhanced security measures at the hardware level.

The machines were designed for business use, with the financial services and healthcare industries targeted specifically, as well as anyone working in a high-value-data role such as in government.

Chinese hackers have attacked IT companies and defense contractors using a zero-day elevation-of-privilege exploit, according to security researchers.

Researchers at Kaspersky said an APT group exploited a zero-day vulnerability in the Windows Win32k kernel driver to develop a new RAT trojan. This exploit had many debug strings from an older, officially known exploit for the CVE-2016-3309 vulnerability. The malware, dubbed MysterySnail, was found on several Microsoft servers between August and September 2021.

The privilege escalation exploit used to develop the MysterySnail RAT targets Windows client and server versions, from Windows 7 and Windows Server 2008 to the latest versions, including Windows 11 and Windows Server 2022. Kaspersky reports that zero-day exploit also targets Windows client versions, however, it was only discovered on Windows Server systems.

Researchers said the root cause of this vulnerability lies in the ability to set user-mode callbacks and execute unexpected API functions during the execution of those callbacks. The bug was triggered when the function ResetDC is executed a second time for the same handle during the execution of its own callback, said researchers.

The uncovered code similarity and the reuse of the Command and Control (C&C) infrastructure led researchers to connect these attacks to the IronHusky cyber espionage group and Chinese-sourced APT activity dating back to 2012.

Kaspersky first spotted the Chinese hacking group IronHusky by in 2017 as part of an investigation into a campaign targeting Russian and Mongolian government entities, airlines, and research centers. A year later, Kaspersky's investigators discovered that Chinese hackers began exploiting the CVE-2017-11882 vulnerability, a memory corruption vulnerability in Microsoft Office, to spread RATs commonly used by Chinese groups, including PlugX and PoisonIvy.

By analyzing the malware payload used with the zero-day exploit in MysterySnail, Kaspersky researchers found hacker used variants of this malware in widespread espionage campaigns against IT companies, military, defense contractors, and diplomatic entities. The malware collects and steals system information from compromised computers before contacting the command-and-control server for further commands.

The RAT can execute various commands on infected machines, such as running new processes, interrupting processes, and more. Researchers said the malware itself is not very sophisticated and has functionality like many other remote shells.

“But it still somehow stands out, with a relatively large number of implemented commands and extra capabilities like monitoring for inserted disk drives and the ability to act as a proxy,” said Kaspersky researchers Boris Larin and Costin Raiu.

The vulnerability identified as CVE-2021-40449 was fixed by Microsoft as part of this month's Patch Tuesday.

Microsoft has issued a warning that hackers are exploiting a Windows Server system vulnerability that provides access to an organisation's active directory domain controller.

The tech giant said it was actively tracking hackers using the 'Zerologon' bug, which it said had been incorporated into attacker playbooks.

Zerologon has appeared in downloadable forms on the internet since it was first spotted by Dutch security firm Secura on 14 September. It is an exploit of Netlogon, the protocol used by Windows systems to authenticate against a Windows Server running as a domain controller. With it, hackers can take over the domain controller and, in turn, a company's internal network.

The warning comes just days after the US Cybersecurity and Infrastructure Security Agency (CISA) issued a directive, urging government agencies to immediately apply the Windows Server August 2020 security update to all domain controllers by 21 September.

CISA said that the bug poses "an unacceptable risk" and requires "immediate action", rating it the highest possible score of 10.0 on the CVSS scale of severity.

"Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon," the tech giant warned in a tweet. "We have observed attacks where public exploits have been incorporated into attacker playbooks.

"Microsoft 365 customers can refer to the threat analytics report we published in Microsoft Defender Security Center. The threat analytics report contains technical details, mitigations, and detection details designed to empower SecOps to detect and mitigate this threat."

Researchers have dubbed the vulnerability Zerologon as it allows hackers with minimal access to a network to login to its Active Directory simply by sending a string of zeros in messages that use the Netlogon protocol.

It's said to affect Windows Server versions from 2008 up to 2019.

Microsoft has given some breathing room to organisations running older versions of Windows 10 by delaying final security updates due to be released over the next few weeks.

Businesses running Windows 10 version 1709 Enterprise, Education and IoT Enterprise, as well as Windows 10 version 1809 Home, Pro, Pro Education, Pro for Workstations and IoT Core, must no longer imminently update their systems.

The final security update for the former will now be released on 13 October, instead of its initially scheduled date of 14 April. The latter version meanwhile will see its final security update released on 10 November instead of 12 May.

These changes are being made in light of the coronavirus pandemic, which has caused an untold level of disruption, with many businesses migrating their workforce to remote working patterns.

“Microsoft has been deeply engaged with customers around the world who are impacted by the current public health situation,” a Microsoft update said.

“As a member of the global community, we want to contribute to reducing the stress our customers face right now. To that end, we have delayed the scheduled end of support and servicing dates for the following products to help people and organizations focus their attention on retaining business continuity.”

These versions of Windows 10 were no longer meant to be supported through the rest of 2020 and beyond, with Microsoft keen to encourage businesses to stay up-to-date with the latest iteration of its flagship OS.

The reality, for many businesses, is that it’s more difficult in practice staying up-to-date to this degree. Moreover, it’s often undesirable, considering seasonal updates such as these being phased out are afflicted with bugs that need patching shortly after release.

Microsoft is also pausing feature updates for Home and Pro editions running on version 1809, with the rollout process restart being closely monitored in advance of the 10 November end of service date.

Windows Server version 1809, Datacentre and Standard editions will see final security updates delayed to 10 November from 12 May as well. SharePoint Server 2010, SharePoint Foundation 2010 and Project Server 2010 were expected to reach their end-of-service dates on 13 April, moreover, although final security updates will now be released on 13 October.

There were also a couple of applications due no longer be supported by Microsoft, with their final update dates also pushed back. The final release for the Dynamics 365 Customer Engagement web client, for example, has been delayed to December 2020, with updates paused for Dyanimcs 365 Finance, Supply Chain Management and Commerce customers for an extended period of time.

Microsoft has also postponed the disablement of Basic Authentication in Exchange Online for those still actively using it, until the second half of 2021.

The likes of Exchange Server 2010, Office 2010, Project 2010, Office 2016 for Mac and Office 2013 connectivity to the Office 365 services have been unaffected in this update. The end-of-support date for these packages will remain the same as they were.

Microsoft has been making tweaks to the way it delivers software and updates in light of the coronavirus pandemic, with a view to reducing the burden on itself as well as its customers. Windows development, for example, was put on lockdown last month, with developers only working to release the most essential security updates from May 2020.

Microsoft accidentally released information on a critical flaw embedded in its Server Message Block 3.0 (SMBv3) network communications protocol ahead of schedule, coinciding with more than a hundred Patch Tuesday fixes.

Details of the wormable vulnerability, which has been reserved CVE-220-0796, were disclosed publicly shortly after Microsoft prematurely informed security vendors of the bug through its Active Protections Program scheme. This early-access information, however, was retracted shortly after.

Attackers can exploit the remote code execution vulnerability found in SMBv3 by sending a specially-crafted packet to the targeted SMBv3 server - to which the hacker must already be connected to.

Vulnerable operating systems include Windows 10 1903 and 1909 for 32-bit, x64-bit and ARM64-based systems, as well as Windows Server versions 1903 and 1909.

Security firm Fortinet has suggested the vulnerability is due to an error when the software handles any maliciously crafted data packet, which can lead to hackers gaining full control of a vulnerable system. It’s considered ‘wormable’ as it's believed an attacker could easily move from device to device.

Both Fortinet and Cisco Talos have recommended that users disable SMBv3 compression and block TCP port 445 on firewalls and client computers.

After the details became public, Microsoft released its own security advisory suggesting the company was aware of the flaw, although official mitigation has not yet been identified.

“To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server,” the advisory said.

“To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.”

Microsoft confirmed a workaround that involves disabling SMBv3 compression using a PowerShell command may be deployed, although the firm added this does not prevent exploitation of SMB clients.

Details of the vulnerability were made public just as Microsoft released fixes for 117 flaws in various systems, including 25 vulnerabilities considered critical, as part of its routine Patch Tuesday round of fixes.

Three Microsoft Windows Server 2008 R2 editions EOS came up in January 2020. By now, companies should have already migrated to a new server such as Microsoft Windows Server 2016 or Windows Server 2019. Those who haven’t need to urgently make their move.

These organisations must decide whether to attempt installing this new OS on their existing servers, build new servers to support the upgrade, or purchase new hardware from an OEM vendor to ensure the best results for the updated OS.

This whitepaper looks at the different considerations IT decision makers face in making the upgrade to Microsoft Windows Server 2019, and how to decide which option is best for their organisation. Download it now to beat the EOS clock.

Dell recommends Windows 10 Pro for business.

Learn more about Dell Technologies solutions powered by Intel®

When we think about our local council, the chances are we think about the everyday services they provide street cleaning, social care, planning, that kind of thing.

Underpinning these services is an administrative system built on technology architecture that needs to run smoothly, be secure, and be well maintained if it's to provide the level of service citizens expect at a price that's affordable.

Thirty-seven attacks every minute

Research from IT service provider Comparex recently revealed that nearly half of all councils in England are still reliant on server software that is no longer officially supported by its vendor.

The research found that 24% of councils were still running Windows Server 2000 or Windows Server 2003, support for which ended in 2010 and 2015 respectively, while 38% were running Microsoft SQL Server 2005, which hit end-of-life in 2016. In total, it was found that 46% of councils reported using one or more of these products, and therefore running critical infrastructures that could be vulnerable to attacks, breakage and general inefficiency. That's particularly alarming given the surge in the number of attacks targeting the public sector over the past few years.

Comparex found that 94% of councils running Windows Server 2000 or Windows Server 2003 planned to upgrade within the next two years and 88% of those running Microsoft SQL Server 2005 had plans to upgrade in next couple of years. As custodians of vast amounts of public data, that's certainly a step in the right direction, but, if we're also to account for delays or technical teething problems in the upgrade process, its still gives plenty of time for flaws to emerge.

It was recently discovered that UK local authorities have faced more than 98 million cyber attacks over the past five years, according to data gathered by Big Brother Watch using Freedom of Information requests. That equates to at least 37 attempted breaches every minute, and at least one in four of these attempts resulted in an actual breach during the 2013 to 2017 period.

Security still isn't a priority

Coming up with an upgrade plan is difficult enough, but actually beginning the process is another beast entirely. James Moar, senior analyst at Juniper Research tells Cloud Pro that security is still seen as an afterthought, particularly at a time of dwindling budgets.

"Councils, like many businesses, are still likely to see security as an additional cost, rather than a necessity," says Moar. "While the GDPR and other recent legislation has highlighted the need to more tightly control access to data, this is unlikely to cause councils to rethink their whole information security posture."

The problem is compounded by the fact Microsoft's upgrading process isn't exactly user-friendly. "So far as I'm aware, there's no direct upgrade route from Windows Server 2000 to Windows Server 2012," explains Richard Edwards, IT research analyst at Freeform Dynamics. "So, the only option would be to upgrade to Windows Server 2003 and then to Windows Server 2012. That's not a good use of anyone's time."

"There are, of course, alternatives to upgrading," adds Edwards. "A Windows file server can be replaced by an appliance or cloud storage services. Databases can be consolidated or considered for replacement by other SaaS applications. There are many options to look at."

Trusting third-party providers

The problem councils face is finding the best route through budgetary constraints to a back-end system that's as secure as it can be, that meets the requirements of GDPR and other legislation, and that's able to be kept up to date in a cost-efficient way.

"GDPR encourages best practice, but policies themselves don't keep hackers out," says Edwards. "IT departments may have expertise in running old systems, and they may have mitigations in place to address hardware failure, but it's not good business to run any business on unsupported systems."

In response to the report, Georgina Maratheftis, programme manager for Local Government at techUK tells us that cyber security "must be taken seriously by everyone in councils, not just the IT and cyber team".

"If anything, the General Data Protection Regulation (GDPR) should be an opportunity for councils to build a culture of data trust and review current cyber security procedure and training.

Understandably councils continue to face financial pressures and constraints, but they should weigh up the long-term and reputational costs if they do not act now."

One solution is for councils to look to cloud providers for alternatives, particularly as technologies like virtualisation help not only cut down on the costs of running infrastructure, but is also far more efficient than housing physical servers on-premise. This, of course, would require a great deal of decommissioning on behalf of the councils, and they may be reluctant to break from tradition and hand over the management of systems to a third-party.

"There's still the issue of out-of-date software," explains Edwards. "SaaS solutions are available to meet an unimaginable range of business requirements. These should be investigated, and where existing SaaS platforms are in use, consider how they might feature as part of a re-platforming strategy."

Unfortunately, recent research by Citrix revealed that a staggering 80% of councils are still reliant on on-premise architecture. Some experts claim that many authorities are facing difficulty securing buy-in from senior leadership, particularly when it comes to alleviating fears over changing workplace cultures or the greater demand a move may have on employee skill sets.

Inaction is not an option

Given the access that local councils have to public data, doing nothing is not really an option even if the current budgetary climate is forcing authorities to make drastic cutbacks.

As James Moar of Juniper Research explains, councils need to "be aware of penalties for non-compliance with data handling and data security regulations. While the costs of a rigorous cybersecurity posture may seem large, the penalties and PR fallout are likely to be much larger."

"To not be worried about attacks in the current climate is to be nave about cybersecurity," he adds. "While the benefit of an attack may not be immediately obvious to potential targets, that does not mean they will not be targeted."

Microsoft's current preview of Windows Server 2016 is set to expire in just over a week, with no replacement due until May.

Windows Server Technical Preview was made available last October, but will stop working on April 15, with the next preview only scheduled for release at some point next month.

The Redmond giant said in a blog post that it will deliver an interim solution for customers wanting to continue using the preview, but with the expiry just eight days away, it may be a close run thing.

Exactly what improvements will be available in the second preview of Server 2016 are currently a mystery, but the preview was delayed from a slated January release to make room for significant changes.

This news broke shortly before a leaked Redmond presentation revealed Microsoft's working on a "Nano server" based on a Cloud OS infrastructure.

The virtualised nano server is aimed at letting IT admins deploy a lightweight server infrastructure, and the slides describe it as the "future nucleus" of Windows Server.

Whether or not Microsoft is far enough along the nano server track to make any of its features available in the latest Server 2016 preview remains to be seen, however.

The next iteration of Windows Server won't be released until next year, meaning it's not an option for those migrating from Server 2003, due to expire on 14 July 2015.

IT community Spicework's recent special report, The Great IT Upgrade, suggests that 48 per cent of 1,300 Server 2003 users are in the process of migrating, with 15 per cent already on another OS.