Microsoft's patch for a zero-day privilege escalation Windows bug in June did not fix the vulnerability, which could still be exploited with some adjustments
Back in June, Microsoft released a fix for a vulnerability in the Windows operating system that enabled attackers to increase … Source: Google Project Zero .
Context & Ripple Effects
This is the second time in roughly two years that Microsoft has declared a Windows privilege-escalation zero-day fixed and been proven wrong. In 2018 the pressure came from Kaspersky Lab researchers who caught multiple cyber-espionage groups exploiting an escalation-of-privelege bug before a patch existed; this time Google Project Zero found that Microsoft's June patch simply didn't close the hole, leaving it reachable with adjustments.
The finding lands on a Patch Tuesday cadence Microsoft has been running at high volume — the related coverage shows batches of 50 flaws with seven zero-days and 44-flux months alongside one-off emergency fixes like the Follina PowerShell zero-day exploited by state-backed actors. A failed fix inside that pipeline matters because enterprises plan their patching around the assumption that a shipped patch is a closed vulnerability.
First-order effects
- Windows administrators who applied the June patch are running with a false sense of protection: the privilege-escalation path remains exploitable, so their risk posture is unchanged despite a completed patch cycle.
- Microsoft is forced back into the patch lab on a vulnerability it had already marked closed, with Google Project Zero's disclosure setting the clock and the public narrative.
Second-order effects
- Enterprise security teams lose confidence in patch status as a security metric, pushing weight toward defense-in-depth controls and researcher verification rather than trusting the Patch Tuesday label alone.
- The incomplete fix hands espionage groups a documented, adjusted exploit path on systems believed patched — raising the stakes for Microsoft's follow-up fix and for how quickly customers redeploy it.
Third-order effects
- If incomplete fixes recur, patch verification becomes a structural expectation: independent researchers re-testing shipped patches becomes a de facto QA layer for the entire Windows update ecosystem.
- The pattern — a 2018 kernel zero-day, a failed 2020 fix, and the 2021-2022 run of actively exploited zero-days — points toward sustained regulatory and customer scrutiny of Microsoft's vulnerability-response process, not just its code.
The trend: Windows patching is shifting from vendor-attested fixes to researcher-verified fixes, as Microsoft's repeated incomplete and actively-exploited zero-day patches erode trust in Patch Tuesday as a final word.