cyber.hendryadrian.com
Security News · bleepingcomputer.com

Microsoft Confirms April Windows Updates Block Driver Used by Backup Apps

· Original article ↗

Summary

Microsoft says April 2026 updates block psmounterex.sys to mitigate CVE-2023-43896, causing some VSS-based backup apps to fail when mounting or browsing images. It recommends updating affected apps rather than pausing the Windows update.

Key points

  • The April 2026 Windows updates add the vulnerable kernel driver psmounterex.sys to Microsoft’s Vulnerable Driver Blocklist.
  • Backup applications using VSS snapshots, including products from Macrium, Acronis, UrBackup, and NinjaOne, may fail to mount or browse backup images on Windows 10, 11, and Server.
  • Backup creation may still succeed, while mounting or restoring images can fail with VSS timeouts or VSS_E_BAD_STATE errors.
  • Microsoft says the block mitigates CVE-2023-43896, a buffer overflow that can enable privilege escalation or arbitrary code execution.
  • Admins can check the Code Integrity Operational log for Event ID 3077 and the specified policy ID to identify a blocked driver.
  • Microsoft recommends installing updated backup application versions with newer drivers and advises against uninstalling or pausing the Windows update.

Article Details

Event Type
Windows security update compatibility issue caused by a vulnerable driver block
Impact
The April 2026 Windows security updates block psmounterex.sys to mitigate CVE-2023-43896. Backup applications that rely on the driver may fail to mount or browse backup images, and image restores may fail or time out; full image backup creation may still succeed. Microsoft recommends updating affected applications to versions with newer drivers rather than uninstalling or pausing the Windows update.

CVE

CVE-2023-43896Macrium · ReflectThe hardening addresses CVE-2023-43896, and Microsoft urges customers to install updated application versions with newer drivers instead of uninstalling or pausing the update.

Vendors

AcronisBackup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.MacriumBackup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.MicrosoftMicrosoft confirms the April 2026 security updates have added the kernel driver psmounterex.sys to the Vulnerable Driver Blocklist, causing third‑party backup applications that use VSS snapshots to fail to mount orNinjaOneBackup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.UrBackupBackup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.

Products

Acronis Cyber Protect Cloudimpacted by this includes, but is not limited to, products from Macrium (Reflect), Acronis (Cyber Protect Cloud), UrBackup Server, and NinjaOne Backup running on Windows 11, Windows Server, and Windows 10Macrium ReflectSoftware impacted by this includes, but is not limited to, products from Macrium (Reflect), Acronis (Cyber Protect Cloud), UrBackup Server, and NinjaOne Backup running on Windows 11, Windows Server, and Windows 10NinjaOne Backupnot limited to, products from Macrium (Reflect), Acronis (Cyber Protect Cloud), UrBackup Server, and NinjaOne Backup running on Windows 11, Windows Server, and Windows 10 devices.UrBackup Serverincludes, but is not limited to, products from Macrium (Reflect), Acronis (Cyber Protect Cloud), UrBackup Server, and NinjaOne Backup running on Windows 11, Windows Server, and Windows 10 devices.Windows 10Backup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.Windows 11Backup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.Windows ServerBackup software using VSS snapshots (e.g., Macrium, Acronis, UrBackup, NinjaOne) may fail to mount or restore images on Windows 10, Windows 11, and Windows Server.

Related Articles