[CA8930] ESET Customer Advisory: Mandatory Auto-updates of ESET security applications for the Windows platform

ESET Customer Advisory 2026-0005
March 23, 2026
Severity: Medium

Summary

ESET has taken action to resolve an issue with the epfwwfp driver through the release of an automatic product update to multiple ESET security solutions. These updates will be distributed to all affected applications and may override the auto-update settings, as per the terms set in the EULA.

Details

A high-severity issue in the epfwwfp driver, utilized for network traffic scanning, has been identified during the investigation of support tickets reported by several customers.

The issue may manifest when an affected ESET security application is upgraded using a full installer, for instance, the .msi type (used, for example, in the Software Install tasks via ESET PROTECT or "Update ESET applications"). This could prevent the ESET service from stopping gracefully and in a timely manner, causing the upgrade to fail, leaving the system unprotected. As this is not acceptable, ESET decided to release a mandatory Auto-update to ensure continual protection of our customers and their systems.

Please note that the released hotfix versions will contain only this one fix (compared to the latest released version) to minimize potential issues.

Affected ESET products

  • ESET Endpoint Antivirus and ESET Endpoint Security for Windows 12.1.2076.0
  • ESET Server Security for Microsoft Windows Server 12.1.12012.0
  • ESET Mail Security for Microsoft Exchange Server 12.1.10010.0
  • ESET Security for Microsoft SharePoint Server 12.1.15006.0

Solution

ESET released the listed applications as Security and Stability hotfixes.

Do not run the update from an installer file

It is important not to run the update of affected versions from an installer file (for example, via ESET PROTECT's Software Install Task or "Update ESET applications" option). In this case, the product would run into the issue described above. Wait for the auto-update to be applied automatically and then restart the computer when prompted.

In case the ESET application was uninstalled during the update:

  1. Restart the client computer.

  2. Install or upgrade ESET Endpoint Security or ESET Endpoint Antivirus on a client device or deploy applications using ESET PROTECT or ESET PROTECT On-Prem.

NOTE: As most users had already applied this Auto-update, ESET stopped enforcing its distribution on April 17, 2026. Auto-update continues to be available with regular parameters, i.e., not overriding customers' Auto-update settings.

The following updates were applied to the affected products with auto-updates enabled:

  • ESET Endpoint Antivirus and ESET Endpoint Security for Windows 12.1.2076.1 (released on March 24, 2026)
  • ESET Server Security for Microsoft Windows Server 12.1.12012.1 (released on April 9, 2026)
  • ESET Mail Security for Microsoft Exchange Server 12.1.10010.1 (released on April 9, 2026)
  • ESET Security for Microsoft SharePoint Server 12.1.15006.1 (released on April 9, 2026)

Please note that the installers for ESET Server Security for Microsoft Windows Server, ESET Mail Security for Microsoft Exchange Server and ESET Security for Microsoft SharePoint Server are now available in the repository.

Additionally, on April 9, the updates for the affected server products were available only upon manually selecting the "Check for updates" option, as well as automatically for those customers who have their auto-update timing set to "Immediate auto-updates" in the policy. Automatic distribution to the affected products with "Gradual update rollout" timing selected in their policy started on April 14 and continued throughout the following week.

Alternatively, users of the affected server products who don't wish to restart their systems on short notice may wait for the release of version 13 (in mid-May) and update directly to that version. Please note that if updating from a version listed as affected, this update must also be performed via the auto-update channel - i.e. via "Check for updates" or by waiting for the product to offer the update on its own (if auto updates are allowed in the product's policy) and applying it - but not by running an installer file or using ESET PROTECT's Software Install Task or "Update ESET applications" option. Updates from a version that is not affected may be performed by any method.

Feedback & Support

If you have feedback or questions about this issue, contact us via ESET Security Forum or local ESET Technical Support.

Version log

  • Version 1.8 (June 2, 2026): Update after the latest ESET Endpoint release, added information on how to reinstall ESET applications
  • Version 1.7 (May 15, 2026): Specified when the Auto-update stopped overriding the settings
  • Version 1.6 (May 11, 2026): Clarified the wording related to affected products and versions
  • Version 1.5 (April 9, 2026): Expanded information about the possibilities of updating the server products
  • Version 1.4 (April 2, 2026): Added information about the release of server products
  • Version 1.3 (March 25, 2026): Clarified installer‑related notes in the Details and Solution sections
  • Version 1.2 (March 24, 2026): Added an explicit prompt not to run an installer file
  • Version 1.1 (March 23, 2026): Clarified the wording of the Summary section
  • Version 1.0 (March 23, 2026): Initial version of this document
Last Updated: Jun 2, 2026

Additional resources

User guides

ESET Forum

YouTube videos
ESET Support News ESET Customer Advisories ESET Status Portal ESET Technical Support

Existing customer?