Skip to the content
The Update Bureau
Windows 11 23H2 Windows 11 23H2 Security update
Patch Tuesday

KB5093998

KB5093998

Cumulative update for Windows 11, version 23H2, June 2026

In short

Critical code-execution flaws affect the Windows Kernel, DNS Client, Remote Desktop Client and other components. File Explorer search and Secure Boot also change.

Does it affect you? Applies to: Devices running Windows 11, version 23H2, on x64 or Arm64. The announced November 10, 2026 end of updates applies to Enterprise and Education editions.

Build
22631.7219
Security
158 fixed · 22 critical
Restart
Required

What changes

Improvements 7 changes

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates automatically, in a phased rollout.1
    Adds high-confidence device targeting data to Windows quality updates. Devices receive new certificates after enough successful update signals.

Country and Operator Settings Asset (COSA)

Verified in package
  • Profiles for some mobile operators are brought up to date.2

Device management

2 items
  • Some dual-enrolled devices can sync and renew their certificates more reliably.3
    Improves connectivity for devices enrolled in both Microsoft Management Platform Configuration and Secure Lifecycle Device Management.
  • Dual-enrolled devices managed by mobile device management platforms can sync and renew their certificates more reliably.4
    Includes devices managed by the Modern Management Platform Connector.

File Explorer

Verified in package
  • Search handles Chinese text and more text files, and text appears more clearly in results, Content view and tooltips.5
    Adds support for UTF-8-encoded files without a byte order mark (BOM).

Folder customization

For: Users with custom folders from downloaded or remote locations

  • A security change might hide custom folder icons or localized folder names for content from downloaded or remote locations. Folder access is not affected.6
    Changes how Windows processes desktop.ini files.

Servicing stack

  • The component that installs Windows updates gets quality improvements.7
    Includes servicing stack update KB5094146, build 22621.7209.

Fix 1 change

Boot manager servicing update

Verified in package
  • Some devices no longer risk entering BitLocker Recovery after boot files are updated with certain TPM validation settings.8
    Addresses the issue on systems with certain Trusted Platform Module validation settings, including invalid PCR7 configurations. It might occur after installing the April 2026 security update, KB5082052.

New feature 1 change

Secure Boot

Verified in package
  • A new setting lets organizations limit Secure Boot data sent to Microsoft.9
    Adds the LimitSecureBootRequiredServiceData Group Policy and MDM setting under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. When enabled, it suppresses the event normally sent to Microsoft.

Known issues

  1. Open Affects: Everyone

    Microsoft Office applications might fail to open from certain third-party apps

    Some third-party apps that use OLE automation might fail to open Word, Excel, PowerPoint, Access or other Office apps and documents. This issue is listed for Windows updates released on or after June 9, 2026.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Resolved Affects: Everyone Resolved by KB5099414

    Deleting from Recycle Bin displays an internal file name

    When you permanently delete one item, the Recycle Bin confirmation dialog might show an internal file name instead of the original name. KB5099414 addresses this issue.11

    Resolution Fixed in KB5099414

    Install KB5099414 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Open Affects: Everyone

    OneDrive shortcut in File Explorer might not work in administrator mode

    The OneDrive shortcut in File Explorer might not work when File Explorer runs with administrative privileges. The issue affects the built-in Administrator account or apps run as administrator.12

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5087420, KB5082052, KB5078883, KB5075941
+52 earlier KB5078132, KB5077797, KB5073455, KB5071417, KB5070312, KB5068865, KB5067112, KB5066793, KB5065790, KB5065431, KB5064080, KB5066189, KB5063875, KB5062663, KB5062552, KB5060826, KB5060999, KB5062170, KB5058502, KB5058405, KB5055629, KB5058919, KB5055528, KB5053657, KB5053602, KB5052094, KB5051989, KB5050092, KB5050021, KB5048685, KB5046732, KB5046633, KB5044380, KB5044285, KB5043145, KB5043076, KB5041587, KB5041585, KB5040527, KB5040442, KB5039302, KB5039212, KB5037853, KB5037771, KB5036980, KB5036893, KB5035942, KB5035853, KB5034848, KB5034765, KB5034204, KB5034123
Replaced by
KB5099414
VersionBuildChannel
23H2 22631.7219 General availability

Security

158 vulnerabilities fixed
22 critical 136 important
VulnerabilitySeverityCVSS
CVE-2026-41096
Windows DNS Client Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-45657
Windows Kernel Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-47291
HTTP.sys Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-10263
ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]
 Critical 9.3
CVE-2026-40402
Windows Hyper-V Elevation of Privilege Vulnerability
 Critical 9.3
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-42985
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-47289
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-44810
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
 Critical 8.4
CVE-2026-45607
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-45641
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-47652
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.2
CVE-2026-33828
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-44803
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-44812
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-48574
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-42992
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44799
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44801
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-48563
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-45586
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-49160
HTTP.sys Denial of Service Vulnerability
 Important 7.5
CVE-2026-50507
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.8

The table lists the 25 exploited, publicly disclosed or critical vulnerabilities. See all 158 vulnerabilities →

Updated components

1,418 files changed since the previous update for the same versions.

Top changed componentsFiles
Remote Desktop39
Graphics and display36
Security and sign-in20
Networking18
Secure Boot15
Search12
File Explorer and shell11
Bluetooth10
Settings10
Storage and file systems7
Hyper-V and virtualization6
Kernel5

Verified in package: changed files confirm Secure Boot, Country and Operator Settings Asset (COSA), File Explorer, Boot manager servicing update.

Sources

Updated
Cited passages from Microsoft's official notes (12)
  1. 1. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update brings profiles up to date for certain mobile operators. support.microsoft.com
  3. 3. This update improves connectivity for devices enrolled in both Microsoft Management Platform Configuration and Secure Lifecycle Device Management, helping devices reliably sync and renew their certificates. support.microsoft.com
  4. 4. This update improves reliability for dual‑enrolled devices managed by mobile device management platforms, including the Modern Management Platform Connector. support.microsoft.com
  5. 5. This update improves File Explorer search, including support for Chinese text, and UTF 8–encoded files without a byte order mark (BOM). support.microsoft.com
  6. 6. This update introduces a security hardening change to how Windows processes desktop.ini files. support.microsoft.com
  7. 7. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  8. 8. This update addresses an issue where some devices might enter BitLocker Recovery after updating boot files on systems with certain Trusted Platform Module (TPM) validation settings support.microsoft.com
  9. 9. When enabled, Windows limits the Secure Boot service data it sends by suppressing the event normally sent to Microsoft. support.microsoft.com
  10. 10. This issue affects certain third-party applications that use OLE automation to interact with Microsoft Office applications. support.microsoft.com
  11. 11. After you install Windows updates released on June 9, 2026, the confirmation dialog might display the internal Recycle Bin file name (for example, $Rxxxxx.ext) instead of the original file name when you permanently delete a single item. support.microsoft.com
  12. 12. This issue affects only the built-in Administrator account or applications run using Run as administrator. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 12 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake