New Vulnerability Emerges from Microsoft Windows Update

Microsoft's latest update aimed at addressing a security flaw has inadvertently introduced a new vulnerability within its Windows operating systems. The update, intended to prevent potential exploitation by attackers, has resulted in the creation of a folder named 'inetpub' on the system drive, revealing a security oversight.

This issue was highlighted by an IT security expert who documented his findings in a recent blog post. The patch, released during the April Patch Tuesday cycle, addresses a specific vulnerability identified by the CVE reference CVE-2025-2104. This vulnerability relates to an improper handling of shortcut links, which now poses a risk of being misused.

Since the introduction of 'Junctions' in Windows 2000, users have had the ability to create directory aliases, allowing one folder to redirect to another. For instance, a directory like 'D:\Win' can point to 'C:\Winnt\System32', enabling indirect access to various system files. The expert noted that even non-administrative users can create such junctions on the primary drive, which raises concerns.

A specific command can be executed to create a junction that links 'notepad.exe' to the 'inetpub' directory. Should this junction be established, the installation of the latest Windows updates is likely to fail, leading to a potential rollback of the update process. Consequently, this could leave users without crucial security patches, which malicious actors might exploit. The expert reached out to Microsoft regarding these concerns two weeks prior but reported a lack of response.

Recently, the appearance of the 'C:\inetpub' folder has been observed on systems that had not previously hosted a Microsoft web server (Internet Information Services, IIS). Microsoft has stated that this folder should not be deleted, regardless of whether IIS is activated on the device, claiming that this behavior is part of enhancements aimed at improving security. They asserted that no action is required from IT administrators or end-users.