Microsoft has confirmed that the May 2026 Windows 11 security update (KB5089549) fails to install on some systems and triggers 0x800f0922 errors.
This known issue is caused by insufficient free space on the EFI System Partition (ESP), which results in the update automatically rolling back on affected devices.
“This issue affects devices with limited free space on the EFI System Partition (ESP), especially when the device has 10 MB or less space available,” Microsoft said.
“On affected devices, the installation might proceed through the initial phases but fail during the reboot phase at approximately 35–36% completion.”
Users impacted by these installation problems also see the “Something didn’t go as planned. Undoing changes.” message when the installation rolls back, and may find log entries pointing to insufficient ESP free space, such as:
- “SpaceCheck: Insufficient free space”
- “ServicingBootFiles failed. Error = 0x70”
- “SpaceCheck:
used by third-party/OEM files outside of Microsoft boot directories”
While Microsoft is still working to resolve this issue, it advised affected customers to mitigate it using the Known Issue Rollback (a Windows feature that reverses buggy updates pushed via Windows Update).
In enterprise-managed environments where IT departments control Windows updates, admins can manually mitigate it by installing and configuring this Group Policy.
“You will need to install and configure the Group Policy for your version of Windows to resolve this issue,” Microsoft said. “You will also need to restart your device(s) to apply the group policy setting. Note that the Group Policy will temporarily disable the change causing this issue.”
You can find further guidance on deploying and configuring Known Issue Rollback group policies on Microsoft’s support website.
Microsoft released the KB5089549 cumulative update last week, along with dozens of other bug fixes, security patches, and improvements, including a fix for another known issue that causes some Windows 11 systems to boot into BitLocker recovery after installing the April 2026 Windows security updates.
Earlier this month, Microsoft also addressed a Windows Autopatch bug that caused driver updates restricted by administrative policies to be deployed on some Autopatch-managed Windows devices across the European Union, and confirmed that the April 2026 security updates were causing failures in third-party backup applications using a vulnerable driver.
Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.
This guide covers the 6 surfaces you actually need to validate.
