[ad_1]
Microsoft has now confirmed that an April 2025 Home windows safety replace is creating a brand new empty “inetpub” folder and warned customers to not delete it.
This folder is often utilized by Microsoft’s Web Data Providers (IIS), an internet server platform that may be enabled by way of the Home windows Options dialog to host web sites and net apps.
Nevertheless, after putting in this month’s cumulative updates, many Home windows customers have discovered a newly created C:inetpub folder on their techniques, though IIS wasn’t put in through the course of.
BleepingComputer has confirmed this habits on our Home windows 11 and Home windows 10 techniques and found that the cumulative replace creates the folder utilizing the SYSTEM account.
Although deleting the folder didn’t trigger points utilizing Home windows in our exams, Microsoft informed BleepingComputer on Thursday that this empty folder had been deliberately created and shouldn’t be eliminated.
Nevertheless, in response to consumer stories, the April cumulative updates will fail to put in if the C:inetpub listing is created earlier than replace deployment.
Customers warned to not take away the brand new folder
Whereas Redmond nonetheless has to elucidate why the safety updates are creating this folder within the first place, the corporate up to date the advisory for a Home windows Course of Activation elevation of privilege vulnerability (tracked as CVE-2025-21204) in a single day to warn customers to not delete the brand new empty inetpub folder on their laborious drives.
“After putting in the updates listed within the Safety Updates desk on your working system, a brand new %systemdrivepercentinetpub folder can be created in your system,” Microsoft says.
“This folder shouldn’t be deleted no matter whether or not Web Data Providers (IIS) is lively on the goal system. This habits is a part of modifications that improve safety and doesn’t require any motion from IT admins and finish customers.”
The CVE-2025-21204 safety flaw is attributable to an improper hyperlink decision situation earlier than file entry (‘hyperlink following’) within the Home windows Replace Stack which possible implies that, on unpatched units, Home windows Replace could observe symbolic hyperlinks in a means that may let native attackers trick the system into accessing or modifying unintended recordsdata or folders.
The corporate warns that profitable exploitation can let native attackers with low privileges escalate permissions and “carry out and/or manipulate file administration operations on the sufferer machine within the context of the NT AUTHORITYSYSTEM account.”
Microsoft did not clarify how the inetpub folder would “improve safety,” and BleepingComputer has but to obtain a reply to additional questions concerning the newly created folder’s precise function.
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and the best way to defend towards them.
[ad_2]
