KB5060533: Cumulative update for Windows 10, versions 21H2 and 22H2, June 2025. Exploited shortcut-file flaw patched; Netlogon flaw rated critical

The update fixes 34 vulnerabilities, including an exploited flaw in Internet Shortcut Files and a critical Netlogon flaw. It also carries an open issue that can delay delivery when organizations use quality-update deferral policies.

Does it affect you? Applies to: Windows 10, version 22H2, all editions, and version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021.

What changes

Improvements 3 changes

Internal Windows OS

2 items

Windows 10, version 21H2, gets miscellaneous security improvements to internal Windows functions; no specific issues are documented.¹
Applies to Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021.
Windows 10, version 22H2, gets miscellaneous security improvements to internal Windows functions; no specific issues are documented.¹
Applies to Windows 10, version 22H2, all editions.

Servicing stack

The component that installs Windows updates gets quality improvements.²
The cumulative update includes servicing stack update KB5059504.

Known issues

Open Affects: Everyone

Noto fonts

CJK text can look blurry or unclear at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome. Increasing display scaling improves clarity.³

How to apply the workaround Workaround

Increase display scaling to improve text clarity. Users can also report Noto CJK font issues through the official Google Noto Fonts GitHub repository.³
Resolved Affects: Everyone Resolved by KB5063159

Surface Hub v1

After installing this update on Windows 10, version 22H2, Surface Hub v1 devices might fail to start with a Secure Boot Violation error. Surface Hub 2S and Surface Hub 3 are not affected. This issue is fixed by KB5063159; Surface Hub v1 users should install that update instead.⁴

Resolution Fixed in KB5063159

Install KB5063159 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Open Affects: Organizations and IT administrators

Update delay with deferral policies

Some devices in organizations using quality-update deferral policies might receive the June 2025 security update later than expected because its metadata timestamp is June 20, 2025, although it was released on June 10. This affects update timing, not quality or applicability.⁵

How to apply the workaround Workaround

Organizations using Windows Autopatch can create an expedite policy; otherwise, admins can adjust deployment rings or deferral settings to reduce the delay.⁵
Step-by-step workaround instructions
2 steps

Show steps Hide steps
Step-by-step procedure
1. If the organization uses Windows Autopatch, create an expedite policy to bypass deferral settings and deliver the update immediately.
2. Alternatively, adjust deployment rings or deferral configurations to reduce the delay window.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-06-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5061979, KB5061768
Replaced by: KB5062554

Version	Build	Channel
21H2	19044.5965	General availability
22H2	19045.5965	General availability

Security

34 vulnerabilities fixed

1 exploited 1 critical 33 important

Vulnerability	Severity	CVSS
CVE-2025-33053 Exploited Internet Shortcut Files Remote Code Execution Vulnerability	Important	8.8
CVE-2025-33070 Windows Netlogon Elevation of Privilege Vulnerability	Critical	8.1
CVE-2025-33073 Windows SMB Client Elevation of Privilege Vulnerability	Important	8.8

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 34 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 21H2

717.5 MB

windows10.0-kb5060533-x64.msu Main update · KB5060533 SHA-1: dbb8353c…a20abb

Arm64 21H2

670.1 MB

windows10.0-kb5060533-arm64.msu Main update · KB5060533 SHA-1: 31455e90…097c5d

x86 21H2

419.5 MB

windows10.0-kb5060533-x86.msu Main update · KB5060533 SHA-1: de4a47dd…bf768c

Updated components

503 files changed since the previous update for the same versions.

Top changed components	Files
Remote Desktop	43
Graphics and display	14
Kernel	10
Hyper-V and virtualization	7
File Explorer and shell	6
Secure Boot	6
Storage and file systems	5
Security and sign-in	4
Networking	3
Emoji and input	2
Search	1

Sources

Microsoft Support: KB5060533

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (5)

1. This update contains miscellaneous security improvements to internal Windows OS functionality. No specific issues are documented for this release. support.microsoft.com
2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
3. There are reports of blurry or unclear CJK (Chinese, Japanese, Korean) text when displayed at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome. support.microsoft.com
4. This issue is fixed in update KB5063159. support.microsoft.com
5. To accelerate deployment of the June 2025 updates, admins can take one of the following actions: support.microsoft.com

Checked automatically: 7 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake