Patch tracker / KB5087539

KB5087539

Microsoft security update released 2026-06-09. Fixes 66 CVEs.

Critical

Download KB5087539

Get the official update for KB5087539. The download and file size for each supported product are on the Microsoft Update Catalog page.

Microsoft Update Catalog: download KB5087539 Microsoft support article

Update summary

Released

2026-06-09

CVEs fixed

66

Max CVSS

9.8

Severity

Critical

Exploitation and severity

Fixes 66 CVEs. Most severe CVSS 9.8 (Critical). EPSS exploit probability up to 72%.

Among the top 25% of tracked Microsoft updates by EPSS exploit probability.

What to do

High priority: EPSS puts the odds of near-term exploitation high. Senserva flags whether KB5087539 is missing on your devices.

CVEs fixed by this update

CVE-2025-54518 CVE-2026-21530 CVE-2026-32161 CVE-2026-32170 CVE-2026-32209 CVE-2026-33834 CVE-2026-33835 CVE-2026-33837 CVE-2026-33838 CVE-2026-33839 CVE-2026-33840 CVE-2026-33841 CVE-2026-34329 CVE-2026-34330 CVE-2026-34331 CVE-2026-34332 CVE-2026-34333 CVE-2026-34334 CVE-2026-34336 CVE-2026-34337 CVE-2026-34338 CVE-2026-34339 CVE-2026-34340 CVE-2026-34341 CVE-2026-34342 CVE-2026-34343 CVE-2026-34344 CVE-2026-34345 CVE-2026-34347 CVE-2026-34350 CVE-2026-34351 CVE-2026-35415 CVE-2026-35416 CVE-2026-35417 CVE-2026-35418 CVE-2026-35419 CVE-2026-35420 CVE-2026-35421 CVE-2026-35422 CVE-2026-35423 CVE-2026-35424 CVE-2026-40369 CVE-2026-40377 CVE-2026-40380 CVE-2026-40382 CVE-2026-40397 CVE-2026-40398 CVE-2026-40399 CVE-2026-40401 CVE-2026-40403 CVE-2026-40405 CVE-2026-40406 CVE-2026-40407 CVE-2026-40408 CVE-2026-40410 CVE-2026-40413 CVE-2026-40414 CVE-2026-40415 CVE-2026-41088 CVE-2026-41089 CVE-2026-41095 CVE-2026-41096 CVE-2026-41097 CVE-2026-42825 CVE-2026-42896 CVE-2026-48566

Affected products

Windows 11 Version 25H2 for ARM64-based Systems
Windows 11 Version 25H2 for x64-based Systems
Windows Server 2025 (Server Core installation)

References

Microsoft support article Microsoft Security Update Guide

See this and every Microsoft update ranked by real-world risk on the Microsoft Patch Tracker.

Sponsored by SenservaMicrosoft 365, Intune, Defender, and Entra ID security and compliance, with automated remediation and Trustworthy AI.Scan free

Lexicon: the terms on this page

CVE: Common Vulnerabilities and Exposures. A unique ID for one publicly known vulnerability, such as CVE-2025-1234.
KB: Microsoft Knowledge Base article. The identifier for a specific Microsoft update.
KEV: CISA Known Exploited Vulnerabilities. CVEs confirmed exploited in the wild. Fix these first.
CVSS: Common Vulnerability Scoring System. A standardized Severity score from 0 to 10.
EPSS: Exploit Prediction Scoring System. The probability a CVE will be exploited in the next 30 days.
MSRC: Microsoft Security Response Center. Microsoft's Patch Tuesday advisories and KB-to-CVE mapping.
NVD: National Vulnerability Database (NIST). Authoritative CVE metadata and CVSS scores.
Ransomware: The vulnerability is linked to known ransomware activity.