Microsoft has confirmed that while new installations of Windows Server Update Services (WSUS) are now operational, many existing deployments continue to suffer from crippling synchronisation failures. The problem, described internally as a 'metadata mountain', has left IT administrators across the UK unable to reliably fetch and deploy security patches and feature updates through the on-premises management tool.
The root cause lies in the sheer volume of metadata that WSUS must process when syncing with Microsoft's update servers. Over time, the database of update information grows exponentially, causing the service to time out or hang indefinitely. Microsoft has deployed fixes to prevent the issue on fresh installs, but legacy environments remain affected, with some organisations reporting that synchronisation jobs have been failing for weeks.
For UK businesses, particularly those in sectors like finance, healthcare, and local government that rely on WSUS for tightly controlled patch rollouts, the impact is severe. Delays in applying security updates expose networks to known vulnerabilities. 'This is a ticking clock for compliance,' said Dr. Eleanor Marsh, a cybersecurity researcher at the University of Bristol. 'If you can't sync, you can't patch, and that leaves the door open for ransomware and other attacks.'
The situation also raises regulatory questions. The UK Information Commissioner's Office (ICO) expects organisations to maintain robust security measures under data protection law. A failure to patch promptly due to a broken update system could be seen as a compliance gap. Meanwhile, the EU AI Act is unlikely to directly apply here, but the incident underscores broader concerns about dependency on single-vendor infrastructure for critical update management.
For the UK economy, the knock-on effects include increased IT support costs as businesses scramble to manually deploy updates or migrate to alternative patch management solutions. Some smaller firms may lack the resources to pivot quickly, widening the cybersecurity gap between large enterprises and SMEs. Microsoft has not yet provided a timeline for a full resolution for existing deployments, advising affected customers to contact support or consider cloud-based update alternatives like Windows Update for Business.
Industry experts warn that this incident should serve as a wake-up call. 'WSUS has been a staple for years, but it's clearly struggling under modern workloads,' noted James Whitfield, an IT infrastructure consultant. 'UK organisations need to reassess their patch management strategy now, before the next zero-day hits.'