The Update BureauKB5094123: Cumulative update for Windows 10, version 1809, June 2026. Remote Desktop Client flaws patched; Secure Boot reporting expands
Secure Boot gets new status reporting and data controls, while a security change might hide some custom folder icons or names. Outlook and other apps that use push notifications get a fix for hangs.
Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSC 2019, version 1809, on x86 or x64.
Review notes Additional details from the official release notes (1) Read note
- What changes The bundled SSU, KB5094143, adds enhanced logic to verify whether a device is hosted on Azure, using an updated certificate chain.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows Server.
What changes
Improvements 2 changes
Secure Boot
-
More devices can qualify to receive new Secure Boot certificates automatically. Certificates roll out in phases after devices show enough successful update signals.1
Windows quality updates include additional high confidence device targeting data for devices eligible to automatically receive new Secure Boot certificates.
Folder customization
-
Some custom folder icons or localized names might disappear for content from downloaded or remote locations. Folder access is not affected.2
A security hardening change alters how Windows processes
desktop.inifiles.
New features 2 changes
Secure Boot
-
Windows Security can now report Secure Boot status changes.3
Enables dynamic status reporting for Secure Boot states in the Windows Security App.
-
A new policy lets administrators limit Secure Boot data sent to Microsoft.4
Adds
LimitSecureBootRequiredServiceDataunderComputer Configuration>Administrative Templates>Windows Components>Secure Boot. When enabled, it suppresses the event normally sent to Microsoft. The policy is also included in the Windows Restricted Traffic Limited Functionality Baseline package.
Fix 1 change
Windows Push Notification Services (WNS)
-
Outlook and other apps that use Windows push notifications no longer hang because of this issue.5
Resolves the underlying issue that might cause Microsoft Outlook and other applications using WNS to stop responding, and improves application reliability.
Known issues
-
Microsoft Office applications might fail to open from certain third-party apps
Some third-party apps might fail to open Microsoft Office apps or documents. KB5099538 resolves this issue.6
Resolution Fixed in KB5099538Install KB5099538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Deleting from recycle bin displays an internal file name
The confirmation dialog might show an internal file name when you permanently delete one item from the Recycle Bin. KB5099538 resolves this issue.7
Resolution Fixed in KB5099538Install KB5099538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
OneDrive shortcut in file explorer might not work in administrator mode
The OneDrive shortcut might not work in File Explorer when it runs as administrator. KB5099538 resolves this issue.8
Resolution Fixed in KB5099538Install KB5099538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-06-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5087538, KB5091573, KB5082123, KB5078752
- Replaced by
- KB5099538
| Version | Build | Channel |
|---|---|---|
| 1809 | 17763.8880 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
HTTP.sys Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Media Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
HTTP.sys Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows BitLocker Security Feature Bypass Vulnerability
|
Important | 6.8 |
The table lists the 15 exploited, publicly disclosed or critical vulnerabilities. See all 85 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
1,026 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 26 |
| Secure Boot | 18 |
| Remote Desktop | 16 |
| Networking | 12 |
| Bluetooth | 10 |
| Security and sign-in | 9 |
| Storage and file systems | 9 |
| Search | 8 |
| Hyper-V and virtualization | 7 |
| File Explorer and shell | 6 |
| Audio | 5 |
| Kernel | 4 |
Verified in package: changed files confirm Secure Boot.
Sources
Cited passages from Microsoft's official notes (8)
-
1.
Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout.
support.microsoft.com -
2.
As a result, some users might notice missing custom folder icons or localized folder names for content from downloaded or remote locations. Note that access to folders is not affected.
support.microsoft.com -
3.
This update enables dynamic status reporting for Secure Boot states in Windows Security App.
support.microsoft.com -
4.
When this setting is enabled, Windows limits the Secure Boot service data it sends by suppressing the event normally sent to Microsoft.
support.microsoft.com -
5.
This update resolves the underlying issue and improves application reliability.
support.microsoft.com -
6.
This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099538.
support.microsoft.com -
7.
This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099538.
support.microsoft.com -
8.
This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099538.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake