Skip to the content
The Update Bureau
Windows 10 21H2 / 22H2 Windows 10 21H2 / 22H2 Security update
Patch Tuesday

KB5094127

KB5094127: Cumulative update for Windows 10, versions 21H2 and 22H2, June 2026. HTTP.sys remote-code flaw patched; Secure Boot reporting added

In short

Patches a critical HTTP.sys remote-code execution flaw and adds Secure Boot status reporting. File Explorer search also handles Chinese text and UTF-8 files better.

Does it affect you? Applies to: Windows 10 version 22H2 devices covered by the Extended Security Updates program, and version 21H2 Enterprise LTSC 2021 or IoT Enterprise LTSC 2021 devices.

Builds
19044.7417 · 19045.7417
Security
147 fixed · 17 critical
Restart
Required

What changes

Improvements 4 changes

File Explorer

Verified in package
  • File Explorer search handles Chinese text and UTF-8 files without a byte order mark. Text appears more clearly in search results, Content view, and tooltips.1

Secure Boot

Gradual rollout Verified in package 2 items
  • Windows Security can now report Secure Boot status dynamically.2
    Enables dynamic status reporting for Secure Boot states in Windows Security App.
  • More eligible devices can receive new Secure Boot certificates, but they arrive in a controlled rollout.3
    Windows quality updates include additional high-confidence device targeting data. New certificates reach devices only after sufficient successful update signals.

Folder customization

For: Users with content from downloaded or remote locations

  • Custom icons or localized names might be missing for downloaded or remote folders. Folder access still works.4
    Introduces a security hardening change to how Windows processes desktop.ini files.

New feature 1 change

Secure Boot

Verified in package
  • Administrators can set a policy to limit Secure Boot data sent to Microsoft.5
    Adds LimitSecureBootRequiredServiceData under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. When enabled, it suppresses the event normally sent to Microsoft.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5099539

    Microsoft Office applications might fail to open from certain third-party apps

    Some third-party apps might fail to open Office apps or documents; KB5099539 resolves this.6

    Resolution Fixed in KB5099539

    Install KB5099539 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Everyone Resolved by KB5099539

    Deleting from recycle bin displays an internal file name

    The delete confirmation might show an internal file name instead of the original; KB5099539 resolves this.7

    Resolution Fixed in KB5099539

    Install KB5099539 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5099539

    OneDrive shortcut in file explorer might not work in administrator mode

    The OneDrive shortcut might fail in File Explorer under administrator privileges; KB5099539 resolves this. This affects the built-in Administrator account or apps run as administrator.8

    Resolution Fixed in KB5099539

    Install KB5099539 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5122878

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    Some systems might ask for the BitLocker key once after restart; KB5122878 addresses this. Affected systems have OS-drive BitLocker, PCR7 configured, binding marked “Not Possible,” the 2023 UEFI CA, and an older boot manager.9

    How to apply the workaround Group Policy

    This removes the explicit PCR7 profile and updates BitLocker bindings to use the Windows-selected default PCR profile.9

    Step-by-step instructions, command & download kit
    4 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Open Group Policy Editor (gpedit.msc) or Group Policy Management Console.
    2. Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    4. Run gpupdate /force. If BitLocker is enabled on C:, run the commands below to suspend and resume it.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5087544, KB5082200, KB5078885, KB5075912
+35 earlier KB5078129, KB5077796, KB5073724, KB5074976, KB5071546, KB5068781, KB5066791, KB5066198, KB5065429, KB5063842, KB5066188, KB5063709, KB5062649, KB5062554, KB5061087, KB5063159, KB5060533, KB5058481, KB5061979, KB5061768, KB5055612, KB5053643, KB5052077, KB5050081, KB5046714, KB5045594, KB5043131, KB5041582, KB5040525, KB5039299, KB5037849, KB5036979, KB5035941, KB5034843, KB5034203
Replaced by
KB5099539
VersionBuildChannel
21H2 19044.7417 General availability
22H2 19045.7417 General availability

Security

147 vulnerabilities fixed
17 critical 130 important
VulnerabilitySeverityCVSS
CVE-2026-47291
HTTP.sys Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-10263
ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]
 Critical 9.3
CVE-2026-40403
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-42985
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-47289
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-45607
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-45641
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-33828
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-35421
Windows GDI Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-44803
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-44812
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-48574
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-32161
Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-42992
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44799
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44801
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-48563
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-45586
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-49160
HTTP.sys Denial of Service Vulnerability
 Important 7.5
CVE-2026-50507
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.8

The table lists the 20 exploited, publicly disclosed or critical vulnerabilities. See all 147 vulnerabilities →

Updated components

1,861 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display47
Remote Desktop36
Secure Boot25
Networking24
Bluetooth18
Search15
Security and sign-in13
File Explorer and shell11
Storage and file systems11
Hyper-V and virtualization10
Audio8
Emoji and input7

Verified in package: changed files confirm File Explorer, Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. This update improves File Explorer search, including support for Chinese text, and UTF 8–encoded files without a byte order mark (BOM). Text now displays more clearly and consistently across search results, Content view, and tooltips. support.microsoft.com
  2. 2. This update enables dynamic status reporting for Secure Boot states in Windows Security App. support.microsoft.com
  3. 3. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. support.microsoft.com
  4. 4. some users might notice missing custom folder icons or localized folder names for content from downloaded or remote locations. Note that access to folders is not affected. support.microsoft.com
  5. 5. This update adds a new policy setting, LimitSecureBootRequiredServiceData, under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. support.microsoft.com
  6. 6. This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099539. support.microsoft.com
  7. 7. This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099539. support.microsoft.com
  8. 8. This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099539. support.microsoft.com
  9. 9. This issue is addressed in update KB5122878. After installing update KB5122878, devices with this incompatible group policy configuration are prevented from installing the 2023-signed Windows Boot Manager. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake