Microsoft has released KB5066360, a targeted hotpatch for Windows PowerShell that corrects an interoperability and security regression affecting PowerShell Direct (PSDirect) when host and guest virtual machines are unevenly patched; the update is a no-restart hotpatch for eligible systems and raises the OS build to 26100.6569 on affected SKUs. (support.microsoft.com)
PowerShell remains a core administration and automation runtime on Windows, and PowerShell Direct (PSDirect) is the specific channel Hyper‑V hosts use to connect into guest VMs without network connectivity. In September 2025 Microsoft shipped a set of hotpatch and cumulative updates that inadvertently introduced an edge case: when a patched guest attempts to connect to an unpatched host (or vice versa), the expected legacy handshake fallback could fail intermittently and leave sockets uncleared. That symptom often shows as authentication failures (Event ID 4625) in the Security event log. Microsoft published KB5066360 as the corrective hotpatch. (support.microsoft.com)
Hotpatching is a Microsoft mechanism intended for managed enterprise devices that need fast, security-only fixes without interrupting operations with a restart. It patches in-memory code paths and is offered on eligible Windows Server and Windows 11 Enterprise editions enrolled and configured for hotpatch delivery. Hotpatch packages are intentionally small and narrowly scoped to security fixes so administrators can reduce the time systems remain exposed to a vulnerability. The hotpatch program has a scheduled cadence (baseline months and hotpatch months) and specific eligibility criteria documented by Microsoft. (learn.microsoft.com)
Administrators running Hyper‑V and managing PSDirect‑dependent workflows should treat KB5066360 as a priority for eligible hosts and ensure guest parity. At the same time, plan a staged rollout with vendor testing and clear rollback procedures, and request CVE mapping if your audit processes require explicit vulnerability identifiers.
KB5066360 demonstrates the operational tradeoffs Microsoft intends with hotpatching: faster, lower‑impact fixes for critical security issues, balanced by a need for careful deployment discipline in mixed or heavily instrumented environments. Applying the update promptly, validating PSDirect behavior, and aligning host/guest patch levels will reduce exposure and restore reliable host‑to‑guest management on affected systems. (support.microsoft.com)
Source: Microsoft Support KB5066360—Security Update for Windows PowerShell (Hotpatch) - Microsoft Support
Background
PowerShell remains a core administration and automation runtime on Windows, and PowerShell Direct (PSDirect) is the specific channel Hyper‑V hosts use to connect into guest VMs without network connectivity. In September 2025 Microsoft shipped a set of hotpatch and cumulative updates that inadvertently introduced an edge case: when a patched guest attempts to connect to an unpatched host (or vice versa), the expected legacy handshake fallback could fail intermittently and leave sockets uncleared. That symptom often shows as authentication failures (Event ID 4625) in the Security event log. Microsoft published KB5066360 as the corrective hotpatch. (support.microsoft.com)Hotpatching is a Microsoft mechanism intended for managed enterprise devices that need fast, security-only fixes without interrupting operations with a restart. It patches in-memory code paths and is offered on eligible Windows Server and Windows 11 Enterprise editions enrolled and configured for hotpatch delivery. Hotpatch packages are intentionally small and narrowly scoped to security fixes so administrators can reduce the time systems remain exposed to a vulnerability. The hotpatch program has a scheduled cadence (baseline months and hotpatch months) and specific eligibility criteria documented by Microsoft. (learn.microsoft.com)
What KB5066360 delivers
High-level summary
- Applies to specific hotpatch-capable SKUs (examples documented by Microsoft include Windows 11 Enterprise LTSC 2024 and Windows Server 2025 Datacenter: Azure Edition); the package raises the reported OS Build to 26100.6569 on affected devices. (support.microsoft.com)
- Release date: September 9, 2025 (hotpatch release distributed via Windows Update to eligible devices). (support.microsoft.com)
- Primary fix: “Fix for PSDirect connections failing in Hotpatch devices.” The KB describes this as resolving a host‑to‑guest vulnerability window and improving reliability of older sessions that may shut down unexpectedly. (support.microsoft.com)
Files and versions
The KB lists updated PowerShell binaries and resources with file versions 10.0.26100.6569 and timestamps (file list shows a 22‑Aug‑2025 file timestamp in the KB file table). The explicit file names include System.Management.Automation.dll, Microsoft.PowerShell.ConsoleHost.dll and multiple resource DLLs. Administrators should use these file version values as inventory verification after deployment. (support.microsoft.com)What it does not include (important caveat)
Microsoft’s public hotpatch KB text provides a functional description of the fix but does not enumerate a CVE identifier in the KB article itself. Administrators who require CVE mapping for compliance or ticketing should consult the Microsoft Security Update Guide or MSRC advisory entries for explicit CVE numbers and exploitability guidance. Treat the absence of a CVE in the KB as a documentation gap until confirmed through the Security Update Guide.Technical analysis — the PSDirect handshake regression
