Microsoft Ships KB5094125 to Patch Five Windows Server 2025 Flaws
The cumulative update addresses privilege escalation in Active Directory, RDP remote code execution, a DNS denial-of-service flaw, and a Hyper-V VM escape across all Windows Server 2025 editions.
On this page
Key takeaways
- KB5094125 patches five CVEs in Windows Server 2025 and updates the build to 26100.32995.
- CVE-2026-0235 is an unauthenticated RDP remote code execution flaw rated CVSS 9.8.
- CVE-2026-0237 allows a Hyper-V guest VM to escape to the host, rated CVSS 9.0.
- CVE-2026-0234 enables privilege escalation on domain controllers via malformed LDAP queries (CVSS 8.8).
- All Server 2025 editions on builds 26100.1000–26100.32994 require the update; a restart is required.
What to do now
High urgency- Install KB5094125 on all Windows Server 2025 systems and restart.
- Prioritize domain controllers, RDP-enabled servers, DNS servers, and Hyper-V hosts.
- Apply interim mitigations where immediate patching is not possible.
- Consider live migration of critical VMs before patching Hyper-V hosts.
Microsoft released KB5094125 on June 9, 2026, a critical security update for Windows Server 2025 that patches five vulnerabilities spanning Active Directory Domain Services, Remote Desktop Services, the DNS server, Hyper-V, and Server Core. The update raises the operating system build to 26100.32995 and applies to all editions in both full GUI and Server Core deployments.
Two of the fixed flaws are rated critical and are network-facing — an unauthenticated Remote Desktop Services remote code execution bug (CVE-2026-0235, CVSS 9.8) and a Hyper-V guest-to-host escape (CVE-2026-0237, CVSS 9.0) — making prompt patching important for internet-exposed and virtualization infrastructure.
Microsoft's KB5094125 patches five Windows Server 2025 vulnerabilities, including critical RDP and Hyper-V flaws, and updates the build to 26100.32995.
Install KB5094125 on all Windows Server 2025 systems. It fixes critical RDP RCE and Hyper-V escape flaws plus AD, DNS, and Server Core issues, and requires a restart.
Affected & context
KB5094125 is a June 9, 2026 security update for Windows Server 2025 that patches five vulnerabilities across Active Directory, Remote Desktop Services, DNS, Hyper-V, and Server Core, and raises the OS build to 26100.32995.
Two of the flaws are critical and network-facing — an unauthenticated RDP remote code execution bug and a Hyper-V guest-to-host escape — putting exposed domain controllers, RDP hosts, and virtualization infrastructure at direct risk until patched.
All Windows Server 2025 editions (Standard, Datacenter, Essentials, Azure Edition) on builds 26100.1000 through 26100.32994, in both full GUI and Server Core deployments.
- Vendors
- Microsoft
- Products
- Windows Server 2025 StandardWindows Server 2025 DatacenterWindows Server 2025 EssentialsWindows Server 2025 Azure EditionActive Directory Domain ServicesRemote Desktop ServicesWindows DNS ServerHyper-V
- Geography
- Global
- CVEs
- CVE-2026-0234CVE-2026-0235CVE-2026-0236CVE-2026-0237CVE-2026-0238
What happened
Microsoft released KB5094125 on June 9, 2026 as a critical security update for Windows Server 2025. The cumulative package addresses five vulnerabilities across core server components and updates the operating system build to 26100.32995.
The flaws affect the base Windows Server 2025 installation and, according to the update documentation, apply to both full GUI and Server Core deployments. The update is distributed through Windows Update, the Microsoft Update Catalog, and enterprise channels such as WSUS, SCCM, and Intune.
- Released June 9, 2026
- Updates OS build to 26100.32995
- Patches five CVEs
The five vulnerabilities
KB5094125 resolves a mix of critical and important severity issues. Two are unauthenticated or network-facing and warrant the most urgent attention:
- CVE-2026-0235 — Remote Desktop Services remote code execution via crafted RDP packets, exploitable without authentication in certain configurations. CVSS 9.8.
- CVE-2026-0237 — Hyper-V guest-to-host escape through memory corruption in the virtualization layer, allowing a guest VM to run code on the host. CVSS 9.0.
- CVE-2026-0234 — Active Directory Domain Services elevation of privilege via malformed LDAP queries, affecting domain controllers. CVSS 8.8.
- CVE-2026-0238 — Windows Server Core local privilege escalation through system service manipulation. CVSS 7.8.
- CVE-2026-0236 — Windows DNS Server denial of service via malformed DNS queries causing crashes or resource exhaustion. CVSS 7.5.
Per the documentation, the underlying causes include improper input validation in AD DS, insufficient boundary checks in Remote Desktop Services, memory corruption in DNS components, and inadequate isolation in the Hyper-V layer. The fixes add stronger input and packet validation, improved memory management, enhanced hypercall validation, and tighter service security descriptors.
- CVE-2026-0235 CVSS 9.8 (RDP RCE)
- CVE-2026-0237 CVSS 9.0 (Hyper-V escape)
Affected systems
All Windows Server 2025 editions on builds 26100.1000 through 26100.32994 require the update:
- Windows Server 2025 Standard — full GUI and Server Core
- Windows Server 2025 Datacenter — full GUI and Server Core
- Windows Server 2025 Essentials — full GUI only
- Windows Server 2025 Azure Edition — Server Core
Highest-priority systems
Prioritize domain controllers (CVE-2026-0234), servers with RDP enabled (CVE-2026-0235), DNS servers (CVE-2026-0236), and Hyper-V hosts (CVE-2026-0237).
Deployment and verification
Most servers receive KB5094125 automatically through Windows Update. Enterprises can deploy it via WSUS, SCCM software update groups, or Intune update policies. Manual installation is available from the Microsoft Update Catalog (approximately 485 MB for full installations, 320 MB for Server Core). A restart is required.
After installation and restart, confirm the update applied and that the build is 26100.32995:
# Check installed update
Get-HotFix -Id KB5094125
# Verify OS build (should show 26100.32995)
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").BuildLabEx
# Confirm restart occurred
(Get-CimInstance Win32_OperatingSystem).LastBootUpTimePrerequisites include Windows Server 2025 at minimum build 26100.1000, at least 2 GB free on the system drive, no pending restart, and a functional Windows Update service.
Interim mitigations
Until the update can be installed, the documentation suggests temporary risk-reduction measures:
- Restrict RDP access to trusted networks only.
- Monitor DNS server logs for unusual query patterns.
- Implement network segmentation for Hyper-V hosts.
- Enable advanced auditing for privilege escalation attempts.
Mitigations are temporary
These measures reduce exposure but do not remediate the flaws. Applying KB5094125 remains the only complete fix.
Known installation and post-update issues
The documentation notes several issues to watch for:
- Error 0x80070643 on servers with insufficient disk space — ensure at least 2 GB free before installing.
- Error 0x800f0922 tied to a corrupted Windows Update service — run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth before retrying.
- Temporary domain controller replication delays after restart, typically resolving within about 30 minutes.
- Slightly reduced Hyper-V VM performance immediately after host restart, returning to normal after VM restart.
- The DNS Server service may take longer to start on the first boot after installation.
Timeline
KB5094125 released
Microsoft ships KB5094125 for Windows Server 2025, patching five CVEs and raising the build to 26100.32995.
Source: KB5094125 update documentation
Confidence: Medium
Impact
KB5094125 remediates five Windows Server 2025 vulnerabilities that could otherwise enable privilege escalation, remote code execution, denial of service, or a Hyper-V VM escape.
Business impact
Unpatched servers risk unauthorized access, service disruption, and compromise of virtualized environments; the flaws also touch compliance frameworks including PCI DSS, ISO 27001, SOC 2, and the NIST CSF.
Technical impact
Exploitation could lead to domain compromise via AD, code execution on RDP hosts, DNS name-resolution outages, and guest-to-host code execution on Hyper-V.
Security impact
Two critical, network-facing flaws (RDP RCE and Hyper-V escape) significantly raise the attack surface for exposed infrastructure until patched.
Affected audience: IT admins, MSPs, Virtualization administrators, Active Directory administrators
Action required.
Technical details
- CVEs
- CVE-2026-0234, CVE-2026-0235, CVE-2026-0236, CVE-2026-0237, CVE-2026-0238
- CVSS
- 9.8
- Attack vector
- Network (RDP, LDAP, DNS) and local (Server Core); guest-to-host for Hyper-V
- Affected versions
- Windows Server 2025 builds 26100.1000–26100.32994
- Patched versions
- 26100.32995
Detection methods
- Verify installed update with Get-HotFix -Id KB5094125
- Confirm OS build 26100.32995 via registry BuildLabEx
Mitigations
- Restrict RDP access to trusted networks.
- Monitor DNS server logs for unusual query patterns.
- Segment Hyper-V host networks.
- Enable advanced auditing for privilege escalation.
Workarounds
- Free disk space and clear temporary files before installing.
- Temporarily disable antivirus during installation.
- Live-migrate critical VMs off Hyper-V hosts before patching.
Response
Customer guidance
Microsoft's update documentation classifies KB5094125 as a critical security update and recommends installing it through Windows Update or enterprise management channels; a restart is required, and manual packages are available from the Microsoft Update Catalog.
Response status: Patched
Patch available: Yes
Workaround available: Yes
FAQ
What does KB5094125 fix?
It patches five Windows Server 2025 vulnerabilities: privilege escalation in Active Directory (CVE-2026-0234), remote code execution in Remote Desktop Services (CVE-2026-0235), a DNS server denial-of-service flaw (CVE-2026-0236), a Hyper-V guest-to-host escape (CVE-2026-0237), and a Server Core privilege escalation (CVE-2026-0238).
Which systems need KB5094125?
All Windows Server 2025 editions — Standard, Datacenter, Essentials, and Azure Edition — on builds 26100.1000 through 26100.32994, across full GUI and Server Core installations.
What build should I see after installing?
After a successful install and restart, the OS build should read 26100.32995.
Is a restart required?
Yes. KB5094125 requires a restart, and domain controllers must restart to fully apply the security fixes.
How do I confirm KB5094125 is installed?
Run Get-HotFix -Id KB5094125 in PowerShell; it returns patch details if the update is present.
The bottom line
KB5094125, released June 9, 2026, patches five Windows Server 2025 vulnerabilities — including critical RDP RCE and Hyper-V escape flaws — and updates the build to 26100.32995.
Install KB5094125 promptly on all Windows Server 2025 systems; the RDP and Hyper-V flaws are network-facing and critical.
What happens next
Administrators should deploy the update across all Server 2025 systems, prioritizing internet-facing and virtualization hosts, and watch for the documented replication, performance, and DNS-startup post-install behaviors.
What to do
Deploy KB5094125 and verify the build reads 26100.32995 after restart.
Sources
Microsoft · Jun 9, 2026 · Primary source
Claims supported
- KB5094125 was released June 9, 2026 and updates Windows Server 2025 to build 26100.32995.
- The update patches CVE-2026-0234 through CVE-2026-0238.
- Affected editions and builds, deployment channels, and known issues.