The Update BureauKB5094123: Cumulative update for Windows Server, version 2019, June 2026. HTTP.sys remote-code flaw patched; Outlook hangs fixed
A critical HTTP.sys remote-code flaw is patched, and an issue that could hang Outlook and other notification apps is resolved.
Does it affect you? Applies to: Devices running the x64 edition of Windows Server 2019. The update installs build 17763.8880.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Improvements 4 changes
Secure Boot
-
Secure Boot status reporting is enabled in the Windows Security app.1
Enables dynamic status reporting for Secure Boot states in Windows Security.
-
More devices that qualify can receive new Secure Boot certificates. They get the certificates after enough successful update signals.2
Windows quality updates include additional high confidence device targeting data. Certificate delivery remains a controlled, phased rollout.
Folder customization
-
Some downloaded or remote content might show missing custom folder icons or translated folder names. Folder access is not affected.3
A security hardening change affects how Windows processes
desktop.inifiles for content from downloaded or remote locations.
Servicing stack
For: Azure-hosted devices
-
The update improves checks that confirm whether a device is hosted on Azure.4
The SSU includes enhanced logic to verify whether a device is hosted on Azure, using an updated certificate chain for validation.
Fix 1 change
Windows Push Notification Services (WNS)
For: Users of Outlook and other apps that use WNS
-
The issue that could make Outlook and other apps stop responding is resolved.5
Resolves the underlying issue that might cause Microsoft Outlook and other applications using WNS to hang, and improves application reliability.
New feature 1 change
Secure Boot
-
A new setting lets administrators limit the Secure Boot data Windows sends to Microsoft.6
Adds
LimitSecureBootRequiredServiceDataunder Computer Configuration > Administrative Templates > Windows Components > Secure Boot. When enabled, it suppresses the event normally sent to Microsoft.
Known issues
-
Microsoft Office applications might fail to open from certain third-party apps
Some third-party apps that use OLE automation might fail to open Office apps or documents. KB5099538 resolves this issue.7
Resolution Fixed in KB5099538Install KB5099538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Deleting from recycle bin displays an internal file name
When you permanently delete one item, the confirmation dialog might show its internal Recycle Bin name instead of its original name. KB5099538 resolves this issue.8
Resolution Fixed in KB5099538Install KB5099538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
OneDrive shortcut in file explorer might not work in administrator mode
The OneDrive shortcut in File Explorer might not work when File Explorer runs with administrative privileges. This affects the built-in Administrator account and apps run as administrator. KB5099538 resolves this issue.9
Resolution Fixed in KB5099538Install KB5099538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-06-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5087538, KB5091573, KB5082123, KB5078752
- Replaced by
- KB5099538
| Version | Build | Channel |
|---|---|---|
| 2019 | 17763.8880 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
HTTP.sys Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Windows Deployment Services (WDS) Remote Code Execution
|
Critical | 8.1 |
|
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Graphics Component Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Windows Media Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Remote Desktop Client Remote Code Execution Vulnerability
|
Critical | 7.5 |
|
Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
|
Critical | 7.1 |
|
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
HTTP.sys Denial of Service Vulnerability
|
Important | 7.5 |
|
Windows BitLocker Security Feature Bypass Vulnerability
|
Important | 6.8 |
The table lists the 18 exploited, publicly disclosed or critical vulnerabilities. See all 89 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
628 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 14 |
| Secure Boot | 10 |
| Remote Desktop | 8 |
| Hyper-V and virtualization | 7 |
| Networking | 6 |
| Storage and file systems | 6 |
| Bluetooth | 5 |
| Security and sign-in | 5 |
| Audio | 4 |
| Search | 4 |
| File Explorer and shell | 3 |
| Kernel | 2 |
Verified in package: changed files confirm Secure Boot.
Sources
Cited passages from Microsoft's official notes (9)
-
1.
This update enables dynamic status reporting for Secure Boot states in Windows Security App.
support.microsoft.com -
2.
Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout.
support.microsoft.com -
3.
As a result, some users might notice missing custom folder icons or localized folder names for content from downloaded or remote locations. Note that access to folders is not affected.
support.microsoft.com -
4.
This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation.
support.microsoft.com -
5.
This update resolves the underlying issue and improves application reliability.
support.microsoft.com -
6.
When this setting is enabled, Windows limits the Secure Boot service data it sends by suppressing the event normally sent to Microsoft.
support.microsoft.com -
7.
This issue is resolved in Windows updates released on and after July 14, 2026 such as KB5099538.
support.microsoft.com -
8.
After you install Windows updates released on June 9, 2026, the confirmation dialog might display the internal Recycle Bin file name (for example, $Rxxxxx.ext) instead of the original file name when you permanently delete a single item.
support.microsoft.com -
9.
This issue affects only the built-in Administrator account or applications run using Run as administrator.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake