The Update BureauKB5094128: Cumulative update for Windows Server, version 2022, June 2026. Remote Desktop and HTTP.sys remote-code flaws addressed
Remote Desktop, HTTP.sys, Hyper-V, and other components receive security fixes. File Explorer search and app reliability also improve.
Does it affect you? Applies to: Systems running Windows Server 2022. The update package is for x64 systems.
Review notes Additional details from the official release notes (4) Read notes
- Known issues The Office-launch issue is resolved in updates released on or after July 14, 2026, including KB5099540.
- Known issues The Recycle Bin display issue is addressed in KB5099540.
- Known issues The OneDrive shortcut issue is addressed in KB5099540.
- Known issues The issue can affect the built-in Administrator account or applications run as administrator.
The official sources are linked at the end of the page.
What changes
Improvements 6 changes
Secure Boot
-
More eligible devices can receive new Secure Boot certificates automatically, in a controlled rollout.1
Quality updates include additional high-confidence device targeting data. Devices receive certificates only after sufficient successful update signals.
App
- Windows Security shows real-time status updates for Secure Boot.2
File Explorer
-
File Explorer search supports Chinese text and UTF-8 files without a byte order mark. Text is clearer across search results, Content view, and tooltips.3
Improves search support for UTF-8-encoded files without a byte order mark (BOM).
Texts and Fonts
- Windows fonts now include the Saudi Riyal currency symbol.4
Folder customization
-
A security change might hide some custom folder icons or localized names for content from downloaded or remote locations. Folder access is not affected.5
Changes how Windows processes
desktop.inifiles.
Servicing stack
-
The component that installs Windows updates receives quality improvements.6
Includes servicing stack update KB5094147, build 20348.5251.
Fix 1 change
Windows Push Notification Services (WNS)
-
Outlook and other apps that use push notifications are less likely to stop responding.7
Resolves the underlying issue that might cause apps using WNS to hang.
New feature 1 change
Secure Boot
-
Administrators can limit the Secure Boot service data Windows sends to Microsoft.8
Adds the
LimitSecureBootRequiredServiceDataGroup Policy and MDM setting under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. When enabled, it suppresses the event normally sent to Microsoft.
Known issues
-
Windows Server Update Services (WSUS) does not display error details
WSUS does not show synchronization error details after KB5070884 or later updates. Microsoft says this function was temporarily removed to address CVE-2025-59287.9
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
-
Microsoft Office applications might fail to open from certain third-party apps
Some third-party apps might fail to launch Office apps or open documents, sometimes without an error message. Reports include CCH Engagement, Workpaper Manager, Dentrix, Softdent, and Zotero.10
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
-
Deleting from recycle bin displays an internal file name
When permanently deleting one item, the confirmation dialog might show an internal file name instead of the original name. The Recycle Bin still shows the original name, and restoring the item keeps that name.11
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
-
OneDrive shortcut in file explorer might not work in administrator mode
The OneDrive shortcut in File Explorer might stop responding in administrator mode. OneDrive properties might be blank, and sync status icons might be missing; this affects the built-in Administrator account or apps run as administrator.12
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
-
Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
A limited number of systems might ask for the BitLocker recovery key once, after the first restart. This applies when BitLocker is on, the native UEFI policy includes PCR7, System Information reports PCR7 binding as “Not Possible,” the Windows UEFI CA 2023 certificate is in the Secure Boot database, and the device does not use the 2023-signed boot manager.13
How to apply the workaround Group PolicyChanging the policy and cycling BitLocker updates its bindings to use the Windows-selected default PCR profile.13
Step-by-step instructions, command & download kitShow steps & kit Hide steps & kit3 steps cmd.exe · Administrator Instructions (.txt)Step-by-step procedure- Before installing, set “Configure TPM platform validation profile for native UEFI firmware configurations” to Not Configured under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
- Run
gpupdate /forceon affected devices. - If BitLocker is enabled on C:, run the disable command, then the enable command.
> gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-06-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5087545, KB5091575, KB5082142, KB5078766
+37 earlier
KB5082314, KB5075906, KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129 - Replaced by
- KB5099540
| Version | Build | Channel |
|---|---|---|
| 2022 | 20348.5256 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Kernel Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
HTTP.sys Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Active Directory Domain Services Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
|
Critical | 8.4 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.2 |
|
Windows Deployment Services (WDS) Remote Code Execution
|
Critical | 8.1 |
|
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Media Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
|
Critical | 7.1 |
|
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
HTTP.sys Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows BitLocker Security Feature Bypass Vulnerability
|
Important | 6.8 |
The table lists the 23 exploited, publicly disclosed or critical vulnerabilities. See all 105 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
674 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Remote Desktop | 19 |
| Graphics and display | 13 |
| Secure Boot | 10 |
| Networking | 9 |
| Bluetooth | 5 |
| Hyper-V and virtualization | 5 |
| Search | 5 |
| Security and sign-in | 5 |
| File Explorer and shell | 4 |
| Kernel | 4 |
| Storage and file systems | 4 |
| Emoji and input | 2 |
Verified in package: changed files confirm Secure Boot, App, File Explorer.
Sources
Cited passages from Microsoft's official notes (13)
-
1.
With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates.
support.microsoft.com -
2.
This update improves visibility and reliability of device security by enabling real-time status updates for Secure Boot within the Windows Security app.
support.microsoft.com -
3.
This update improves File Explorer search, including support for Chinese text, and UTF 8–encoded files without a byte order mark (BOM).
support.microsoft.com -
4.
This update improves Windows fonts by adding the new Saudi Riyal currency symbol.
support.microsoft.com -
5.
As a result, some users might notice missing custom folder icons or localized folder names for content from downloaded or remote locations.
support.microsoft.com -
6.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
7.
This update addresses an issue that might cause Microsoft Outlook and other applications that use WNS to stop responding (hang).
support.microsoft.com -
8.
When enabled, Windows limits the Secure Boot service data it sends by suppressing the event normally sent to Microsoft.
support.microsoft.com -
9.
This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287.
support.microsoft.com -
10.
This issue affects certain third-party applications that use OLE automation to interact with Microsoft Office applications.
support.microsoft.com -
11.
After you install Windows updates released on June 9, 2026, the confirmation dialog might display the internal Recycle Bin file name (for example, $Rxxxxx.ext) instead of the original file name when you permanently delete a single item.
support.microsoft.com -
12.
This issue affects only the built-in Administrator account or applications run using Run as administrator.
support.microsoft.com -
13.
Run the following command on affected devices to propagate the policy change: gpupdate /force
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 13 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 3/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake