Microsoft released KB5094041 on June 9, 2026, the June monthly rollup for Windows Server 2012 R2 systems enrolled in the Extended Security Updates (ESU) program. The update delivers kernel security patches, TLS 1.3 compatibility fixes, and reliability improvements for organizations still running this legacy server OS.
Server 2012 R2 is well past mainstream support, but many organizations still run it for legacy applications. This monthly rollup keeps ESU-enrolled systems patched against current threats while those organizations plan their migration path.
Key takeaways
- Kernel security patches fix privilege escalation vulnerabilities in Windows kernel-mode drivers.
- TLS 1.3 compatibility fix resolves authentication failures with modern cloud services and apps.
- WMI memory leak fix prevents performance degradation in enterprise monitoring environments.
- AD replication stability improvements address high-latency network timing issues.
- ESU license is mandatory. Systems without ESU cannot install this update.
Affected
KB5094041: June Monthly Rollup for Server 2012 R2 ESU Systems
Microsoft released KB5094041 on June 9, 2026, the June monthly rollup for Windows Server 2012 R2 systems with active Extended Security Update (ESU) licenses. The update patches kernel privilege escalation vulnerabilities, fixes TLS 1.3 authentication failures with modern clients, resolves WMI memory leaks under high-load monitoring, stabilizes Active Directory replication in high-latency networks, and optimizes SMB file sharing performance for concurrent connections.
This update is only available to organizations with valid ESU licenses, per Microsoft's extended support policy. Systems without ESU will not receive the update through Windows Update. The standalone package is approximately 85 MB and requires a restart.
Why KB5094041 Matters for Legacy Server Environments
Server 2012 R2 remains in production at many organizations that can't migrate immediately. The kernel security patches close privilege escalation paths that attackers use for lateral movement in legacy environments. The TLS 1.3 fix is especially relevant as more cloud services and modern apps drop support for older TLS versions.
The WMI memory leak affected enterprise monitoring setups (SCOM, third-party tools) that query WMI intensively, causing gradual performance degradation and eventual exhaustion. The AD replication fix addresses timing issues that became more common as organizations extended their networks across hybrid cloud infrastructure.
Affected Systems and ESU Requirement
Windows Server 2012 R2 (Standard, Datacenter, Essentials, and Server Core) on x64 architecture. Active ESU license is mandatory. Prerequisite: Servicing Stack Update KB5012170 must be installed first. Minimum 200 MB free disk space required.
Known issues
Legacy antivirus may report false positives on updated files. Custom WMI providers may need vendor updates for compatibility. Very old SMB clients (pre-XP SP3) may experience connection issues. Only enable SMB1 if absolutely necessary due to security risks.
Timeline
Impact & actions
Six fixes covering kernel security, TLS 1.3 compatibility, WMI memory management, AD replication stability, SMB performance, and event log reliability for Server 2012 R2 ESU systems.
Security: Kernel privilege escalation patches close attack paths for lateral movement in legacy environments.
Recommended actions · High urgency
- 1Install KB5094041 on all Server 2012 R2 ESU systems.
- 2Verify ESU license status with slmgr.vbs /dlv.
- 3Test custom WMI providers for compatibility after installation.
- 4Plan migration to Windows Server 2022 or 2025.
Technical details
- Affected versions
- Windows Server 2012 R2 (all builds, ESU required)
- Patched versions
- Windows Server 2012 R2 with KB5094041 installed
Mitigations
- Install KB5094041 on all ESU-enrolled systems.
- Restrict network exposure of legacy Server 2012 R2 systems.
- Accelerate migration planning to Server 2022 or 2025.
Response
Vendor
FAQ
What does KB5094041 fix?
KB5094041 patches kernel privilege escalation vulnerabilities, fixes TLS 1.3 authentication failures, resolves WMI service memory leaks, stabilizes Active Directory replication in high-latency networks, optimizes SMB file sharing performance, and fixes event log corruption issues.
Which systems can install KB5094041?
Only Windows Server 2012 R2 systems (Standard, Datacenter, Essentials, Server Core) on x64 architecture with active Extended Security Update (ESU) licenses. Systems without ESU cannot install this update.
Are there known issues?
Known issues include antivirus false positives on updated system files, compatibility concerns with custom WMI providers, and possible SMB connection issues with very old clients (pre-Windows XP SP3). Only enable SMB1 for legacy compatibility if absolutely necessary.
Is this a security update?
Yes. KB5094041 includes critical security fixes for Windows kernel components and system services that address privilege escalation vulnerabilities. The security patches are bundled with reliability and compatibility improvements in the monthly rollup.
The bottom line
KB5094041 delivers kernel security patches, TLS 1.3 compatibility, WMI memory management improvements, AD replication stability, SMB performance optimization, and event log reliability fixes for Windows Server 2012 R2 ESU systems.
What happens next
What to do
