# KB5094122: June 2026 cumulative update for Windows 10 1607 KB5094122, released June 9, 2026, fixes 72 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/microsoft/kb5094122 - Platform: Microsoft - Released: Jun 9, 2026 - Priority: Urgent (Closes CVE-2026-49160, exploitation more likely) - CVEs: 72, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.microsoft.com/help/5094122 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows 10 Version 1607 for 32-bit Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-1607-for-32-bit-systems.md) | | 14393.9234 | | [Windows 10 Version 1607 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-10-version-1607-for-x64-based-systems.md) | | 14393.9234 | | [Windows Server 2016](https://patchblox.com/security/data/product/microsoft/windows-server-2016.md) | | 14393.9234 | | [Windows Server 2016 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2016-server-core-installation.md) | | 14393.9234 | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-49160](https://patchblox.com/security/data/cve/CVE-2026-49160.md) | Urgent | HTTP/2 | 7.5 | 0.5660 | Disclosed | | [CVE-2026-47291](https://patchblox.com/security/data/cve/CVE-2026-47291.md) | Urgent | Windows HTTP.sys | 9.8 | 0.2530 | More likely | | [CVE-2026-50508](https://patchblox.com/security/data/cve/CVE-2026-50508.md) | Urgent | Windows NTLM | 6.5 | 0.1144 | More likely | | [CVE-2026-50507](https://patchblox.com/security/data/cve/CVE-2026-50507.md) | Urgent | Windows BitLocker | 6.8 | 0.0502 | Disclosed | | [CVE-2026-45586](https://patchblox.com/security/data/cve/CVE-2026-45586.md) | Urgent | Windows Collaborative Translation Framework | 7.8 | 0.0363 | Disclosed | | [CVE-2026-42989](https://patchblox.com/security/data/cve/CVE-2026-42989.md) | Urgent | Winlogon | 7.8 | 0.0227 | More likely | | [CVE-2026-42905](https://patchblox.com/security/data/cve/CVE-2026-42905.md) | Urgent | Windows DWM Core Library | 7.8 | 0.0200 | More likely | | [CVE-2026-42986](https://patchblox.com/security/data/cve/CVE-2026-42986.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0200 | More likely | | [CVE-2026-42985](https://patchblox.com/security/data/cve/CVE-2026-42985.md) | Urgent | Remote Desktop Client | 8.8 | 0.0126 | More likely | | [CVE-2026-44815](https://patchblox.com/security/data/cve/CVE-2026-44815.md) | Urgent | Windows DHCP Client | 9.8 | 0.0110 | | | [CVE-2026-47289](https://patchblox.com/security/data/cve/CVE-2026-47289.md) | Urgent | Remote Desktop Client | 8.8 | 0.0095 | | | [CVE-2026-42987](https://patchblox.com/security/data/cve/CVE-2026-42987.md) | Urgent | Windows Deployment Services | 8.1 | 0.0059 | | | [CVE-2026-47654](https://patchblox.com/security/data/cve/CVE-2026-47654.md) | Urgent | Remote Desktop Client | 7.5 | 0.0055 | | | [CVE-2026-44803](https://patchblox.com/security/data/cve/CVE-2026-44803.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0052 | More likely | | [CVE-2026-44812](https://patchblox.com/security/data/cve/CVE-2026-44812.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0052 | More likely | | [CVE-2026-47288](https://patchblox.com/security/data/cve/CVE-2026-47288.md) | Urgent | Windows Kerberos | 7.1 | 0.0050 | | | [CVE-2026-42992](https://patchblox.com/security/data/cve/CVE-2026-42992.md) | Urgent | Remote Desktop Client | 7.5 | 0.0046 | | | [CVE-2026-44799](https://patchblox.com/security/data/cve/CVE-2026-44799.md) | Urgent | Remote Desktop Client | 7.5 | 0.0046 | | | [CVE-2026-44801](https://patchblox.com/security/data/cve/CVE-2026-44801.md) | Urgent | Remote Desktop Client | 7.5 | 0.0046 | | | [CVE-2026-48574](https://patchblox.com/security/data/cve/CVE-2026-48574.md) | Urgent | Windows Media | 7.8 | 0.0045 | | | [CVE-2026-45607](https://patchblox.com/security/data/cve/CVE-2026-45607.md) | Urgent | Windows Hyper-V | 8.4 | 0.0036 | | | [CVE-2026-45658](https://patchblox.com/security/data/cve/CVE-2026-45658.md) | Urgent | Windows BitLocker | 7.8 | 0.0035 | More likely | | [CVE-2026-33828](https://patchblox.com/security/data/cve/CVE-2026-33828.md) | Urgent | Microsoft Azure Attestation service and Device Health Attestation Service | 7.8 | 0.0031 | | | [CVE-2026-48573](https://patchblox.com/security/data/cve/CVE-2026-48573.md) | High | Windows Secure Boot | 7.9 | 0.0103 | | | [CVE-2026-48576](https://patchblox.com/security/data/cve/CVE-2026-48576.md) | High | Windows Secure Boot | 7.9 | 0.0103 | | | [CVE-2026-42908](https://patchblox.com/security/data/cve/CVE-2026-42908.md) | High | Windows RDP | 7.5 | 0.0087 | | | [CVE-2026-45639](https://patchblox.com/security/data/cve/CVE-2026-45639.md) | High | Windows RDP | 7.5 | 0.0087 | | | [CVE-2026-47653](https://patchblox.com/security/data/cve/CVE-2026-47653.md) | High | Remote Desktop Client | 8.8 | 0.0060 | | | [CVE-2026-45635](https://patchblox.com/security/data/cve/CVE-2026-45635.md) | High | Universal Plug and Play (upnp.dll) | 8.1 | 0.0056 | | | [CVE-2026-45599](https://patchblox.com/security/data/cve/CVE-2026-45599.md) | High | Universal Plug and Play (upnp.dll) | 8.1 | 0.0052 | | | [CVE-2026-45636](https://patchblox.com/security/data/cve/CVE-2026-45636.md) | High | Windows NTFS | 7.8 | 0.0041 | | | [CVE-2026-42909](https://patchblox.com/security/data/cve/CVE-2026-42909.md) | High | Remote Desktop Client | 7.5 | 0.0040 | | | [CVE-2026-45602](https://patchblox.com/security/data/cve/CVE-2026-45602.md) | High | Windows DHCP Server | 9.1 | 0.0037 | | | [CVE-2026-40404](https://patchblox.com/security/data/cve/CVE-2026-40404.md) | High | Windows Universal Disk Format File System Driver (UDFS) | 7.8 | 0.0034 | | | [CVE-2026-42916](https://patchblox.com/security/data/cve/CVE-2026-42916.md) | High | Windows NT OS Kernel | 7.8 | 0.0033 | | | [CVE-2026-45656](https://patchblox.com/security/data/cve/CVE-2026-45656.md) | High | Windows UEFI | 7.8 | 0.0032 | | | [CVE-2026-45588](https://patchblox.com/security/data/cve/CVE-2026-45588.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-47656](https://patchblox.com/security/data/cve/CVE-2026-47656.md) | High | Windows Boot Manager | 7.9 | 0.0030 | | | [CVE-2026-48568](https://patchblox.com/security/data/cve/CVE-2026-48568.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-48570](https://patchblox.com/security/data/cve/CVE-2026-48570.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-48575](https://patchblox.com/security/data/cve/CVE-2026-48575.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-41092](https://patchblox.com/security/data/cve/CVE-2026-41092.md) | High | Microsoft Kinect | 7.8 | 0.0030 | | | [CVE-2026-40409](https://patchblox.com/security/data/cve/CVE-2026-40409.md) | High | Windows Universal Disk Format File System Driver (UDFS) | 7.8 | 0.0030 | | | [CVE-2026-45592](https://patchblox.com/security/data/cve/CVE-2026-45592.md) | High | Windows Internet (wininet.dll) | 7.8 | 0.0029 | | | [CVE-2026-45605](https://patchblox.com/security/data/cve/CVE-2026-45605.md) | High | Windows Bluetooth Service | 7.8 | 0.0029 | | | [CVE-2026-41108](https://patchblox.com/security/data/cve/CVE-2026-41108.md) | High | Windows DNS | 7.0 | 0.0027 | | | [CVE-2026-48578](https://patchblox.com/security/data/cve/CVE-2026-48578.md) | High | Windows Secure Boot | 7.9 | 0.0027 | | | [CVE-2026-48583](https://patchblox.com/security/data/cve/CVE-2026-48583.md) | High | Windows Kernel | 7.8 | 0.0027 | | | [CVE-2026-45653](https://patchblox.com/security/data/cve/CVE-2026-45653.md) | High | Windows Kernel | 7.0 | 0.0025 | | | [CVE-2026-34335](https://patchblox.com/security/data/cve/CVE-2026-34335.