Microsoft has issued a warning to enterprise administrators about a critical issue affecting Windows 11 systems. This problem may cause devices to boot to a black screen or experience severe shell failures following recent cumulative updates.
The issue, documented under KB5072911, affects Windows 11 versions 24H2 and 25H2 when updates released on or after July 2025, such as KB5062553 and KB5065789, are installed in specific enterprise and virtualized environments.
While Microsoft states that this bug is unlikely to affect consumer devices, it poses significant operational risks for managed enterprise deployments, especially those that rely on provisioning workflows and virtual desktop infrastructure (VDI).
According to Microsoft, the root cause is that XAML-dependent application components fail to initialize properly due to delayed or incomplete registration of required system packages.
Critical Windows interface elements, including Explorer, the Start Menu, the Taskbar, System Settings, and Windows Search, depend on these XAML frameworks to function correctly. When these dependencies fail, users may encounter a black screen upon login, experience unresponsive desktop environments, or face repeated application crashes.
This problem is especially prevalent in scenarios where updates are installed before the first user logon in persistent installations or in non-persistent environments where application packages need to be provisioned dynamically during each session.
Enterprise environments that use VDI platforms are particularly vulnerable, as repeated user logons can consistently trigger this failure condition. Affected binaries include explorer.exe, which may crash at startup or fail to render the desktop, resulting in a black screen.
Additionally, StartMenuExperienceHost may display critical errors, while shellhost.exe crashes can disrupt the immersive shell experience. Other XAML-dependent components, such as the User Account Control interface (consent.exe) and System Settings, may fail silently or crash when attempting to initialize their user interfaces, complicating troubleshooting efforts.
Microsoft attributes this issue to a timing issue in which essential XAML packages, such as Microsoft. Windows.Client.CBS, Microsoft.UI.Xaml.CBS, and MicrosoftWindows.Client.Core, are not registered promptly following the installation of updates. This results in broken dependencies that prevent the Windows shell and associated applications from launching correctly.
The situation highlights the fragility of modern Windows components, which rely heavily on modular app packages and dynamic provisioning, particularly in enterprise-scale deployments.
To resolve the issue, Microsoft has released a fix starting with updates rolled out on June 23, 2026 (KB5095093). This patch is being gradually deployed and is expected to be fully available in subsequent monthly updates. Organizations are strongly advised to apply the latest updates to mitigate the issue and ensure system stability.
For environments unable to deploy the fix immediately, Microsoft has provided temporary workarounds. Administrators can manually register the missing XAML packages using PowerShell commands that reinitialize the necessary AppX manifests.
For non-persistent environments, Microsoft also recommends implementing a logon script that synchronously registers these packages before Explorer launches. This approach ensures that dependencies are correctly provisioned before the Windows shell initializes, preventing the black screen condition.
This incident underscores the importance of update sequencing and dependency management in enterprise Windows environments. Security and IT teams are advised to validate their update deployment workflows, especially in VDI and automated provisioning scenarios, to prevent disruptions caused by similar issues in future updates.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…