Microsoft’s Security Patch Introduces New Denial-of-Service Vulnerability
A recent security update from Microsoft, aimed at fixing a critical privilege escalation flaw, has unexpectedly opened the door to a new and serious vulnerability.
The patch, meant to address CVE-2025-21204, now enables non-administrative users to effectively prevent future Windows security updates, resulting in a denial-of-service (DoS) condition. This incident underscores the inherent complexity of securing large-scale operating systems and the ongoing risk of unintentionally introducing new flaws while patching old ones.
Background: The Symlink Vulnerability and Microsoft’s Fix
In April 2025, Microsoft released a fix for CVE-2025-21204 — a privilege escalation vulnerability rated “Important” with a CVSS 3.1 score of 7.8. The issue stemmed from improper handling of symbolic links (symlinks) in the Windows Update Stack, which could allow a local attacker with limited access to gain elevated privileges.
To mitigate the flaw, Microsoft’s update automatically creates a directory named inetpub on the system drive of all Windows machines, regardless of whether Internet Information Services (IIS) is installed. The company specifically cautioned users not to delete this folder, as it plays a critical role in the updated security logic.
The Emerging Threat: A New DoS Vector
Security researcher Kevin Beaumont has revealed that this well-intentioned fix introduces a new vulnerability — one that allows any user, including those without administrative rights, to break the Windows update mechanism entirely.
By using a basic command-line operation, a non-admin user can create a junction point — a kind of file system redirection — targeting the inetpub folder. This manipulation corrupts the update process, blocking future security patches.
“Non-admin (and admin) users can create junction points in C:,” Beaumont noted in his findings. Exploiting the vulnerability requires only basic user privileges and simple command-line access — no advanced tools or permissions needed.
The exploit involves creating a symbolic link between the protected inetpub directory and a critical system file, effectively rendering the update system non-functional.
Exploiting the Fix: How a Simple Junction Blocks Windows Updates
The vulnerability hinges on a simple command that creates a junction, redirecting C:\inetpub to an unrelated application — such as Notepad. Once this redirection is in place, Windows Update fails to interact properly with the folder, triggering errors that cause updates to fail or revert.
“After that point, the April 2025 Windows OS update (and future updates, unless Microsoft fixes it) fail to ever install — they error out and/or roll back. So you just go without security updates,” explained researcher Kevin Beaumont.
What makes this flaw particularly troubling is that it requires no administrative access. On many systems with default configurations, standard users can create these junction points — effectively blocking system-wide updates without elevated privileges.
This isn’t just a one-time disruption. The denial-of-service effect is persistent. Once established, the issue remains in place indefinitely, unless the junction is manually removed or the system is reinstalled.
Security experts are raising alarms over how easily this could be weaponized. A simple script or piece of malware could deploy the exploit at scale, leaving countless machines unpatched and exposed to further vulnerabilities.
Beaumont disclosed the issue to Microsoft’s Security Response Center roughly two weeks ago but, as of writing, has not received a response. In the meantime, system administrators are urged to proactively monitor for suspicious junctions on the system drive — particularly any involving the inetpub directory.