How PSDirect normally works
PSDirect allows an administrator or automation service on the Hyper‑V host to establish a remote PowerShell session directly into a guest VM using integration channels rather than network-based remoting. That host‑to‑guest handshake supports legacy fallback behavior so that when one side is updated and the other is not, the communication can revert to a compatible handshake and cleanly tear down sockets when necessary.The regression and its consequences
The September 2025 hotpatch/security update cycle introduced a regression in that fallback mechanism. When the patched side attempted to fall back to a legacy handshake with an unpatched counterpart, the fallback did not always complete correctly; socket cleanup sometimes failed and the connection broke in a way that could surface as Event ID 4625 (authentication failure) in the Security log. In narrow conditions Microsoft indicated the behavior could create an unauthorized, non‑administrator access window during session handling—hence the priority to release a corrective hotpatch. (support.microsoft.com)Why this matters operationally
PowerShell is a frequent target in post‑compromise scenarios; vulnerabilities or regressions in host/guest administration surfaces can be abused for lateral movement or escalation. The hotpatch fixes both the security exposure during that brief handshake window and improves session teardown reliability, reducing an operational pain point (intermittent PSDirect failures) that can disrupt management workflows.Operational impact and who should act
Affected environments
- Hyper‑V hosts and guest VMs where PSDirect is used to administer virtual machines.
- Mixed estates where hotpatches are applied unevenly (some hosts patched, guests not, or vice versa).
- Customers using Windows 11 Enterprise LTSC 2024 and hotpatch‑capable Windows Server SKUs that report builds in the 26100 series should prioritize verification. (support.microsoft.com)
Priority for deployment
- If you operate Hyper‑V hosts that perform PSDirect-based management of guests, prioritize host updates and ensure guest parity. Microsoft explicitly recommends applying the hotpatch to hosts whose guests have received the September 2025 hotpatch or cumulative updates. (support.microsoft.com)
- For production critical systems, use a staged rollout with a pilot group, early‑adopter ring, and then broader deployment. Track errors in the Security event log and virtualization subsystem logs for PSDirect handshake anomalies.
Hotpatch eligibility and delivery channels
- Hotpatch packages are typically delivered via Windows Update for hotpatch‑enrolled, eligible devices; in many cases Microsoft bundles the servicing stack update (SSU) to improve installation reliability. WSUS/MSU/catalog distribution may vary by SKU and channel—hotpatching is delivered automatically only to devices that meet prerequisites. Confirm your enrollment and baseline alignment before expecting the no‑restart delivery. (learn.microsoft.com)
Deployment checklist and step‑by‑step recommendations
Pre‑deployment (inventory and testing)
- Inventory where PSDirect is used and list host/guest pairs; prioritize pairs where either side is hotpatched or pending updates.
- Confirm device eligibility for hotpatch (baseline build, licensing, VBS/enrollment requirements for your environment). Use winver or inventory tools to validate build values (target 26100.6569 once KB5066360 installs). (learn.microsoft.com)
- Identify third‑party agents (EDR, backup, monitoring) and vendor drivers that hook into PowerShell or virtualization subsystems; coordinate vendor testing because hotpatches modify in‑memory code paths.
Pilot and validation
- Choose a pilot ring representing typical hardware, firmware, and agent combinations.
- Apply KB5066360 to hosts in the pilot ring first. Validate that guests are also updated or will be updated promptly.
- Validate PSDirect scenarios: connect from host to guest and from guest to host where applicable; monitor Security event logs, Hyper‑V logs, and EDR telemetry for regressions. Look specifically for Event ID 4625 and socket cleanup errors.
Production rollout
- Expand to early adopter ring only after 48–72 hours of no regression incidents.
- Apply monitoring rules and SIEM correlations to detect unexpected PowerShell or firewall changes, and maintain an incident‑response playbook for rapid rollback or remediation.
Post‑deployment verification
- Confirm updated build values in inventory and CMDB tools; map hotpatched KB numbers and build versions to “patched” status so compliance scanners do not misreport. Hotpatch updates can change reported build numbers in subtle ways—update asset management rules accordingly.
Monitoring, telemetry and forensic indicators
- Watch for Event ID 4625 in the Security log correlated to PSDirect session timestamps. This event was specifically called out in Microsoft’s known‑issue description for the September packaging and is a key signal to validate the fix. (support.microsoft.com)
- Configure EDR to capture process creation (Event ID 4688), firewall rule changes (Event IDs 4946/4947), and service state changes for Windows Firewall and PowerShell processes. Correlate these to hotpatch install times.
- Tune alerts for false positives: hotpatches can alter in‑memory code paths in ways that some security agents interpret as anomalous — baseline telemetry prior to deployment reduces noisy alerts post‑install.
Benefits of the hotpatch model — and tradeoffs
Strengths
- Reduced downtime: hotpatches install without immediate restart on eligible systems, decreasing operational disruption and shortening the exposure window for security issues. (learn.microsoft.com)
- Targeted scope: hotpatches are security-only and narrow in scope, which simplifies testing and reduces the likelihood of broad regressions tied to feature or bug‑fix payloads.
- Faster mitigation: for a host‑to‑guest handshake vulnerability, the ability to activate the fix without a full reboot materially reduces the moment-of-exposure for critical infrastructure.
Tradeoffs and risks
- Eligibility friction: hotpatching requires enrollment, licensing, baseline alignment and sometimes platform-specific configuration; mixed estates that can’t enroll will still need baseline LCUs (which require restarts), complicating parity. (learn.microsoft.com)
- Compatibility risk with agents/drivers: in‑memory hotpatches can conflict with hooking behavior in EDR, backup, or virtualization extensions; thorough vendor testing is essential before broad rollout.
- Rollback complexity: while hotpatches can be uninstalled, rollback typically requires a restart and may leave devices in an unexpected servicing state; test rollbacks in your lab before relying on them in production.
Practical commands and quick checks
- Verify installed HotFix/KBs on a device (example):
- wmic qfe get HotFixID,Description,InstalledOn
- Or check Windows Update history and inventory tools that report combined SSU + LCU packages.
- Validate the running build after applying the hotpatch:
- Run winver or use: [PowerShell] (Get‑ComputerInfo).OsBuildNumber (confirm 26100.6569 where applicable). The KB lists the post‑install OS build value for inventory verification. (support.microsoft.com)
- Search the Security Event Log for PSDirect handshake problems:
- Use Event Viewer or PowerShell to filter for Event ID 4625 around PSDirect session times. (support.microsoft.com)
Secure Boot certificate advisory — separate but urgent
KB5066360 includes a reminder about a separate operational program: Secure Boot certificates used by many Windows devices begin expiring starting in June 2026, and administrators must coordinate firmware/OEM and update deployment to avoid secure‑boot disruptions. This advisory is not part of the PSDirect fix but is an operationally significant reminder that requires cross‑team planning (firmware, OEM, IT asset management). Start inventorying firmware readiness and plan DB/KEK update tests now. (support.microsoft.com)Recommendations — concise action plan
- Inventory hosts and guests that use PSDirect and flag host/guest pairs for parity updates.
- Confirm hotpatch eligibility and enrollment for devices you want to protect with no-restart delivery. (learn.microsoft.com)
- Pilot KB5066360 in a small, representative ring; validate PSDirect scenarios, Event ID 4625 absence, and agent compatibility for 48–72 hours.
- Expand rollout in staged rings, update CMDB and compliance scanners to recognize hotpatched build values, and coordinate with virtualization and backup vendors.
- For compliance teams requiring CVE mapping, request explicit CVE identifiers from the Microsoft Security Update Guide or MSRC; do not assume KB text is exhaustive.
Final assessment
KB5066360 is a narrowly scoped, operationally important hotpatch that corrects a PSDirect handshake regression with concrete, readily verifiable indicators (build numbers and file versions). It demonstrates the value of hotpatching for fast, low‑disruption security remediation in managed enterprise environments. However, hotpatch adoption still carries real operational tradeoffs: enrollment and baseline prerequisites, the need to update asset management and compliance tooling to recognize hotpatched states, and the ever‑present possibility of agent/driver incompatibilities when in‑memory code paths are altered.Administrators running Hyper‑V and managing PSDirect‑dependent workflows should treat KB5066360 as a priority for eligible hosts and ensure guest parity. At the same time, plan a staged rollout with vendor testing and clear rollback procedures, and request CVE mapping if your audit processes require explicit vulnerability identifiers.
KB5066360 demonstrates the operational tradeoffs Microsoft intends with hotpatching: faster, lower‑impact fixes for critical security issues, balanced by a need for careful deployment discipline in mixed or heavily instrumented environments. Applying the update promptly, validating PSDirect behavior, and aligning host/guest patch levels will reduce exposure and restore reliable host‑to‑guest management on affected systems. (support.microsoft.com)
Source: Microsoft Support KB5066360—Security Update for Windows PowerShell (Hotpatch) - Microsoft Support