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0023 | | | [CVE-2026-42911](https://patchblox.com/security/data/cve/CVE-2026-42911.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0023 | | | [CVE-2026-47648](https://patchblox.com/security/data/cve/CVE-2026-47648.md) | High | Windows Storage | 7.0 | 0.0022 | | | [CVE-2026-42836](https://patchblox.com/security/data/cve/CVE-2026-42836.md) | High | Function Discovery Service (fdwsd.dll) | 7.0 | 0.0020 | | | [CVE-2026-45596](https://patchblox.com/security/data/cve/CVE-2026-45596.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-45598](https://patchblox.com/security/data/cve/CVE-2026-45598.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-45601](https://patchblox.com/security/data/cve/CVE-2026-45601.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-45603](https://patchblox.com/security/data/cve/CVE-2026-45603.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-8863](https://patchblox.com/security/data/cve/CVE-2026-8863.md) | High | Windows UEFI | 7.8 | 0.0011 | | | [CVE-2026-42903](https://patchblox.com/security/data/cve/CVE-2026-42903.md) | Routine | Windows Kerberos | 6.5 | 0.0090 | | | [CVE-2026-42971](https://patchblox.com/security/data/cve/CVE-2026-42971.md) | Routine | Windows Push Notifications | 5.5 | 0.0046 | | | [CVE-2026-42972](https://patchblox.com/security/data/cve/CVE-2026-42972.md) | Routine | Role: Windows Hyper-V | 5.5 | 0.0046 | | | [CVE-2026-45595](https://patchblox.com/security/data/cve/CVE-2026-45595.md) | Routine | Windows Mark of the Web (MOTW) | 5.4 | 0.0042 | | | [CVE-2026-42970](https://patchblox.com/security/data/cve/CVE-2026-42970.md) | Routine | Windows Push Notifications | 5.5 | 0.0042 | | | [CVE-2026-42973](https://patchblox.com/security/data/cve/CVE-2026-42973.md) | Routine | Windows Push Notifications | 5.5 | 0.0042 | | | [CVE-2026-45655](https://patchblox.com/security/data/cve/CVE-2026-45655.md) | Routine | Windows BitLocker | 5.3 | 0.0041 | | | [CVE-2026-45594](https://patchblox.com/security/data/cve/CVE-2026-45594.md) | Routine | Windows Application Identity (AppID) Subsystem | 5.5 | 0.0040 | | | [CVE-2026-42969](https://patchblox.com/security/data/cve/CVE-2026-42969.md) | Routine | Windows Push Notifications | 5.5 | 0.0040 | | | [CVE-2026-42968](https://patchblox.com/security/data/cve/CVE-2026-42968.md) | Routine | Windows Telephony Service | 5.5 | 0.0039 | | | [CVE-2026-45606](https://patchblox.com/security/data/cve/CVE-2026-45606.md) | Routine | Microsoft UxTheme Library (uxtheme.dll) | 5.5 | 0.0038 | | | [CVE-2026-45634](https://patchblox.com/security/data/cve/CVE-2026-45634.md) | Routine | Windows DHCP Server | 5.5 | 0.0036 | | | [CVE-2026-45608](https://patchblox.com/security/data/cve/CVE-2026-45608.md) | Routine | Windows DHCP Client | 6.8 | 0.0034 | | | [CVE-2026-45642](https://patchblox.com/security/data/cve/CVE-2026-45642.md) | Routine | Microsoft Azure Attestation service and Device Health Attestation Service | 3.9 | 0.0032 | | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.