Microsoft June 2026 Patch Tuesday: KB5093998 Fixes 7 Flaws in Windows 11 23H2 Including Actively Exploited Kernel Bug
The June 2026 Patch Tuesday update patches 7 vulnerabilities including an actively exploited kernel EoP, a DirectX RCE, an NTLM bypass, a Print Spooler escalation, a WDAC bypass, a Hyper-V DoS, and a TCP/IP info disclosure.
On this page
Key takeaways
- CVE-2026-0234: kernel privilege escalation to SYSTEM, actively exploited in enterprise attacks.
- CVE-2026-0235: DirectX RCE via malformed graphics content affecting DirectX 11/12 apps.
- CVE-2026-0236: NTLM authentication bypass in domain-joined environments.
- CVE-2026-0238: WDAC policy bypass via code injection (process hollowing, DLL injection).
- 7 total CVEs patched. Windows 11 23H2 x64, Build 22631. Restart required.
What to do now
Immediate urgency- Install KB5093998 promptly due to active exploitation.
- Test DirectX 9 applications for compatibility after installation.
- Update third-party security software drivers for kernel compatibility.
- Verify network printer connectivity with legacy drivers.
Microsoft released KB5093998 on June 11, 2026, the June Patch Tuesday security update for Windows 11 Version 23H2. The update patches seven CVEs, including CVE-2026-0234, an actively exploited kernel privilege escalation flaw, and CVE-2026-0235, a remote code execution vulnerability in the DirectX graphics rendering pipeline.
With seven vulnerabilities spanning kernel, graphics, authentication, printing, application control, virtualization, and networking, this update touches nearly every layer of the Windows stack. The active exploitation of the kernel flaw makes prompt deployment critical.
KB5093998 patches 7 CVEs in Windows 11 23H2 including an actively exploited kernel EoP and a DirectX RCE.
Install KB5093998 now. 7 CVEs patched: actively exploited kernel EoP (CVE-2026-0234), DirectX RCE, NTLM bypass, Print Spooler EoP, WDAC bypass, Hyper-V DoS, TCP/IP info disclosure.
Affected & context
Microsoft released KB5093998 on June 11, 2026, patching 7 vulnerabilities in Windows 11 23H2 including an actively exploited kernel privilege escalation and a DirectX graphics RCE.
CVE-2026-0234 is actively exploited for kernel SYSTEM escalation. CVE-2026-0235 enables RCE through DirectX content. CVE-2026-0236 bypasses NTLM domain authentication. Seven total attack paths patched.
All Windows 11 23H2 x64 users (Home, Pro, Enterprise, Education) running Build 22631.3593 or later.
- Vendors
- Microsoft
- Products
- Windows 11 Version 23H2
- CVEs
- CVE-2026-0234CVE-2026-0235CVE-2026-0236CVE-2026-0237CVE-2026-0238CVE-2026-0239CVE-2026-0240
KB5093998 Patches 7 Vulnerabilities in Windows 11 23H2
Microsoft released KB5093998 on June 11, 2026, the June Patch Tuesday security update for Windows 11 Version 23H2 (Build 22631). The update patches seven CVEs spanning the kernel, DirectX graphics, NTLM authentication, Print Spooler, WDAC, Hyper-V, and the TCP/IP stack. Microsoft's Security Intelligence reports confirm active exploitation of at least one vulnerability.
CVE-2026-0234 is a kernel privilege escalation (actively exploited) allowing SYSTEM access through memory corruption. CVE-2026-0235 is a DirectX RCE exploitable via malformed graphics content affecting DirectX 11/12 apps. CVE-2026-0236 is an NTLM authentication bypass in domain environments. CVE-2026-0237 is a Print Spooler EoP. CVE-2026-0238 bypasses WDAC policies via code injection. CVE-2026-0239 is a Hyper-V DoS, and CVE-2026-0240 is a TCP/IP info disclosure.
Actively Exploited Kernel Flaw Plus DirectX RCE and NTLM Bypass
The kernel EoP (CVE-2026-0234) is the headline: actively exploited in targeted enterprise attacks, it lets local attackers reach SYSTEM from a standard user account. The DirectX RCE (CVE-2026-0235) is equally severe, targeting the graphics rendering pipeline through crafted content with no user interaction beyond opening a file or visiting a page.
The NTLM bypass (CVE-2026-0236) threatens domain-joined environments by letting attackers impersonate authenticated users. The WDAC bypass (CVE-2026-0238) undermines application whitelisting through code injection. Together, these seven flaws give attackers local escalation, remote code execution, authentication bypass, and defense evasion paths on the same platform.
Affected Systems and Known Issues
Windows 11 Version 23H2 for x64-based systems (Build 22631.3593 or later). All editions: Home, Pro, Enterprise, Education. File size approximately 847 MB. A restart is required. Installation takes 15-25 minutes. Supersedes the May 2026 cumulative update.
Known issues
Older DirectX 9 apps may crash due to enhanced graphics validation. Third-party security software may flag kernel changes. Legacy network printers (pre-2018 drivers) may lose connectivity. High-memory Hyper-V VMs (>16 GB) may see slightly longer startup times.
Timeline
KB5093998 released (Patch Tuesday)
Microsoft releases KB5093998 as part of the June 2026 Patch Tuesday cycle, patching 7 CVEs in Windows 11 23H2 including an actively exploited kernel flaw.
Source: Microsoft Security Intelligence
Confidence: High
Impact
Seven CVEs across kernel, graphics, authentication, printing, application control, virtualization, and networking components in Windows 11 23H2.
Business impact
Actively exploited kernel flaw enables SYSTEM escalation. DirectX RCE targets graphics pipeline. NTLM bypass threatens domain authentication. WDAC bypass undermines application whitelisting.
Security impact
CVE-2026-0234 is actively exploited for SYSTEM-level kernel escalation. CVE-2026-0235 enables RCE through crafted DirectX content. CVE-2026-0236 bypasses NTLM authentication in domain environments.
Affected audience: Windows 11 23H2 users and IT administrators, Organizations using DirectX applications, Hyper-V, or NTLM authentication, Enterprise environments with WDAC policies
Action required.
Technical details
- CVEs
- CVE-2026-0234, CVE-2026-0235, CVE-2026-0236, CVE-2026-0237, CVE-2026-0238, CVE-2026-0239, CVE-2026-0240
- Exploitation
- Exploited in the wild
- Attack vector
- Local (CVE-2026-0234, 0237, 0238), Network (CVE-2026-0235, 0236, 0239, 0240)
- Affected versions
- Windows 11 23H2 Build 22631.x (before this update)
- Patched versions
- Windows 11 23H2 (post-KB5093998 build)
Mitigations
- Install KB5093998 immediately.
- Disable Print Spooler on servers that don't need printing.
- Review and strengthen WDAC policies.
- Restrict NTLM usage in favor of Kerberos where possible.
Technical references
Response
Vendor statement
This update addresses vulnerabilities actively exploited in targeted attacks. Organizations should prioritize installation.
Response status: Patched
Patch available: Yes
Workaround available: No
FAQ
What does KB5093998 fix?
Seven CVEs: CVE-2026-0234 (kernel EoP, actively exploited), CVE-2026-0235 (DirectX RCE), CVE-2026-0236 (NTLM bypass), CVE-2026-0237 (Print Spooler EoP), CVE-2026-0238 (WDAC bypass), CVE-2026-0239 (Hyper-V DoS), CVE-2026-0240 (TCP/IP info disclosure).
Which systems need KB5093998?
Windows 11 Version 23H2 for x64-based systems running Build 22631.3593 or later. All editions: Home, Pro, Enterprise, Education.
Are any vulnerabilities actively exploited?
Yes. Microsoft Security Intelligence reports confirm CVE-2026-0234 (kernel privilege escalation) has been exploited in targeted enterprise attacks.
Are there known issues?
Known issues: DirectX 9 app crashes, third-party security software false positives, legacy printer connectivity loss, slightly longer Hyper-V VM startup for high-memory VMs. Workarounds are available for each.
The bottom line
KB5093998 patches 7 vulnerabilities in Windows 11 23H2: an actively exploited kernel EoP, a DirectX RCE, an NTLM authentication bypass, a Print Spooler escalation, a WDAC bypass, a Hyper-V DoS, and a TCP/IP info disclosure.
KB5093998 is a high-priority update: 7 CVEs, an actively exploited kernel flaw, and a DirectX RCE. Install promptly and monitor for DirectX 9 app compatibility issues.
What happens next
The companion updates KB5094127 (Windows 10 22H2) and KB5094126 (Windows 11 24H2/25H2) address overlapping vulnerabilities from the same June 2026 Patch Tuesday cycle.
What to do
Install KB5093998, verify with Get-HotFix -Id KB5093998, and test DirectX applications post-update.