Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday Zero-day

KB5060999

KB5060999: Cumulative update for Windows 11, version 23H2, June 2025. Exploited Internet Shortcut flaw patched; Remote Desktop issue addressed

In short

The update fixes 35 security vulnerabilities, including the exploited Internet Shortcut Files remote-code-execution flaw CVE-2025-33053. It also addresses a Remote Desktop connection issue on Windows 11, version 22H2.

Does it affect you? Applies to: Devices running Windows 11, versions 22H2 and 23H2, with OS builds 22621.5472 and 22631.5472.

Build
22631.5472
Security
35 fixed · 2 critical · 1 exploited
Restart
Required

What changes

Improvements 2 changes

Windows 11, version 23H2

For: Windows 11, version 23H2 users

  • This build includes the improvements from Windows 11, version 22H2.1

Servicing stack

  • The servicing stack, which installs Windows updates, receives quality improvements.2
    The package includes servicing stack update KB5058546.

Fix 1 change

Graphics

Verified in package

For: Some Windows 11, version 22H2 users

  • On Windows 11, version 22H2, the update addresses a graphics issue that could prevent some users from connecting through Remote Desktop.3
    The issue could show errors such as “The Remote Desktop Services session has ended” or “A remote desktop connection cannot be established.”

Known issues

  1. Open Affects: Everyone

    Noto fonts issue

    CJK (Chinese, Japanese, Korean) text might look blurry or unclear at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome.4

    How to apply the workaround Workaround

    Increase display scaling to improve text clarity. For additional support, report Noto CJK font issues through the Google Noto Fonts GitHub repository.4

  2. Open Affects: Organizations and IT administrators

    Update delay with deferral policies

    Some devices in organizations using quality update deferral policies might receive the June 2025 security update later than expected. The metadata date is June 20, 2025, although the update was released June 10; this affects availability timing, not update quality or applicability.5

    How to apply the workaround Workaround

    Organizations using Windows Autopatch can create an expedite policy to bypass deferrals; admins can also adjust deployment rings or deferral configurations to reduce the delay.5

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. If the organization uses Windows Autopatch, create an expedite policy to bypass deferral settings and deliver the update immediately.
    2. Alternatively, adjust deployment rings or deferral configurations to reduce the delay window.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-06-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5062170, KB5058502, KB5058405, KB5055629
+31 earlier KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5062552
VersionBuildChannel
23H2 22631.5472 General availability

Security

35 vulnerabilities fixed
1 exploited 2 critical 33 important
VulnerabilitySeverityCVSS
CVE-2025-33053 Exploited
Internet Shortcut Files Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-29828
Windows Schannel Remote Code Execution Vulnerability
 Critical 8.1
CVE-2025-33070
Windows Netlogon Elevation of Privilege Vulnerability
 Critical 8.1
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability
 Important 8.8

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 35 vulnerabilities →

Updated components

537 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop29
Graphics and display16
Kernel7
File Explorer and shell6
Secure Boot4
Security and sign-in4
Hyper-V and virtualization2
Networking2
Storage and file systems2

Verified in package: changed files confirm Graphics.

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This build includes all the improvements in Windows 11, version 22H2. support.microsoft.com
  2. 2. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  3. 3. resulting in errors like “The Remote Desktop Services session has ended” or “A remote desktop connection cannot be established.” support.microsoft.com
  4. 4. There are reports of blurry or unclear CJK (Chinese, Japanese, Korean) text when displayed at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome. support.microsoft.com
  5. 5. To accelerate deployment of the June 2025 updates, admins can take one of the following actions: support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake