Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday

KB5094125

KB5094125: Cumulative update for Windows Server, version 2025, June 2026. DNS over HTTPS arrives as Secure Boot coverage expands

In short

Windows Server 2025 DNS can now use encrypted server-to-client queries, while Secure Boot certificate rollout reaches more eligible devices. The update also resolves an issue that could make Outlook and other WNS apps stop responding.

Does it affect you? Applies to: Devices running Windows Server 2025, build 26100.32995. The listed package is for x64 systems.

Build
26100.32995
Security
109 fixed · 20 critical
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • Known issues This issue is addressed in updates released on or after July 14, 2026, including KB5099536. Microsoft recommends installing the latest update.
  • Known issues KB5099536 addresses this issue.
  • Known issues KB5099536 addresses this issue.

The official sources are linked at the end of the page.

What changes

Improvements 4 changes

Secure Boot

Gradual rollout Verified in package

For: devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates through a controlled rollout.1
    Adds high-confidence device-targeting data to Windows quality updates. Devices receive new certificates only after enough successful update signals.

File Explorer

Verified in package
  • File Explorer search handles Chinese text and more text files. Search results, Content view, and tooltips display text more clearly.2
    Improves search support for UTF-8 encoded files without a byte order mark (BOM).

Reliability

  • User profiles load more reliably.3
    Improves resource management during user profile loading.

Folder customization

For: users with customized folders from downloaded or remote locations

  • Some custom folder icons or translated folder names might not appear for content from downloaded or remote locations. Folder access is not affected.4
    Changes how Windows processes desktop.ini files as a security hardening measure.

Fixes 3 changes

Boot manager servicing update

Verified in package
  • Some devices might enter BitLocker Recovery after boot files are updated. This update addresses the issue.5
    The issue can occur with certain TPM validation settings, including invalid PCR7 configurations, after installing the April 2026 security update.

Windows Update Deployment

Verified in package
  • Updates installed with WUSA no longer encounter the listed path error in the affected cases.6
    Addresses ERROR_BAD_PATHNAME when installing an .msu file by double-clicking it or running WUSA from a network share containing multiple .msu files.

Windows Push Notification Services (WNS)

For: users of Outlook and other apps that use WNS

  • Outlook and other apps that use WNS no longer have the underlying issue that might make them stop responding.7
    Resolves the underlying issue that might cause applications using Windows Push Notification Services to hang.

New features 2 changes

Secure Boot

Verified in package
  • A new policy lets administrators limit the Secure Boot data Windows sends to Microsoft.8
    Adds the LimitSecureBootRequiredServiceData Group Policy and MDM setting under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. When enabled, it suppresses the event normally sent to Microsoft.

Networking

Verified in package

For: IT administrators managing DNS

  • DNS can encrypt queries between a Windows Server DNS server and its clients, helping protect their privacy.9
    Windows Server 2025 DNS Server adds DNS over HTTPS (DoH) for server-client communication. Encrypted DNS between servers is not supported.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details in its error reports. This functionality is temporarily unavailable.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Everyone

    Microsoft Office applications might fail to open from certain third-party apps

    Some third-party apps might fail to open Microsoft Office apps or documents after installing updates released on or after June 9, 2026. The Office app might fail to open without an error message.11

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Everyone

    Deleting from recycle bin displays an internal file name

    When permanently deleting one item, the confirmation dialog might show an internal file name instead of the original name. The Recycle Bin and restored file retain the original name.12

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Open Affects: Everyone

    OneDrive shortcut in file explorer might not work in administrator mode

    The OneDrive shortcut in File Explorer might not work when File Explorer runs with administrative privileges. The shortcut might not respond, its properties might be blank, or sync status icons might be missing.13

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5087539, KB5091157, KB5082063, KB5078740
+25 earlier KB5075899, KB5078135, KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5099536
VersionBuildChannel
2025 26100.32995 General availability

Security

109 vulnerabilities fixed
20 critical 89 important
VulnerabilitySeverityCVSS
CVE-2026-45657
Windows Kernel Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-47291
HTTP.sys Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-42985
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-45648
Windows Active Directory Domain Services Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-47289
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-44810
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
 Critical 8.4
CVE-2026-45607
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-45641
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-47652
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.2
CVE-2026-42987
Windows Deployment Services (WDS) Remote Code Execution
 Critical 8.1
CVE-2026-33828
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-44803
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-44812
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-48574
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-42992
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44799
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44801
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-47654
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-48563
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-47288
Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
 Critical 7.1
CVE-2026-45586
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-49160
HTTP.sys Denial of Service Vulnerability
 Important 7.5
CVE-2026-45585
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.8

The table lists the 23 exploited, publicly disclosed or critical vulnerabilities. See all 109 vulnerabilities →

Updated components

5,142 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings112
Graphics and display49
Networking47
Bluetooth33
Remote Desktop33
Security and sign-in32
Printing31
Audio29
Hyper-V and virtualization26
File Explorer and shell22
Storage and file systems20
Secure Boot17

Verified in package: changed files confirm Secure Boot, File Explorer, Boot manager servicing update, Windows Update Deployment, Networking.

Sources

Updated
Cited passages from Microsoft's official notes (13)
  1. 1. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
  2. 2. This update improves File Explorer search, including support for Chinese text, and UTF 8–encoded files without a byte order mark (BOM). support.microsoft.com
  3. 3. This update improves reliability during user profile load by managing system resources more efficiently. support.microsoft.com
  4. 4. some users might notice missing custom folder icons or localized folder names for content from downloaded or remote locations. Note that access to folders is not affected. support.microsoft.com
  5. 5. This update addresses an issue where some devices might enter BitLocker Recovery after updating boot files on systems with certain Trusted Platform Module (TPM) validation settings support.microsoft.com
  6. 6. updates installed using the Windows Update Standalone Installer (WUSA) might fail with error code ERROR_BAD_PATHNAME. support.microsoft.com
  7. 7. This update addresses an issue that might cause Microsoft Outlook and other applications that use WNS to stop responding (hang). This update resolves the underlying issue support.microsoft.com
  8. 8. When enabled, Windows limits the Secure Boot service data it sends by suppressing the event normally sent to Microsoft. support.microsoft.com
  9. 9. This support applies only to server-client communication and doesn’t support encrypted DNS communication between servers. support.microsoft.com
  10. 10. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  11. 11. certain third-party applications might be unable to launch Microsoft Office applications or open documents after installing the Windows updates released on or after June 9, 2026. support.microsoft.com
  12. 12. the confirmation dialog might display the internal Recycle Bin file name (for example, $Rxxxxx.ext) instead of the original file name when you permanently delete a single item. support.microsoft.com
  13. 13. This issue affects only the built-in Administrator account or applications run using Run as administrator. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 13 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake