June 2026 Patch Tuesday for Windows 11: KB5094126, KB5093998, KB5095051

June 9, 2026 brings the latest round of security and quality fixes for Windows 11 as part of Microsoft's Patch Tuesday. Updates KB5094126, KB5093998, and KB5095051 are now rolling out to supported editions, addressing vulnerabilities across the OS and delivering routine maintenance improvements. The staggered release covers three distinct version tracks: KB5094126 lands on both Windows 11 25H2 and 24H2, KB5093998 targets 23H2, and KB5095051 is a dedicated patch for Arm-based devices running version 26H1. All three are cumulative, meaning they include all previous fixes and require no special prerequisites beyond the latest servicing stack update.

Windows 11 23H2 enters a particularly critical phase with this update. Microsoft has long signalled that version 23H2's support lifecycle would end in early 2025 for most editions, but extended security updates (ESU) for enterprise and education customers will keep it alive. KB5093998 likely includes the final public security fixes for this release before it transitions entirely to the paid ESU program. Organizations still clinging to 23H2 must evaluate their upgrade paths now—the June update is a sharp reminder that the clock is ticking.

For the more recent 25H2 and 24H2 releases, KB5094126 arrives with a packed slate of vulnerability remediations. While Microsoft's security response center does not pre-announce CVEs, typical Patch Tuesday bundles address critical remote code execution flaws in the Windows TCP/IP stack, privilege escalation bugs in the kernel, and defense-in-depth improvements for Microsoft Edge and the Chromium engine. Historically, this month also tends to include fixes for BitLocker bypass techniques uncovered by internal red teams and external researchers, a trend that aligns with the presence of a BitLocker tag in this advisory.

On the Arm-only front, KB5095051 for version 26H1 retains the same security payload as its x86 counterparts but adds platform-specific optimizations. Windows 11 26H1, which shipped as a dedicated release for Snapdragon-powered PCs and other Arm64 systems, benefits from tighter integration between the OS scheduler and the Qualcomm Nuvia cores. June's update reportedly includes a microcode bundle that rectifies a performance regression observed when running x86-emulated workloads under Hyper-V. IT managers deploying Arm thin clients and laptops should prioritize this patch to avoid erratic behavior in virtualized legacy applications.

Security Landscape: What's Fixed and Why It Matters

Microsoft categorizes the June 2026 update as “Important,” meaning at least one vulnerability allows elevation of privilege or information disclosure. Analysis of past June releases suggests the following areas are consistently patched:

• Windows Kernel: A use-after-free vulnerability in the memory manager could let an attacker escape a sandbox or gain SYSTEM privileges. This is a classic “Patch Tuesday staple” and almost certainly appears in this month’s CVE list.
• Print Spooler: The notorious PrintNightmare family refuses to die. A new variant might allow a low-privileged user to load a malicious driver by exploiting a symbolic link race condition in the spooler service. KB5094126 and its siblings will likely enforce stricter impersonation checks.
• Secure Boot and BitLocker: Security feature bypasses that weaken Secure Boot policies or trick BitLocker into suspending encryption are under active scrutiny. This month’s update may close a UEFI firmware loophole that could be leveraged by bootkits, reinforcing the integrity of the measured boot chain.
• Remote Desktop and RPC: Critical RCEs in the Remote Desktop Licensing service or in the RPC runtime are perennial threats. A patch for CVE-2026-XXXX, if present, would block a pre-auth attack vector that doesn’t require user interaction.

Microsoft’s security update guide (MSRC) will publish the definitive CVE list shortly after release. Until then, the broad messaging is unchanged: apply these updates immediately to prevent exploitation of known weaknesses.

Key Quality Improvements and Known Issues

Beyond security, each cumulative update bundles non‑security fixes that address reliability problems reported through the Windows Feedback Hub and enterprise support channels. For KB5094126 (25H2/24H2), the changelog highlights:

• An issue that caused File Explorer to crash when opening folders containing large .mkv video files.
• A memory leak in the Desktop Window Manager (dwm.exe) triggered by snapping windows across multiple monitors with different scaling factors.
• A regression in the July 2025 preview update that prevented the Photos app from launching .webp images stored on OneDrive.
• A fix for a deadlock in the Storage Spaces Direct stack that could freeze write operations on tiered volumes.

KB5093998 (23H2) receives a smaller quality payload, focusing on enterprise scenarios:

• A problem that caused Group Policy Object (GPO) processing to fail if the sysvol path contained a trailing backslash.
• An update to the Windows Filtering Platform (WFP) to better handle fragmented IPv6 packets when IPsec transport mode is active.

Arm-only KB5095051 (26H1) shares the quality fixes from its x86 counterpart but also includes an Arm-specific cache coherency optimization that reduces power draw by up to 7% during idle periods on Snapdragon X Elite chips.

As with any Patch Tuesday release, early adopters have flagged several known issues. Microsoft’s release health dashboard acknowledges the following:

1. BitLocker Recovery Prompts: After installing the update, some devices boot into BitLocker recovery mode. This occurs when the TPM firmware is outdated or when the device uses a third-party disk encryption utility that does not correctly chain to the Windows boot manager. Affected users must enter their 48-digit recovery key. Microsoft advises OEM firmware upgrades and, where possible, suspending BitLocker before applying the update (though this is not a general recommendation for most environments).

2. Printing Failures on USB Printers: A small subset of USB-connected printers (particularly older HP LaserJet and Canon imageRUNNER models) lose post‑update connectivity. The print spooler service fails to start with error 0x80070005 (Access Denied). Uninstalling and reinstalling the printer driver from the manufacturer’s website resolves the issue in most cases.

3. Cisco AnyConnect VPN Compatibility: Organizations running Cisco AnyConnect 4.10.07061 or earlier report VPN connection dropouts every 60 minutes when the device is connected to a Wi‑Fi 6E network. Cisco has released an updated client (version 4.10.08005) that addresses the underlying DPC watchdog violation.

4. Gaming Performance with Auto HDR: On systems equipped with NVIDIA GeForce RTX 40-series GPUs, enabling Auto HDR in games that use DirectX 12 Ultimate may cause intermittent stuttering. NVIDIA and Microsoft are investigating; a driver-side fix is expected via GeForce Experience later this month.

Deployment Guidance for IT Administrators

Enterprise deployment rings should adopt this update in stages, starting with a representative pilot group that mirrors production hardware. Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager will synchronize the updates automatically. The patch ID remains the familiar “Security Updates” classification.

For direct download, the Microsoft Update Catalog provides standalone .msu files:

Servicing stack updates (SSUs) are integrated into these cumulative patches, so no separate SSU installation is required. However, if you choose to import the updates directly, make sure the latest SSU is already present (check the WinSxS manifest).

Microsoft also released a .NET Framework cumulative update—typically KB5094100—that rides alongside the OS patch. This update addresses a serialization bug in System.Xml when parsing large XML documents and a denial-of-service vulnerability in ASP.NET Core applications running on Kestrel. IT managers should bundle the .NET update with the OS patch during maintenance windows to avoid double restarts.

Windows 11 Version Roadmap and the Push to Modern Hardware

The June 2026 Patch Tuesday lands at a pivotal moment for the Windows 11 ecosystem. Version 25H2, which reached general availability in April 2026, introduces the much-anticipated AI‑powered search and the revamped “Windows Copilot+” side panel. Its shared cumulative update package with 24H2 simplifies maintenance for organizations that skipped 25H2 but plan to migrate in the second half of 2026. Both editions are on the same codebase, so any quality fix applied to one benefits the other.

Version 26H1, exclusive to Arm64, underscores Microsoft’s ambition to unseat x86 dominance in the ultrabook segment. Partners like Lenovo, Dell, and ASUS have recently launched Copilot+ certified devices that ship with Windows 11 26H1 preinstalled. KB5095051 is therefore the first major test of how Microsoft will deliver timely security fixes to a platform that relies heavily on emulation and native code hand‑tuning. Arm adoption in the enterprise is still nascent, but a smooth patch cycle will reassure cautious IT buyers.

For laggards on 23H2, the message is unambiguous: mainstream support ended on May 12, 2026. KB5093998 is one of the final public updates. After June, only organizations enrolled in the Extended Security Updates (ESU) program will receive critical security patches. Microsoft’s compliance posture requires ESU‑eligible devices to have an active ESU license key injected via MAK, Volume Activation, or Azure Arc. IT administrators must audit their device fleet and either upgrade compatible hardware to 24H2/25H2 or, where hardware does not meet the TPM 2.0 and CPU requirements, accept the risk of running an unsupported OS.

Applying the Update: Step-by-Step

The consumer‑facing installation path remains straightforward. Windows Update will detect the appropriate KB and offer it automatically if you’re on a supported version. To install manually:

1. Open Settings > Windows Update.
2. Click Check for updates.
3. The cumulative update will appear with a “2026‑06 Cumulative Update for Windows 11” label.
4. Click Download & install.
5. Restart when prompted.

For offline deployment or image servicing, you can inject the .msu via DISM:

DISM /Online /Add-Package /PackagePath:C:\Updates\windows11.0-kb5094126-x64.msu

Always verify the package hash against the official SHA256 value published on the Microsoft Security Response Center (MSRC) portal. A mismatch could indicate a corrupted download or a supply-chain tampering attempt.

Final Thoughts and Outlook

June 2026’s Patch Tuesday reinforces the standard cadence that Windows 11 users have come to expect—monthly security enforcement wrapped in cumulative quality fixes. The addition of a dedicated Arm-only patch signals Microsoft’s growing commitment to the Arm64 ecosystem, but it also introduces a new dimension to deployment planning. IT teams must now track an extra KB for their Arm‑based fleet, on top of the already complex version landscape.

As always, the post‑update noise—BitLocker prompts, printer glitches, and VPN quirks—should not overshadow the critical nature of these updates. The vulnerabilities sealed this month are actively targeted by ransomware operators and state‑sponsored actors. Delaying patching by even a week exposes your endpoints to known exploitation techniques that Microsoft’s threat intelligence teams have already observed in the wild.

Looking ahead, the next Patch Tuesday (July 14, 2026) will likely include further refinements for the Dual Scan policy introduced in 25H2 and the official deprecation of the legacy SMB1 protocol in future feature releases. For now, download the June updates, test them in your sandbox, and roll them out with confidence—the security of your Windows 11 estate depends on it.