Windows 'Downdate' Attack Reverts Patched PCs to a Vulnerable State

**Windows Downdate / downgrade attacks** — A SafeBreach researcher demonstrated that an attacker with admin privileges can tamper with the Windows Update process to downgrade patched OS components (for example ci.dll) on fully patched Windows 11 systems, revive DSE bypasses, load unsigned kernel drivers, and deploy rootkits; some CVEs exploited in the chain (CVE-2024-21302 and CVE-2024-38202) were patched, but the fundamental ability to downgrade system files remains unmitigated and Microsoft is developing mitigations (including revoking outdated VBS files and recommending VBS with UEFI lock and 'Mandatory' flag) to reduce the risk.