Skip to the content
The Update Bureau
Windows 10 1607 Windows 10 1607 Security update
Patch Tuesday Zero-day

KB5039214

KB5039214: Cumulative update for Windows 10, version 1607, June 2024. Exploited Mark of the Web bypass addressed; LSASS issues fixed

In short

The update addresses 24 vulnerabilities, including an actively exploited Mark of the Web security bypass, and two LSASS problems. It has been unavailable since March 31, 2026.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016, version 1607, build 14393.7070.

Build
14393.7070
Security
24 fixed · 1 critical · 1 exploited
Review notes Additional details from the official release notes (1) Read note
  • Does it affect you? This update is for Windows 10 Enterprise LTSB 2016, version 1607, and installs OS build 14393.7070.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Fixes 2 changes

LSASS

2 items
  • The Windows security process stops responding on Windows servers after the April 2024 security updates.1
    Addresses an issue that affects lsass.exe on Windows servers after installing the April 2024 security updates.
  • The Windows security process can leak memory during a domain policy communication.2
    Addresses an lsass.exe memory leak during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call.

New feature 1 change

File Explorer

For: People copying files from untrusted locations

  • Files and folders from untrusted locations get an internet-origin tag. The tag updates the file’s LastWriteTime timestamp, which might affect some file-copy scenarios.3
    When MapUrlToZone classifies a file as “Internet,” the file gets the Mark of the Web (MoTW) tag; this updates the LastWriteTime timestamp.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-06-11
Type
Cumulative update
VersionBuildChannel
1607 14393.7070 General availability

Security

24 vulnerabilities fixed
1 exploited 1 critical 22 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2024-38213 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
 Moderate 6.5
CVE-2024-30080
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
 Critical 9.8
CVE-2024-30068
Windows Kernel Elevation of Privilege Vulnerability
 Important 8.8
CVE-2024-30078
Windows Wi-Fi Driver Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30097
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
 Important 8.8
CVE-2024-30077
Windows OLE Remote Code Execution Vulnerability
 Important 8.0
CVE-2024-30082
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30086
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30087
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30091
Win32k Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30094
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-30095
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
 Important 7.8
CVE-2024-35250
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.8
CVE-2024-30093
Windows Storage Elevation of Privilege Vulnerability
 Important 7.3
CVE-2024-30084
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30090
Microsoft Streaming Service Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30099
Windows Kernel Elevation of Privilege Vulnerability
 Important 7.0
CVE-2024-30076
Windows Container Manager Service Elevation of Privilege Vulnerability
 Important 6.8
CVE-2024-30063
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
 Important 6.7
CVE-2024-30065
Windows Themes Denial of Service Vulnerability
 Important 5.5
CVE-2024-30066
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30067
Winlogon Elevation of Privilege Vulnerability
 Important 5.5
CVE-2024-30069
Windows Remote Access Connection Manager Information Disclosure Vulnerability
 Important 4.7

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. support.microsoft.com
  2. 2. This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. support.microsoft.com
  3. 3. Starting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake