Microsoft's official 'inetpub' folder lets hackers permanently block Windows updates on PCs

Waiting to hear more about this one.

"For this vulnerability to be exploited, cybercriminals need to gain regular access to a Windows machine...."

OAT said:

"For this vulnerability to be exploited, cybercriminals need to gain regular access to a Windows machine...."

Click to expand...

I read that and my initial thought was "what is regular access?" Physical access or access via electronic means?

Probably they get access with a Trojan horse that user install

i changed all the permissions on that folder that could be changed so no one had access
then i deleted the inetpub folder from all (4) windows systems. it will remain that way.

best of luck, Steve ..

The article cited by ghacks says:

Non-admin (and admin) users can create junction points in c:\

So a non-admin user can just do Windows+R, cmd, and then run:

mklink /j c:\inetpub c:\windows\system32\notepad.exe

This creates a symlink between c:\inetpub and notepad. After that point, April 2025 Windows OS update (and future updates, unless Microsoft fix it) fail to ever install — they error out and/or roll back. So you just go without security updates.

Click to expand...

Which you can do if c:\inetpub doesn't exist. If it does this won't work.

Although the underlying API does allow any user with WRITE_ATTRIBUTES permission to change an existing empty folder, mklink insists on creating a new folder. But if the folder already exists and you don't have WRITE_ATTRIBUTES permissions a special tool still wouldn't help.

If you have admin rights you can already do anything you like. Creating a file in the folder which explained what it was doing and didn't have write or delete permissions for administrators wouldn't stop the determined, but might discourage "clearing up".

So I think we can ignore this. Provided we have the folder there with the forest permissions.

Just another epic failure of MS software engineering

Like everything else that comes along, everyone is getting their panties in a wad and immediately panicking and deleting the folder. If there is a hole caused by the addition of this folder, don't you think it is a top priority with MS to fix the vulnerability. Chill a few days and give them a chance, folks. According to bleepingcomputer, MS has said we should NOT delete the folder.
While Redmond still has to explain why the security updates are creating this folder in the first place, the company updated the advisory for a Windows Process Activation elevation of privilege vulnerability (tracked as CVE-2025-21204) overnight to warn users not to delete the new empty inetpub folder on their hard drives.

source: Microsoft: Windows 'inetpub' folder created by security fix, don’t delete