Skip to the content
The Update Bureau
Windows Server 2016 Windows Server 2016 Security update
Patch Tuesday

KB5094122

KB5094122: Cumulative update for Windows Server, version 2016, June 2026. Secure Boot controls added; DFS fixed for 15-character hostnames

In short

A new Secure Boot policy limits data sent to Microsoft, and more eligible devices can receive updated certificates. The update also fixes DFS Namespaces on servers with exactly 15-character hostnames.

Does it affect you? Applies to: Devices running Windows Server 2016, updated to OS build 14393.9234.

Build
14393.9234
Security
76 fixed · 14 critical
Restart
Required

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 2 changes

Secure Boot

Gradual rollout Verified in package

For: Devices eligible for new Secure Boot certificates

  • More eligible devices can receive new Secure Boot certificates automatically after showing enough successful update signals.1
    Windows quality updates include additional high confidence device targeting data. Certificate delivery remains phased.

Folder customization

For: Users of downloaded or remote folder content

  • Some downloaded or remote folders might lose custom icons or localized names. Folder access is not affected.2
    Adds a security hardening change to how Windows processes desktop.ini files.

Fix 1 change

Domain controller (known issue)

For: Servers with 15-character hostnames

  • DFS Namespaces work again on servers with hostnames that are exactly 15 characters long.3
    Addresses an issue affecting DFS Namespaces on servers with hostnames that are exactly 15 characters long.

New feature 1 change

Secure Boot

Verified in package
  • Administrators can use a new policy to limit the Secure Boot data Windows sends to Microsoft.4
    Adds LimitSecureBootRequiredServiceData under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. The policy is also included in the Windows Restricted Traffic Limited Functionality Baseline package.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5099535

    Microsoft Office applications might fail to open from certain third-party apps

    Some third-party apps might fail to open Microsoft Office apps or documents. KB5099535 resolves this issue.5

    Resolution Fixed in KB5099535

    Install KB5099535 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  2. Resolved Affects: Everyone Resolved by KB5099535

    Deleting from recycle bin displays an internal file name

    When you permanently delete one item, the confirmation box might show an internal file name instead of the original name. KB5099535 resolves this issue.6

    Resolution Fixed in KB5099535

    Install KB5099535 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  3. Resolved Affects: Everyone Resolved by KB5099535

    OneDrive shortcut in file explorer might not work in administrator mode

    The OneDrive shortcut in File Explorer might not work when File Explorer runs with administrator privileges. KB5099535 resolves this issue.7

    Resolution Fixed in KB5099535

    Install KB5099535 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5087537, KB5091572, KB5082198, KB5078938
+20 earlier KB5075999, KB5073722, KB5074974, KB5071543, KB5068864, KB5070882, KB5066836, KB5065427, KB5063871, KB5062560, KB5061010, KB5058383, KB5058921, KB5055521, KB5053594, KB5052006, KB5049993, KB5048671, KB5046612, KB5037423
Replaced by
KB5099535
VersionBuildChannel
2016 14393.9234 General availability

Security

76 vulnerabilities fixed
14 critical 62 important
VulnerabilitySeverityCVSS
CVE-2026-47291
HTTP.sys Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-42985
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-47289
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-45607
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-42987
Windows Deployment Services (WDS) Remote Code Execution
 Critical 8.1
CVE-2026-33828
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
 Critical 7.8
CVE-2026-44803
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-44812
Windows Graphics Component Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-48574
Windows Media Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-42992
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44799
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-44801
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-47654
Remote Desktop Client Remote Code Execution Vulnerability
 Critical 7.5
CVE-2026-47288
Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
 Critical 7.1
CVE-2026-45586
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-49160
HTTP.sys Denial of Service Vulnerability
 Important 7.5
CVE-2026-50507
Windows BitLocker Security Feature Bypass Vulnerability
 Important 6.8

The table lists the 17 exploited, publicly disclosed or critical vulnerabilities. See all 76 vulnerabilities →

Updated components

433 files changed since the previous update for the same versions.

Top changed componentsFiles
Graphics and display12
Secure Boot9
Remote Desktop7
Hyper-V and virtualization6
Networking6
Bluetooth5
Search4
Security and sign-in4
File Explorer and shell3
Storage and file systems3
Kernel2
Settings2

Verified in package: changed files confirm Secure Boot.

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. As a result, some users might notice missing custom folder icons or localized folder names for content from downloaded or remote locations. Note that access to folders is not affected. support.microsoft.com
  3. 3. Fixed: Addressed an issue that affects DFS (Distributed File System) Namespaces on servers with hostnames that are exactly 15 characters long. support.microsoft.com
  4. 4. When this setting is enabled, Windows limits the Secure Boot service data it sends by suppressing the event normally sent to Microsoft. support.microsoft.com
  5. 5. This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099535. support.microsoft.com
  6. 6. This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099535. support.microsoft.com
  7. 7. This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099535. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake