# KB5094041: June 2026 security update KB5094041, released June 9, 2026, fixes 63 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/microsoft/kb5094041 - Platform: Microsoft - Released: Jun 9, 2026 - Priority: Urgent (Closes CVE-2026-47291, exploitation more likely) - CVEs: 63, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.microsoft.com/help/5094041 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2012 R2](https://patchblox.com/security/data/product/microsoft/windows-server-2012-r2.md) | | | | [Windows Server 2012 R2 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2012-r2-server-core-installation.md) | | | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-47291](https://patchblox.com/security/data/cve/CVE-2026-47291.md) | Urgent | Windows HTTP.sys | 9.8 | 0.2530 | More likely | | [CVE-2026-50508](https://patchblox.com/security/data/cve/CVE-2026-50508.md) | Urgent | Windows NTLM | 6.5 | 0.1144 | More likely | | [CVE-2026-50507](https://patchblox.com/security/data/cve/CVE-2026-50507.md) | Urgent | Windows BitLocker | 6.8 | 0.0502 | Disclosed | | [CVE-2026-45586](https://patchblox.com/security/data/cve/CVE-2026-45586.md) | Urgent | Windows Collaborative Translation Framework | 7.8 | 0.0363 | Disclosed | | [CVE-2026-42989](https://patchblox.com/security/data/cve/CVE-2026-42989.md) | Urgent | Winlogon | 7.8 | 0.0227 | More likely | | [CVE-2026-42905](https://patchblox.com/security/data/cve/CVE-2026-42905.md) | Urgent | Windows DWM Core Library | 7.8 | 0.0200 | More likely | | [CVE-2026-42986](https://patchblox.com/security/data/cve/CVE-2026-42986.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0200 | More likely | | [CVE-2026-42985](https://patchblox.com/security/data/cve/CVE-2026-42985.md) | Urgent | Remote Desktop Client | 8.8 | 0.0126 | More likely | | [CVE-2026-44815](https://patchblox.com/security/data/cve/CVE-2026-44815.md) | Urgent | Windows DHCP Client | 9.8 | 0.0110 | | | [CVE-2026-47289](https://patchblox.com/security/data/cve/CVE-2026-47289.md) | Urgent | Remote Desktop Client | 8.8 | 0.0095 | | | [CVE-2026-48564](https://patchblox.com/security/data/cve/CVE-2026-48564.md) | Urgent | Windows DHCP Server | 8.8 | 0.0091 | | | [CVE-2026-42987](https://patchblox.com/security/data/cve/CVE-2026-42987.md) | Urgent | Windows Deployment Services | 8.1 | 0.0059 | | | [CVE-2026-44803](https://patchblox.com/security/data/cve/CVE-2026-44803.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0052 | More likely | | [CVE-2026-44812](https://patchblox.com/security/data/cve/CVE-2026-44812.md) | Urgent | Windows Win32K - GRFX | 7.8 | 0.0052 | More likely | | [CVE-2026-47288](https://patchblox.com/security/data/cve/CVE-2026-47288.md) | Urgent | Windows Kerberos | 7.1 | 0.0050 | | | [CVE-2026-44799](https://patchblox.com/security/data/cve/CVE-2026-44799.md) | Urgent | Remote Desktop Client | 7.5 | 0.0046 | | | [CVE-2026-44801](https://patchblox.com/security/data/cve/CVE-2026-44801.md) | Urgent | Remote Desktop Client | 7.5 | 0.0046 | | | [CVE-2026-48574](https://patchblox.com/security/data/cve/CVE-2026-48574.md) | Urgent | Windows Media | 7.8 | 0.0045 | | | [CVE-2026-45658](https://patchblox.com/security/data/cve/CVE-2026-45658.md) | Urgent | Windows BitLocker | 7.8 | 0.0035 | More likely | | [CVE-2026-48573](https://patchblox.com/security/data/cve/CVE-2026-48573.md) | High | Windows Secure Boot | 7.9 | 0.0103 | | | [CVE-2026-48576](https://patchblox.com/security/data/cve/CVE-2026-48576.md) | High | Windows Secure Boot | 7.9 | 0.0103 | | | [CVE-2026-42990](https://patchblox.com/security/data/cve/CVE-2026-42990.md) | High | SQL Server ODBC driver | 9.8 | 0.0097 | | | [CVE-2026-42908](https://patchblox.com/security/data/cve/CVE-2026-42908.md) | High | Windows RDP | 7.5 | 0.0087 | | | [CVE-2026-45639](https://patchblox.com/security/data/cve/CVE-2026-45639.md) | High | Windows RDP | 7.5 | 0.0087 | | | [CVE-2026-47653](https://patchblox.com/security/data/cve/CVE-2026-47653.md) | High | Remote Desktop Client | 8.8 | 0.0060 | | | [CVE-2026-45635](https://patchblox.com/security/data/cve/CVE-2026-45635.md) | High | Universal Plug and Play (upnp.dll) | 8.1 | 0.0056 | | | [CVE-2026-45599](https://patchblox.com/security/data/cve/CVE-2026-45599.md) | High | Universal Plug and Play (upnp.dll) | 8.1 | 0.0052 | | | [CVE-2026-45636](https://patchblox.com/security/data/cve/CVE-2026-45636.md) | High | Windows NTFS | 7.8 | 0.0041 | | | [CVE-2026-42909](https://patchblox.com/security/data/cve/CVE-2026-42909.md) | High | Remote Desktop Client | 7.5 | 0.0040 | | | [CVE-2026-45602](https://patchblox.com/security/data/cve/CVE-2026-45602.md) | High | Windows DHCP Server | 9.1 | 0.0037 | | | [CVE-2026-40404](https://patchblox.com/security/data/cve/CVE-2026-40404.md) | High | Windows Universal Disk Format File System Driver (UDFS) | 7.8 | 0.0034 | | | [CVE-2026-42916](https://patchblox.com/security/data/cve/CVE-2026-42916.md) | High | Windows NT OS Kernel | 7.8 | 0.0033 | | | [CVE-2026-45656](https://patchblox.com/security/data/cve/CVE-2026-45656.md) | High | Windows UEFI | 7.8 | 0.0032 | | | [CVE-2026-45588](https://patchblox.com/security/data/cve/CVE-2026-45588.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-47656](https://patchblox.com/security/data/cve/CVE-2026-47656.md) | High | Windows Boot Manager | 7.9 | 0.0030 | | | [CVE-2026-48568](https://patchblox.com/security/data/cve/CVE-2026-48568.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-48570](https://patchblox.com/security/data/cve/CVE-2026-48570.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-48575](https://patchblox.com/security/data/cve/CVE-2026-48575.md) | High | Windows Secure Boot | 7.9 | 0.0030 | | | [CVE-2026-41092](https://patchblox.com/security/data/cve/CVE-2026-41092.md) | High | Microsoft Kinect | 7.8 | 0.0030 | | | [CVE-2026-40409](https://patchblox.com/security/data/cve/CVE-2026-40409.md) | High | Windows Universal Disk Format File System Driver (UDFS) | 7.8 | 0.0030 | | | [CVE-2026-45592](https://patchblox.com/security/data/cve/CVE-2026-45592.md) | High | Windows Internet (wininet.dll) | 7.8 | 0.0029 | | | [CVE-2026-41108](https://patchblox.com/security/data/cve/CVE-2026-41108.md) | High | Windows DNS | 7.0 | 0.0027 | | | [CVE-2026-48578](https://patchblox.com/security/data/cve/CVE-2026-48578.md) | High | Windows Secure Boot | 7.9 | 0.0027 | | | [CVE-2026-45653](https://patchblox.com/security/data/cve/CVE-2026-45653.md) | High | Windows Kernel | 7.0 | 0.0025 | | | [CVE-2026-34335](https://patchblox.com/security/data/cve/CVE-2026-34335.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0023 | | | [CVE-2026-42911](https://patchblox.com/security/data/cve/CVE-2026-42911.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0023 | | | [CVE-2026-47648](https://patchblox.com/security/data/cve/CVE-2026-47648.md) | High | Windows Storage | 7.0 | 0.0022 | | | [CVE-2026-42836](https://patchblox.com/security/data/cve/CVE-2026-42836.md) | High | Function Discovery Service (fdwsd.dll) | 7.0 | 0.0020 | | | [CVE-2026-45596](https://patchblox.com/security/data/cve/CVE-2026-45596.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-45598](https://patchblox.com/security/data/cve/CVE-2026-45598.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-45601](https://patchblox.com/security/data/cve/CVE-2026-45601.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-45603](https://patchblox.com/security/data/cve/CVE-2026-45603.md) | High | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0018 | | | [CVE-2026-8863](https://patchblox.com/security/data/cve/CVE-2026-8863.md) | High | Windows UEFI | 7.8 | 0.0011 | | | [CVE-2026-42903](https://patchblox.com/security/data/cve/CVE-2026-42903.md) | Routine | Windows Kerberos | 6.5 | 0.0090 | | | [CVE-2026-42972](https://patchblox.com/security/data/cve/CVE-2026-42972.md) | Routine | Role: Windows Hyper-V | 5.5 | 0.0046 | | | [CVE-2026-45595](https://patchblox.com/security/data/cve/CVE-2026-45595.md) | Routine | Windows Mark of the Web (MOTW) | 5.4 | 0.0042 | | | [CVE-2026-42970](https://patchblox.com/security/data/cve/CVE-2026-42970.md) | Routine | Windows Push Notifications | 5.5 | 0.0042 | | | [CVE-2026-45655](https://patchblox.com/security/data/cve/CVE-2026-45655.md) | Routine | Windows BitLocker | 5.3 | 0.0041 | | | [CVE-2026-42968](https://patchblox.com/security/data/cve/CVE-2026-42968.md) | Routine | Windows Telephony Service | 5.5 | 0.0039 | | | [CVE-2026-45606](https://patchblox.com/security/data/cve/CVE-2026-45606.md) | Routine | Microsoft UxTheme Library (uxtheme.dll) | 5.5 | 0.0038 | | | [CVE-2026-45634](https://patchblox.com/security/data/cve/CVE-2026-45634.md) | Routine | Windows DHCP Server | 5.5 | 0.0036 | | | [CVE-2026-45608](https://patchblox.com/security/data/cve/CVE-2026-45608.md) | Routine | Windows DHCP Client | 6.8 | 0.0034 | | | [CVE-2026-45642](https://patchblox.com/security/data/cve/CVE-2026-45642.md) | Routine | Microsoft Azure Attestation service and Device Health Attestation Service | 3.9 | 0.0032 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo