• Thread Author
Microsoft has released KB5066360, a targeted hotpatch for Windows PowerShell that corrects an interoperability and security regression affecting PowerShell Direct (PSDirect) when host and guest virtual machines are unevenly patched; the update is a no-restart hotpatch for eligible systems and raises the OS build to 26100.6569 on affected SKUs. (support.microsoft.com)

Background​

PowerShell remains a core administration and automation runtime on Windows, and PowerShell Direct (PSDirect) is the specific channel Hyper‑V hosts use to connect into guest VMs without network connectivity. In September 2025 Microsoft shipped a set of hotpatch and cumulative updates that inadvertently introduced an edge case: when a patched guest attempts to connect to an unpatched host (or vice versa), the expected legacy handshake fallback could fail intermittently and leave sockets uncleared. That symptom often shows as authentication failures (Event ID 4625) in the Security event log. Microsoft published KB5066360 as the corrective hotpatch. (support.microsoft.com)
Hotpatching is a Microsoft mechanism intended for managed enterprise devices that need fast, security-only fixes without interrupting operations with a restart. It patches in-memory code paths and is offered on eligible Windows Server and Windows 11 Enterprise editions enrolled and configured for hotpatch delivery. Hotpatch packages are intentionally small and narrowly scoped to security fixes so administrators can reduce the time systems remain exposed to a vulnerability. The hotpatch program has a scheduled cadence (baseline months and hotpatch months) and specific eligibility criteria documented by Microsoft. (learn.microsoft.com)

What KB5066360 delivers​

High-level summary​

  • Applies to specific hotpatch-capable SKUs (examples documented by Microsoft include Windows 11 Enterprise LTSC 2024 and Windows Server 2025 Datacenter: Azure Edition); the package raises the reported OS Build to 26100.6569 on affected devices. (support.microsoft.com)
  • Release date: September 9, 2025 (hotpatch release distributed via Windows Update to eligible devices). (support.microsoft.com)
  • Primary fix: “Fix for PSDirect connections failing in Hotpatch devices.” The KB describes this as resolving a host‑to‑guest vulnerability window and improving reliability of older sessions that may shut down unexpectedly. (support.microsoft.com)

Files and versions​

The KB lists updated PowerShell binaries and resources with file versions 10.0.26100.6569 and timestamps (file list shows a 22‑Aug‑2025 file timestamp in the KB file table). The explicit file names include System.Management.Automation.dll, Microsoft.PowerShell.ConsoleHost.dll and multiple resource DLLs. Administrators should use these file version values as inventory verification after deployment. (support.microsoft.com)

What it does not include (important caveat)​

Microsoft’s public hotpatch KB text provides a functional description of the fix but does not enumerate a CVE identifier in the KB article itself. Administrators who require CVE mapping for compliance or ticketing should consult the Microsoft Security Update Guide or MSRC advisory entries for explicit CVE numbers and exploitability guidance. Treat the absence of a CVE in the KB as a documentation gap until confirmed through the Security Update Guide.

Technical analysis — the PSDirect handshake regression​

How PSDirect normally works​

PSDirect allows an administrator or automation service on the Hyper‑V host to establish a remote PowerShell session directly into a guest VM using integration channels rather than network-based remoting. That host‑to‑guest handshake supports legacy fallback behavior so that when one side is updated and the other is not, the communication can revert to a compatible handshake and cleanly tear down sockets when necessary.

The regression and its consequences​

The September 2025 hotpatch/security update cycle introduced a regression in that fallback mechanism. When the patched side attempted to fall back to a legacy handshake with an unpatched counterpart, the fallback did not always complete correctly; socket cleanup sometimes failed and the connection broke in a way that could surface as Event ID 4625 (authentication failure) in the Security log. In narrow conditions Microsoft indicated the behavior could create an unauthorized, non‑administrator access window during session handling—hence the priority to release a corrective hotpatch. (support.microsoft.com)

Why this matters operationally​

PowerShell is a frequent target in post‑compromise scenarios; vulnerabilities or regressions in host/guest administration surfaces can be abused for lateral movement or escalation. The hotpatch fixes both the security exposure during that brief handshake window and improves session teardown reliability, reducing an operational pain point (intermittent PSDirect failures) that can disrupt management workflows.

Operational impact and who should act​

Affected environments​

  • Hyper‑V hosts and guest VMs where PSDirect is used to administer virtual machines.
  • Mixed estates where hotpatches are applied unevenly (some hosts patched, guests not, or vice versa).
  • Customers using Windows 11 Enterprise LTSC 2024 and hotpatch‑capable Windows Server SKUs that report builds in the 26100 series should prioritize verification. (support.microsoft.com)

Priority for deployment​

  • If you operate Hyper‑V hosts that perform PSDirect-based management of guests, prioritize host updates and ensure guest parity. Microsoft explicitly recommends applying the hotpatch to hosts whose guests have received the September 2025 hotpatch or cumulative updates. (support.microsoft.com)
  • For production critical systems, use a staged rollout with a pilot group, early‑adopter ring, and then broader deployment. Track errors in the Security event log and virtualization subsystem logs for PSDirect handshake anomalies.

Hotpatch eligibility and delivery channels​

  • Hotpatch packages are typically delivered via Windows Update for hotpatch‑enrolled, eligible devices; in many cases Microsoft bundles the servicing stack update (SSU) to improve installation reliability. WSUS/MSU/catalog distribution may vary by SKU and channel—hotpatching is delivered automatically only to devices that meet prerequisites. Confirm your enrollment and baseline alignment before expecting the no‑restart delivery. (learn.microsoft.com)

Deployment checklist and step‑by‑step recommendations​

Pre‑deployment (inventory and testing)​

  • Inventory where PSDirect is used and list host/guest pairs; prioritize pairs where either side is hotpatched or pending updates.
  • Confirm device eligibility for hotpatch (baseline build, licensing, VBS/enrollment requirements for your environment). Use winver or inventory tools to validate build values (target 26100.6569 once KB5066360 installs). (learn.microsoft.com)
  • Identify third‑party agents (EDR, backup, monitoring) and vendor drivers that hook into PowerShell or virtualization subsystems; coordinate vendor testing because hotpatches modify in‑memory code paths.

Pilot and validation​

  • Choose a pilot ring representing typical hardware, firmware, and agent combinations.
  • Apply KB5066360 to hosts in the pilot ring first. Validate that guests are also updated or will be updated promptly.
  • Validate PSDirect scenarios: connect from host to guest and from guest to host where applicable; monitor Security event logs, Hyper‑V logs, and EDR telemetry for regressions. Look specifically for Event ID 4625 and socket cleanup errors.

Production rollout​

  • Expand to early adopter ring only after 48–72 hours of no regression incidents.
  • Apply monitoring rules and SIEM correlations to detect unexpected PowerShell or firewall changes, and maintain an incident‑response playbook for rapid rollback or remediation.

Post‑deployment verification​

  • Confirm updated build values in inventory and CMDB tools; map hotpatched KB numbers and build versions to “patched” status so compliance scanners do not misreport. Hotpatch updates can change reported build numbers in subtle ways—update asset management rules accordingly.

Monitoring, telemetry and forensic indicators​

  • Watch for Event ID 4625 in the Security log correlated to PSDirect session timestamps. This event was specifically called out in Microsoft’s known‑issue description for the September packaging and is a key signal to validate the fix. (support.microsoft.com)
  • Configure EDR to capture process creation (Event ID 4688), firewall rule changes (Event IDs 4946/4947), and service state changes for Windows Firewall and PowerShell processes. Correlate these to hotpatch install times.
  • Tune alerts for false positives: hotpatches can alter in‑memory code paths in ways that some security agents interpret as anomalous — baseline telemetry prior to deployment reduces noisy alerts post‑install.

Benefits of the hotpatch model — and tradeoffs​

Strengths​

  • Reduced downtime: hotpatches install without immediate restart on eligible systems, decreasing operational disruption and shortening the exposure window for security issues. (learn.microsoft.com)
  • Targeted scope: hotpatches are security-only and narrow in scope, which simplifies testing and reduces the likelihood of broad regressions tied to feature or bug‑fix payloads.
  • Faster mitigation: for a host‑to‑guest handshake vulnerability, the ability to activate the fix without a full reboot materially reduces the moment-of-exposure for critical infrastructure.

Tradeoffs and risks​

  • Eligibility friction: hotpatching requires enrollment, licensing, baseline alignment and sometimes platform-specific configuration; mixed estates that can’t enroll will still need baseline LCUs (which require restarts), complicating parity. (learn.microsoft.com)
  • Compatibility risk with agents/drivers: in‑memory hotpatches can conflict with hooking behavior in EDR, backup, or virtualization extensions; thorough vendor testing is essential before broad rollout.
  • Rollback complexity: while hotpatches can be uninstalled, rollback typically requires a restart and may leave devices in an unexpected servicing state; test rollbacks in your lab before relying on them in production.
Independent press and community coverage of hotpatching corroborates the operational benefits and the need for cautious rollout planning; outlets covering Microsoft’s hotpatch program noted both the reduced restart cadence and the importance of vendor compatibility testing. (bleepingcomputer.com)

Practical commands and quick checks​

  • Verify installed HotFix/KBs on a device (example):
  • wmic qfe get HotFixID,Description,InstalledOn
  • Or check Windows Update history and inventory tools that report combined SSU + LCU packages.
  • Validate the running build after applying the hotpatch:
  • Run winver or use: [PowerShell] (Get‑ComputerInfo).OsBuildNumber (confirm 26100.6569 where applicable). The KB lists the post‑install OS build value for inventory verification. (support.microsoft.com)
  • Search the Security Event Log for PSDirect handshake problems:
  • Use Event Viewer or PowerShell to filter for Event ID 4625 around PSDirect session times. (support.microsoft.com)

Secure Boot certificate advisory — separate but urgent​

KB5066360 includes a reminder about a separate operational program: Secure Boot certificates used by many Windows devices begin expiring starting in June 2026, and administrators must coordinate firmware/OEM and update deployment to avoid secure‑boot disruptions. This advisory is not part of the PSDirect fix but is an operationally significant reminder that requires cross‑team planning (firmware, OEM, IT asset management). Start inventorying firmware readiness and plan DB/KEK update tests now. (support.microsoft.com)

Recommendations — concise action plan​

  • Inventory hosts and guests that use PSDirect and flag host/guest pairs for parity updates.
  • Confirm hotpatch eligibility and enrollment for devices you want to protect with no-restart delivery. (learn.microsoft.com)
  • Pilot KB5066360 in a small, representative ring; validate PSDirect scenarios, Event ID 4625 absence, and agent compatibility for 48–72 hours.
  • Expand rollout in staged rings, update CMDB and compliance scanners to recognize hotpatched build values, and coordinate with virtualization and backup vendors.
  • For compliance teams requiring CVE mapping, request explicit CVE identifiers from the Microsoft Security Update Guide or MSRC; do not assume KB text is exhaustive.

Final assessment​

KB5066360 is a narrowly scoped, operationally important hotpatch that corrects a PSDirect handshake regression with concrete, readily verifiable indicators (build numbers and file versions). It demonstrates the value of hotpatching for fast, low‑disruption security remediation in managed enterprise environments. However, hotpatch adoption still carries real operational tradeoffs: enrollment and baseline prerequisites, the need to update asset management and compliance tooling to recognize hotpatched states, and the ever‑present possibility of agent/driver incompatibilities when in‑memory code paths are altered.
Administrators running Hyper‑V and managing PSDirect‑dependent workflows should treat KB5066360 as a priority for eligible hosts and ensure guest parity. At the same time, plan a staged rollout with vendor testing and clear rollback procedures, and request CVE mapping if your audit processes require explicit vulnerability identifiers.

KB5066360 demonstrates the operational tradeoffs Microsoft intends with hotpatching: faster, lower‑impact fixes for critical security issues, balanced by a need for careful deployment discipline in mixed or heavily instrumented environments. Applying the update promptly, validating PSDirect behavior, and aligning host/guest patch levels will reduce exposure and restore reliable host‑to‑guest management on affected systems. (support.microsoft.com)

Source: Microsoft Support KB5066360—Security Update for Windows PowerShell (Hotpatch) - Microsoft Support
 
Microsoft has released KB5066360, a targeted hotpatch for Windows PowerShell that addresses PowerShell Direct (PSDirect) connectivity failures and a narrow host‑to‑guest exposure introduced by the September 2025 security/hotpatch cycle; the package updates PowerShell assemblies to OS Build 26100.6569, installs via Windows Update for eligible devices, and is distributed with the servicing stack update (SSU) to improve installation reliability. (support.microsoft.com)

Background / Overview​

Hotpatching is Microsoft’s mechanism to deliver security-only, in-memory fixes to eligible enterprise devices without forcing the usual immediate reboot associated with cumulative updates. It is intended for managed estates that require high availability and fewer reboots; devices must meet specific prerequisites (baseline build alignment, licensing, virtualization‑based security enabled, Intune/management enrollment, and platform‑specific flags such as CHPE handling on Arm64) to receive hotpatch updates. The hotpatch model reduces the exposure window for urgent fixes but requires additional operational discipline for inventory and compatibility checks. (bleepingcomputer.com)
KB5066360 was published on September 9, 2025 and is framed as a security update for Windows PowerShell (Hotpatch). Microsoft’s KB entry explicitly lists the improvement as a “Fix for PSDirect connections failing in Hotpatch devices,” and the package includes updated PowerShell binaries (System.Management.Automation.dll and related assemblies) with file versions stamped at 10.0.26100.6569. Administrators should expect this patch to be pushed via Windows Update for eligible devices; the KB also notes inclusion of the latest SSU where Windows Update is used. (support.microsoft.com)

Why this patch matters: the PSDirect context​

PowerShell Direct (PSDirect) is a host‑to‑guest management channel used primarily in Hyper‑V and similar virtualization environments to run PowerShell commands against VMs from the host without network connectivity. Because PSDirect operates across host and guest boundaries, any regression or vulnerability in that surface can have outsized operational and security impact—especially as attackers often rely on local or chained access to escalate privileges or move laterally.
The September 2025 cumulative/hotpatch cycle introduced an edge case where a patched guest and an unpatched host (or vice‑versa) could fail to fall back to the legacy handshake during PSDirect connection setup. The failed fallback occasionally produced socket cleanup/rejection issues and could log Event ID 4625 in Security logs; in very narrow conditions Microsoft describes the behavior as exposing a brief window where unauthorized, non‑administrator access could occur during handshake/session tear‑down. KB5066360 is Microsoft’s corrective hotpatch for that behavior. (support.microsoft.com)
  • Immediate operational risk: failed PSDirect sessions in automation or recovery workflows.
  • Security risk (localized): a brief, constrained window of unauthorized access under specific host/guest mismatch scenarios.
Both operational and security implications mean this update is relevant to virtualization hosts, orchestration systems, and labs where staggered patching is common.

What KB5066360 contains — technical summary​

The KB itself is deliberately concise (as is typical for hotpatch KBs) and focuses on packaging, file inventory, and a short “Improvements and fixes” note. Key technical points administrators need to record:
  • Applies to: Windows Server 2025 / Windows 11 Enterprise LTSC builds that participate in the hotpatch program (specific SKUs vary by KB entry). (support.microsoft.com)
  • Release date: September 9, 2025. (support.microsoft.com)
  • Target OS Build after install: 26100.6569 (PowerShell assemblies listed as version 10.0.26100.6569). (support.microsoft.com)
  • Distribution channel: Windows Update (hotpatch eligibility required); SSU is bundled when using Windows Update. The KB indicates Windows Update as the primary delivery mechanism for the hotpatch variant. (support.microsoft.com)
  • Improvements: Fix for PSDirect connections failing in hotpatched devices; improves reliability of older sessions and resolves the narrow host/guest access window described in the September updates. (support.microsoft.com)
The KB also includes a file list with timestamps (22‑Aug‑2025) and file sizes—useful for inventory and post‑deployment verification. Administrators should capture and map those file versions in patch tracking systems to confirm the hotpatch was applied. (support.microsoft.com)

Cross‑checks and independent corroboration​

For operational context and to validate the hotpatch model and scope, Microsoft’s KB entry should be considered the authoritative source for packaging and file information. Independent reporting and documentation corroborate the operational model and the urgency of addressing host/guest interoperability issues:
  • Independent coverage of the September 2025 Patch Tuesday and hotpatch releases confirms the presence of hotpatch variants for customers that qualify and highlights the PSDirect interoperability known issue that pointed to KB5066360 as the remedy. (bleepingcomputer.com)
  • Coverage of Microsoft’s hotpatch program, and prior public preview notes, provides background on why organizations prize hotpatch capability for high‑availability workloads. These reports help explain why Microsoft opted to ship a hotpatch rather than wait for the normal reboot‑required LCU cycle. (bleepingcomputer.com)
  • Community and operations analysis (forum and admin previews) emphasize the auditing and inventory consequences of hotpatch build values (e.g., recorded build 26100.6569) and call out recommended remediation steps for mixed host/guest states.
These independent confirmations reinforce the KB summary while adding practical guidance for deployment and verification.

Deployment implications and recommended rollout plan​

Hotpatches minimize disruption but increase the need for precise inventory and staged validation. Below is a recommended, conservative rollout sequence suitable for production estates that use PSDirect or host VMs for automation:
  • Inventory and eligibility check
  • Confirm devices report the baseline hotpatch build prerequisites (use winver or inventory queries). Ensure VBS and device management enrollment settings are met.
  • Confirm licensing eligibility (Windows 11 Enterprise / Windows Server hotpatch licensing per Microsoft’s hotpatch documentation).
  • Pilot (representative subset)
  • Choose a small pilot group of hosts and guests representing critical apps and different hardware vendors.
  • Enable hotpatch policies in Intune/Windows Autopatch for pilot machines if required.
  • Targeted validation
  • Validate PSDirect and PSRemoting scenarios across host/guest pairs in pilot.
  • Monitor Event Viewer for Event ID 4625 and network/socket cleanup anomalies.
  • Validate automation workflows that use PSDirect for configuration or recovery operations.
  • Phased rollout
  • Expand to Early Adopter ring, then to Broad deployment following successful piloting.
  • Maintain vendor coordination for virtualization stack (Hyper‑V, VMM) and backup vendors during rollout.
  • Post‑deployment verification and CMDB updates
  • Verify OS Build reports 26100.6569 on updated hosts/guests and record the hotpatched KB in patching systems.
  • Update compliance tooling and CMDB rules to recognize hotpatched build values so endpoints are not misclassified as unpatched.
Practical notes:
  • The hotpatch will normally install via Windows Update where eligible. If your environment cannot meet hotpatch prerequisites, plan the usual LCU/Restart path instead.
  • Uninstalling combined SSU/LCU packages may require DISM or follow baseline uninstall procedures; ensure rollback procedures are tested. (support.microsoft.com)

Security analysis — scope, severity, and mitigation​

Microsoft’s KB describes the fix as closing a narrow window that could allow unauthorized, non‑administrator access during PSDirect host/guest interaction. The description indicates the issue is contextual (host/guest mismatch and handshake fallback failure) and not a network‑facing remote exploit.
  • Exploitability: Exploitation requires local context (host/guest access or ability to initiate PSDirect), meaning the risk vector is primarily post‑compromise escalation or internal misuse rather than remote attack. Administrators should treat the issue as high operational priority because PSDirect is an elevated remote administration surface.
  • Attack impact: Potential unauthorized access between host and guest could allow lateral movement or privilege escalation depending on the guest/host privilege matrix and the target workloads.
  • Mitigation: Apply KB5066360 to both host and guest VMs in environments using PSDirect as a best practice, apply standard hardening (least privilege, restrict local admin, Hardened Privileged Access Workstations), and enable/verify EDR/AV telemetry for PowerShell and process creation anomalies.
Administrators should also treat the hotpatch as an operational fix that reduces exposure quickly rather than a complete replacement for scheduled baseline servicing windows. Hotpatches shorten the time to protection but do not remove the need for periodic reboots and cumulative servicing.

Known issues, caveats, and compatibility risks​

Microsoft’s broader September 2025 updates included a documented interoperability issue where PSDirect connections could fail in mixed patch states; KB5066360 is the corrective hotpatch. However, there are operational and compatibility caveats to consider:
  • Hotpatch eligibility: Not all devices will receive the hotpatch. Devices must be enrolled and configured per Microsoft’s hotpatch prerequisites. Non‑eligible devices must be updated via LCU and reboot cycles. (support.microsoft.com)
  • Vendor compatibility: Hotpatches change in‑memory behavior, which can trigger false positives or functional impacts with security agents, backup software, or virtualization tooling. Test with vendors before mass deployment.
  • Inventory and audit friction: Many compliance tools expect LCU/KB numbers and may not recognize hotpatch build values. Update CMDB rules and compliance dashboards to map hotpatched builds (e.g., 26100.6569) to a compliant state to avoid false negatives.
  • Secure Boot certificate program: KB entries released in this cycle reiterate the separate operational imperative around Secure Boot certificate expirations beginning June 2026. That program can affect firmware trust and pre‑boot updateability and should be on every enterprise roadmap even if it is separate from the PowerShell hotpatch. Plan firmware and OEM coordination now. (support.microsoft.com)
Flag for auditors and compliance teams: Microsoft’s KB for this hotpatch does not enumerate CVE identifiers in the KB narrative. If your audit process requires explicit CVE mapping, consult the Security Update Guide or MSRC advisory for CVE mappings and exploitability data; treat the absence of CVE identifiers in the KB as a documentation gap until confirmed via the Security Update Guide.

Practical verification commands and monitoring checklist​

After deployment, perform these checks to validate health and containment:
  • Confirm OS build: run winver or query inventory for reported build 26100.6569.
  • Verify file versions: check System.Management.Automation.dll and Microsoft.PowerShell.ConsoleHost.dll version 10.0.26100.6569 on updated hosts/guests.
  • PSDirect smoke test: run sample PSDirect session across host/guest pairs to validate handshake success and session stability.
  • Event logs: monitor Security logs for Event ID 4625 and system/network logs for socket teardown anomalies.
  • EDR/AV: baseline typical PowerShell usage and tune EDR rules to avoid noisy false positives triggered by updated in‑memory patches.
Suggested SIEM/EDR alerts to enable:
  • Unexpected PowerShell sessions from non‑privileged accounts.
  • Repeated socket cleanup failures tied to PowerShell processes.
  • Unexpected firewall rule changes or MpsSvc restarts correlated to patch events.

Executive summary for managers and compliance teams​

  • KB5066360 is a narrow, operationally important hotpatch for PowerShell/PSDirect that addresses a host/guest handshake fallback regression introduced in the September 2025 updates. Apply to eligible hosts and guests to restore expected PSDirect behavior and eliminate the brief unauthorized access window described by Microsoft. (support.microsoft.com)
  • Hotpatching reduces downtime and speeds protection, but it requires strict inventory, eligibility verification, and staged testing because not all devices are eligible and some vendor software may react to in‑memory patches. (bleepingcomputer.com)
  • For compliance and auditors: request CVE mapping from Microsoft’s Security Update Guide if CVE identifiers are needed for reporting; the KB text may not contain CVE(s) directly.

Action checklist (concise)​

  • Inventory: Identify hosts/guests that use PSDirect and confirm hotpatch eligibility.
  • Pilot: Apply to a small, representative pilot group (host+guest pairs).
  • Validate: Run PSDirect tests, watch for Event ID 4625 and socket/log anomalies.
  • Rollout: Deploy in phased rings with vendor coordination.
  • Verify: Ensure reports/CMDB map 26100.6569 as patched and archive file version evidence.
  • Prepare: Align Secure Boot certificate rollover plans with firmware/OEM teams (June 2026 program).

Conclusion​

KB5066360 is a narrowly scoped but operationally critical hotpatch that restores reliable PSDirect host/guest behavior and removes a brief exposure window introduced during the September 2025 update cycle. Its delivery as a hotpatch reflects a trade‑off Microsoft elected to make: speed and reduced reboots for eligible enterprise workloads at the cost of tighter operational requirements around inventory, vendor testing, and audit mapping.
Organizations that use PSDirect or run mixed patching schedules must treat this update as a priority for coordinated host/guest deployment, while ensuring their patch management, CMDB, and vendor test plans account for hotpatch semantics and version reporting. Where CVE identifiers are required for compliance evidence, request explicit mappings from Microsoft’s Security Update Guide or MSRC channels because the KB entry itself is intentionally concise and may omit CVE attribution. (support.microsoft.com)
Apply the hotpatch to pilot devices immediately where eligible; validate PSDirect workflows thoroughly; and update audit and inventory tooling so the hotpatched build value (26100.6569) is recognized as a compliant, patched state.

Source: Microsoft Support KB5066360—Security Update for Windows PowerShell (Hotpatch) - Microsoft Support