Azure File Sync Agent v20.1 Release - August 2025 (Security-only update)

Improvements and issues that are fixed

Fixes an issue that might allow improper access control in Azure File Sync that allows an authorized attacker to elevate privileges locally. This is a security-only update. For more information about this vulnerability, see CVE-2025-53729. 

Note: This security update is available via Microsoft Update only for servers running Azure File Sync Agent version 20.0. While the forthcoming version 20.1 will be compatible with all prior agent versions when installed manually, it will also be offered via Microsoft Update only to servers currently on version v20.0 agents.

More information about the Azure File Sync Agent v20.1 release

• This security update is available for Windows Server 2016, Windows Server 2019, Windows Server 2022 and Windows Server 2025 installations.

• The agent version for this release is 20.1.0.0.

• The following updates must be installed on the Windows Server:

  • WS 2016 Microsoft Update Catalog (latest cumulative update)

  • WS 2019 Microsoft Update Catalog (latest cumulative update)

​​​​​​​Cumulative updates are released monthly. To deploy the latest one, users can either use Windows Update or manually download it from the Microsoft Update Catalog. If installing manually, they should review the associated KB article to ensure all prerequisites are met.

​​​​​​​Note: If the Windows Updates are not installed prior to installing the Azure File Sync agent, the Storage Sync Agent service (FileSyncSvc) will fail to start. To learn more, see the Azure File Sync troubleshooting documentation. 

How to obtain and install the Azure File Sync Agent 

The Azure File Sync agent is available from Microsoft Update & Microsoft Update Catalog.

Notes

• Agent version 20.1 will be available only via Microsoft Update for servers currently running agent version 20.0. 

• To update existing agent installations, download and install the update from Microsoft Update or Microsoft Update Catalog.

• AfsUpdater.exe will not work for v20.1 agent installation.

Microsoft Update

To obtain and install from Microsoft Update, follow these steps on a server that has Azure File Sync agent installed:

Windows Server 2025, 2022, Server 2019 and Server 2016

1. Click Start, and then click Settings.

2. In Settings, click Update & security.

3. In the Windows Update window, click Check online for updates from Microsoft Update.

4. Verify the Azure File Sync agent update is listed and then click Install now.

Microsoft Update Catalog

Go to the following website to manually download this update from the Microsoft Update Catalog:

Azure File Sync Agent v20.1 release: August 2025 (KB5056953)

To manually install the update package, extract the cab file and run the following command from an elevated command prompt:

msiexec.exe /p packagename.msp REINSTALLMODE=OMUS REINSTALL=StorageSyncAgent,StorageSyncAgentAzureFileSync,StorageSyncAgentGuardFilter,StorageSyncAgentUpdater /qb /l*v KB5056953.log

For example, to install the Azure File Sync agent update for Server 2016, run the following command:

msiexec.exe /p StorageSyncAgent_WS2016_KB5023058.msp REINSTALLMODE=OMUS REINSTALL=StorageSyncAgent,StorageSyncAgentAzureFileSync,StorageSyncAgentGuardFilter,StorageSyncAgentUpdater /qb /l*v KB5056953.log