Skip to the content
The Update Bureau

Monthly Patch Briefing

June 2026

42 updates released this month .

Updates, page 2

Updates, page 2:
  • Windows 10 · 1809
    Windows 10 1809 Windows 10 1809 Security update Also for Windows Server
    KB5094123

    Remote Desktop Client flaws patched; Secure Boot reporting expands

    Secure Boot gets new status reporting and data controls, while a security change might hide some custom folder icons or names. Outlook and other apps that use push notifications get a fix for hangs.

    Build 17763.8880
    Security 85 CVEs 12 critical
    Replaced by KB5099538 →
  • Windows 10 · 1607
    Windows 10 1607 Windows 10 1607 Security update Also for Windows Server
    KB5094122

    Secure Boot reaches more devices; folder icons may disappear

    More devices can qualify for Secure Boot certificate updates, while stricter folder handling may hide custom icons or names. Support ends October 13, 2026.

    Build 14393.9234
    Security 73 CVEs 11 critical
    Replaced by KB5099535 →
  • Windows Server · 2025
    Windows Server 2025 Windows Server 2025 Security update
    KB5094125

    DNS over HTTPS arrives as Secure Boot coverage expands

    Windows Server 2025 DNS can now use encrypted server-to-client queries, while Secure Boot certificate rollout reaches more eligible devices. The update also resolves an issue that could make Outlook and other WNS apps stop responding.

    Build 26100.32995
    Security 109 CVEs 20 critical
    Known issues 1 open
    Replaced by KB5099536 →
  • Windows Server · 2022
    Windows Server 2022 Windows Server 2022 Security update
    KB5094128

    Remote Desktop and HTTP.sys remote-code flaws addressed

    Remote Desktop, HTTP.sys, Hyper-V, and other components receive security fixes. File Explorer search and app reliability also improve.

    Build 20348.5256
    Security 105 CVEs 20 critical
    Known issues 2 open
    Replaced by KB5099540 →
  • Windows Server · 2019
    Windows Server 2019 Windows Server 2019 Security update Also for Windows 10
    KB5094123

    HTTP.sys remote-code flaw patched; Outlook hangs fixed

    A critical HTTP.sys remote-code flaw is patched, and an issue that could hang Outlook and other notification apps is resolved.

    Build 17763.8880
    Security 89 CVEs 15 critical
    Replaced by KB5099538 →
  • Windows Server · 2016
    Windows Server 2016 Windows Server 2016 Security update Also for Windows 10
    KB5094122

    Secure Boot controls added; DFS fixed for 15-character hostnames

    A new Secure Boot policy limits data sent to Microsoft, and more eligible devices can receive updated certificates. The update also fixes DFS Namespaces on servers with exactly 15-character hostnames.

    Build 14393.9234
    Security 76 CVEs 14 critical
    Replaced by KB5099535 →
  • Exchange Server · RTM
    Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
    Zero-day
    KB5094139

    Critical exploited spoofing flaw patched; mitigation services recover

    The update addresses Exchange vulnerabilities, including the actively exploited critical spoofing flaw CVE-2026-42897. It lists eight CVEs, but does not include the fix for CVE-2026-45583; follow that CVE’s guidance.

    Build 15.2.2562.43
    Security 8 CVEs 1 critical 1 exploited
    Replaced by KB5103212 →
  • Exchange Server · CU15
    Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
    Zero-day
    KB5094140

    Mail-server spoofing flaw patched; one remote-code flaw remains open

    The update closes Exchange Server vulnerabilities, including a critical spoofing flaw known to be exploited. It does not include a fix for CVE-2026-45583; follow that CVE’s documentation for instructions.

    Build 15.2.1748.46
    Security 8 CVEs 1 critical 1 exploited
    Replaced by KB5103213 →
  • Exchange Server · CU14
    Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
    Zero-day
    KB5094142

    Actively exploited spoofing flaw; mitigation services error fixed

    The update addresses seven of the eight listed vulnerabilities, including the critical, actively exploited Exchange spoofing flaw; it does not include the fix for CVE-2026-45583. It also fixes an “Unknown Issuer” error in mitigation and flighting services.

    Build 15.2.1544.41
    Security 8 CVEs 1 critical 1 exploited
    Replaced by KB5103214 →
  • Exchange Server · CU23
    Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    Zero-day
    KB5094144

    Exchange spoofing flaw exploited; mitigation services error fixed

    The update addresses Exchange Server vulnerabilities, including an actively exploited critical spoofing flaw. It does not include the fix for CVE-2026-45583.

    Build 15.1.2507.69
    Security 8 CVEs 1 critical 1 exploited
    Replaced by KB5103215 →
  • SharePoint Server · SE
    SharePoint Server SE SharePoint Server SE Security update
    Zero-day
    KB5002873

    Closes exploited remote-code execution flaw; adds 26H1 features

    Closes an actively exploited SharePoint remote-code execution flaw (CVE-2026-58644), among 32 vulnerabilities, and introduces the 26H1 feature update alongside several fixes.

    Build 16.0.19725.20384
    Security 32 CVEs 3 critical 1 exploited
    Replaced by KB5002882 →
  • SharePoint Server · 2019
    SharePoint Server 2019 SharePoint Server 2019 Security update
    Zero-day
    KB5002874

    Actively exploited remote-code flaw patched; 2019 updates end July 14

    Fixes security vulnerabilities in SharePoint Server 2019, including an actively exploited remote-code flaw. Updates for this version end July 14, 2026.

    Build 16.0.10417.20153
    Security 32 CVEs 3 critical 1 exploited
    Replaced by KB5002883 →
  • SharePoint Server · 2016
    SharePoint Server 2016 SharePoint Server 2016 Security update
    Zero-day
    KB5002880

    Actively exploited remote-code flaw patched before support ends

    The update patches an actively exploited remote-code execution flaw and other vulnerabilities. SharePoint Server 2016 updates end on July 14, 2026.

    Build 16.0.5556.1005
    Security 30 CVEs 3 critical 1 exploited
    Replaced by KB5002891 →
  • Office Online Server OOS Office Online Server Security update
    KB5002875

    Excel remote code execution and information disclosure flaws addressed

    Addresses seven Important vulnerabilities, including Excel flaws that could allow remote code execution or information disclosure. Office Online Server updates end on December 31, 2026.

    Build 16.0.10417.20137
    Security 7 CVEs
    Replaced by KB5002884 →
  • Windows 11 · 26H1
    Windows 11 Windows 11 Insider 26H1 Insider Preview
    Experimental Channel
    Build 28120.2242

    Administrator Protection toggle in Settings

    The Experimental Channel is gradually getting a Settings toggle to enable Administrator Protection. A restart is required.

    Changes 1 new · 1 fix
  • Windows 11 · 26H1
    Windows 11 Windows 11 Insider 26H1 Insider Preview
    Beta Channel
    Build 28020.2236

    Minor bugs fixed, with other improvements

    Includes a small number of minor bug fixes and improvements; the release notes do not identify them individually.

    Changes 1 improved · 1 fix
  • Windows 11 · 25H2
    Windows 11 Windows 11 Insider 25H2 Insider Preview
    Beta Channel
    Build 26220.8575

    Update pauses can be extended; audio and app freezes fixed

    Beta Channel Insiders can extend update pauses as many times as needed. The build also fixes audio, Installed Apps settings reliability, and freezes in search, Notepad, and other scenarios.

    Changes 1 new · 3 fixes