GoKawiilMicrosoft has confirmed that the April 2026 security updates are causing failures in third-party backup applications using the psmounterex.sys driver.
As BleepinComputer reported last week, this issue affects software using VSS (Volume Shadow Copy Service) snapshots and causes failures due to a VSS service timeout.
Software impacted by this includes, but is not limited to, products from Macrium (Reflect), Acronis (Cyber Protect Cloud), UrBackup Server, and NinjaOne Backup running on Windows 11, Windows Server, and Windows 10 devices.
Microsoft has now updated its support documents to confirm that the April updates include a security hardening change that adds psmounterex.sys to the company's vulnerable driver blocklist to defend users against attacks targeting a high-severity buffer overflow vulnerability (CVE-2023-43896) that allows attackers to escalate privileges or execute arbitrary code.
Microsoft also advised those affected by this issue to update to a newer version of their app that uses newer drivers, which include the required protections.
On impacted systems, where the vulnerable drive is blocked by Windows Code Integrity enforcement, IT admins and users may observe the following behavior:
Backup applications that rely on the kernel driver psmounterex.sys might fail to mount backup image files as virtual drives.
Attempting to browse or restore from a backup image might result in errors or timeouts.
Failures might be followed by error messages, such as "The backup has failed because Microsoft VSS has timed out during the snapshot creation" or VSS_E_BAD_STATE.
Event Viewer might show Code Integrity errors indicating that psmounterex.sys was blocked from loading.
... continue reading