Microsoft · Security update · June 9, 2026

KB5094122: June 2026 cumulative update for Windows 10 1607

KB5094122, released June 9, 2026, fixes 72 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent3 publicly disclosed

CVEs closed

15 rated Critical

Exploited

None reported

Exploitation more likely

Microsoft's assessment

Highest EPSS

0.5660

99th percentile

Priority of the 72 CVEs

Patch now 0
                                Urgent 23
                                High 35
                                Routine 14

Applies to

Product	Build after install
Windows 10 Version 1607 for 32-bit Systems	14393.9234
Windows 10 Version 1607 for x64-based Systems	14393.9234
Windows Server 2016	14393.9234
Windows Server 2016 (Server Core installation)	14393.9234

CVEs this fix closes

Priority	CVE	Component	Impact	CVSS	EPSS	Exploitation
Urgent	CVE-2026-49160	HTTP/2	Denial of Service	7.5	0.5660	DisclosedMore likely
Urgent	CVE-2026-47291	Windows HTTP.sys	Remote Code Execution	9.8	0.2530	More likely
Urgent	CVE-2026-50508	Windows NTLM	Spoofing	6.5	0.1144	More likely
Urgent	CVE-2026-50507	Windows BitLocker	Security Feature Bypass	6.8	0.0502	DisclosedMore likely
Urgent	CVE-2026-45586	Windows Collaborative Translation Framework	Elevation of Privilege	7.8	0.0363	DisclosedMore likely
Urgent	CVE-2026-42989	Winlogon	Elevation of Privilege	7.8	0.0227	More likely
Urgent	CVE-2026-42905	Windows DWM Core Library	Elevation of Privilege	7.8	0.0200	More likely
Urgent	CVE-2026-42986	Microsoft Graphics Component	Elevation of Privilege	7.8	0.0200	More likely
Urgent	CVE-2026-42985	Remote Desktop Client	Remote Code Execution	8.8	0.0126	More likely
Urgent	CVE-2026-44815	Windows DHCP Client	Remote Code Execution	9.8	0.0110	Exploitation Less Likely
Urgent	CVE-2026-47289	Remote Desktop Client	Remote Code Execution	8.8	0.0095	Exploitation Less Likely
Urgent	CVE-2026-42987	Windows Deployment Services	Remote Code Execution	8.1	0.0059	Exploitation Less Likely
Urgent	CVE-2026-47654	Remote Desktop Client	Remote Code Execution	7.5	0.0055	Exploitation Unlikely
Urgent	CVE-2026-44803	Windows Win32K - GRFX	Remote Code Execution	7.8	0.0052	More likely
Urgent	CVE-2026-44812	Windows Win32K - GRFX	Remote Code Execution	7.8	0.0052	More likely
Urgent	CVE-2026-47288	Windows Kerberos	Remote Code Execution	7.1	0.0050	Exploitation Unlikely
Urgent	CVE-2026-42992	Remote Desktop Client	Remote Code Execution	7.5	0.0046	Exploitation Less Likely
Urgent	CVE-2026-44799	Remote Desktop Client	Remote Code Execution	7.5	0.0046	Exploitation Less Likely
Urgent	CVE-2026-44801	Remote Desktop Client	Remote Code Execution	7.5	0.0046	Exploitation Less Likely
Urgent	CVE-2026-48574	Windows Media	Remote Code Execution	7.8	0.0045	Exploitation Less Likely
Urgent	CVE-2026-45607	Windows Hyper-V	Remote Code Execution	8.4	0.0036	Exploitation Less Likely
Urgent	CVE-2026-45658	Windows BitLocker	Security Feature Bypass	7.8	0.0035	More likely
Urgent	CVE-2026-33828	Microsoft Azure Attestation service and Device Health Attestation Service	Elevation of Privilege	7.8	0.0031	Exploitation Unlikely
High	CVE-2026-48573	Windows Secure Boot	Security Feature Bypass	7.9	0.0103	Exploitation Less Likely
High	CVE-2026-48576	Windows Secure Boot	Security Feature Bypass	7.9	0.0103	Exploitation Less Likely

Released the same day

KB5002852
Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition)
KB5002873
Microsoft SharePoint Server Subscription Edition
KB5002874
Microsoft SharePoint Server 2019
KB5002875
Office Online Server
KB5002876
Microsoft SharePoint Server 2019
KB5002877
Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition)
KB5002878
Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition)
KB5002879
Microsoft Word 2016 (32-bit edition), Microsoft Word 2016 (64-bit edition)
KB5002880
Microsoft SharePoint Enterprise Server 2016
KB5002881
Microsoft SharePoint Enterprise Server 2016
KB5093998
Windows 11 Version 22H2 for ARM64-based Systems, Windows 11 Version 22H2 for x64-based Systems, Windows 11 Version 23H2 for ARM64-based Systems and 1 more
KB5094006
Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)

Vendor advisory

https://support.microsoft.com/help/5094122

Our write-up

June 2026 Patch Tuesday: 200 CVEs, Three Public Disclosures, and a New Record

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/microsoft/kb5094122">KB5094122 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which machines still need it?

Patchblox reads the OS build on every Windows machine, from Intune, ConfigMgr or its own agent, and shows which ones are still below the fixed build.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.