Microsoft Fixes Windows 11 Update Failures Caused by Small EFI Partitions
Microsoft released Windows 11 cumulative update KB5089573 to permanently fix an installation bug introduced by KB5089549 that caused some systems running versions 24H2 and 25H2 to fail during reboot. Affected devices typically stalled at about 35–36% completion, rolled back the update, and returned error 0x800f0922, with logs indicating insufficient free space in the EFI System Partition (ESP). Microsoft had already applied a Known Issue Rollback and provided a registry-based workaround for enterprise administrators before issuing the permanent fix.
The update raises Windows 11 builds to 26100.8524 and 26200.8524, includes servicing stack and AI component updates, and is available through Windows Update, Microsoft Update Catalog, Windows Update for Business, and WSUS. Microsoft said no known issues were identified at release and indicated that the fix will also be included in subsequent cumulative updates, reducing the need for users and administrators to manually resize the ESP or remove security updates.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft deploys rollback and workaround for the Windows 11 install issue
Before issuing a permanent fix, Microsoft mitigated the problem with a Known Issue Rollback and provided a registry-based workaround for enterprise administrators. The mitigation targeted failures tied to insufficient EFI System Partition free space.
May 2026 Windows 11 update introduces installation failure on some PCs
Microsoft said the May 2026 cumulative update KB5089549 introduced an installation issue on some Windows 11 24H2 and 25H2 devices with limited free space in the EFI System Partition. Affected systems stalled around 35–36% during reboot, rolled back changes, and could show error 0x800f0922.
Microsoft releases KB5089573 to permanently fix the Windows 11 issue
On 2026-05-26, Microsoft released optional cumulative update KB5089573 for Windows 11 24H2 and 25H2 to permanently resolve the installation failure caused by KB5089549. Microsoft said the update was available through Windows Update and related servicing channels and that no known issues were identified at release.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
5 references tracked. Mallory keeps watching after this page renders.
Microsoft Fixes Windows 11 KB5089549 Install Failures Caused by Limited EFI Partition Space - gHacks Tech News
ghacks.net
Open sourceMicrosoft resolves Windows 11 update installation errors | brief | SC Media
scworld.com
Open sourceMicrosoft confirms Windows 11 update is failing on some PCs, explains if you need a workaround
windowslatest.com
Open sourceMicrosoft fixes KB5089549 Windows security update install issues
bleepingcomputer.com
Open sourceMicrosoft Releases KB5089573 for Windows 11 to Fix Patch Tuesday Install Issues
cybersecuritynews.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Windows 11 KB5089549 Install Bug Blocks Security Updates on Low-ESP Systems
Microsoft confirmed that the mandatory Windows 11 cumulative update **KB5089549** is failing on some devices, leaving them without the latest security fixes. The installation issue is primarily affecting systems with nearly full **EFI System Partitions (ESP)**—especially those with about **10 MB or less** of free space—and commonly triggers errors including `0x800f0922`, `0x80240069`, and `0x80240031`. Affected machines often stall at roughly **35–36%** during restart, then roll back the update instead of completing installation. Microsoft said it deployed a server-side **Known Issue Rollback (KIR)** to mitigate the problem for consumer and unmanaged business devices, with the fix expected to apply automatically after a restart. The company also advised users to reboot and retry the update, while enterprise administrators were told to use a **Group Policy** mitigation for managed environments. Reports also noted that some impacted systems experienced boot issues or degraded performance, adding to broader concerns over recent Windows update reliability problems.
Jun 9, 2026
Windows 11 KB5089549 Install Failures Complicate Microsoft Defender Security Patches
Microsoft confirmed that the Windows 11 security update `KB5089549` can fail to install on systems running versions 24H2 and 25H2 when the EFI System Partition has 10 MB or less of free space. Affected devices typically stop during reboot at about 35–36% completion, return error `0x800f0922`, and roll back the update. Microsoft has issued a **Known Issue Rollback** for consumer and unmanaged business devices, while enterprise administrators must use a Group Policy workaround; for persistent cases, the company also published a registry-based mitigation to reduce reserved EFI servicing padding. The same update also addresses a separate problem that had pushed some Windows 11 devices into BitLocker recovery after earlier 2026 updates. The installation issue is significant because Microsoft’s May security advisories also included multiple **Microsoft Defender** vulnerabilities, with `CVE-2026-41091` and `CVE-2026-45498` added by CISA to the **Known Exploited Vulnerabilities** catalog, signaling active exploitation risk. Additional Defender flaws tracked as `CVE-2026-45584` and related advisories were also published by Microsoft and echoed by national cybersecurity agencies, including Canada’s Cyber Centre and HKCERT, which urged organizations to review the bulletins and apply updates. Microsoft said it is developing a permanent fix for the Windows 11 update failure in a future release.
May 24, 2026
Microsoft Issues Emergency Windows 11 Update for Installation Failure Loop
Microsoft released an out-of-band Windows 11 update, **KB5086672**, to fix a widespread installation failure affecting versions **25H2** and **24H2** after the March preview update **KB5079391** triggered repeated setup errors. Affected systems entered a loop of failed update attempts and reported error code `0x80073712`, which indicates missing or corrupted update files. Microsoft withdrew the faulty preview release and replaced it with a cumulative package that also carries forward March security and quality fixes. The emergency package moves impacted devices to OS builds **26200.8117** and **26100.8117** and also updates several local AI components. Microsoft said the fix is available through **Windows Update**, the **Microsoft Update Catalog**, and manual installation in Settings, while enterprise administrators can accelerate deployment through **Intune** or **Windows Autopatch** expedited quality updates. Because the release combines the servicing stack and cumulative update, rollback options are limited and manual removal may require **DISM**.
May 25, 2026