Windows devices missing replacement certificates lose Windows Update from May 17 or June 19, 2027

The report describes no vulnerability and no attack. The exposure is the ordinary one: a machine that cannot verify Windows Update servers stops receiving patches ^[3]. The version detail below comes from Help Net Security's account of Microsoft's guidance.

Microsoft is replacing the certificates through certificate rotation ^[4]. "However, the key to getting updates from Windows Update beyond 2027 is to keep your devices up to date today," Microsoft's Andrew Brown said ^[11].

For an admin, the test is a build check against two baselines. Windows 11 24H2 needs the September 2025 security update or later ^[6]. Several other supported versions need the July 2026 update or later ^[7]. The report does not say which versions fall in that second group, or which expire on May 17 and which on June 19. The two dates are 33 days apart ^[12], so a mixed fleet has two cutoffs to track.

For supported systems the cutoff can be reversed. A device that misses it regains access by installing the required update, and admins can download that update from the Microsoft Update Catalog or push it through management tools ^[8]. Unsupported versions get different advice: Microsoft tells those users to upgrade ^[10].

In our view the audit sorts into three groups. Current devices need nothing. Supported devices below the baseline need one update. Unsupported devices need an upgrade, and we'd expect that group to cost the most, because an upgrade is a larger job than a single update. Windows 11 25H2 and later sit in the first group by definition ^[6].