KB5094127

Microsoft has released the cumulative update KB5094127 for Windows 10 version 22H2 as part of the June 2026 Patch Tuesday. This package is intended exclusively for devices enrolled in the Extended Security Updates (ESU) program. The cumulative update package KB5094127 (build 19045.7417) is designed for Windows 10 version 22H2 (2022 Update) on x86, x64 (amd64), and ARM64 processors.

• Search in File Explorer. Search in File Explorer has been improved, including support for Chinese text and UTF-8 encoded files without a byte order mark (BOM). Text now appears more clearly and consistently in search results, the Contents view, and tooltips.
• Dynamic Secure Boot Reporting. This update includes dynamic reporting of the Secure Boot status in the Windows Security app.
• LimitSecureBootRequiredServiceData Group Policy. A group policy and mobile device management (MDM) setting named LimitSecureBootRequiredServiceData has been added under Computer Configuration > Administrative Templates > Windows Components > Secure Boot. When enabled, Windows limits the amount of Secure Boot service data transmitted, suppressing an event that is typically sent to Microsoft. This policy is included in the Windows Restricted Traffic Limited Functionality Baseline. More details about the policy can be found in the document Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services.
• Secure Boot Certificate Update. Additional high-confidence targeting data is now included in Windows quality updates, expanding the coverage of devices that automatically receive new Secure Boot certificates. Certificates are delivered only after a sufficient number of successful installation signals are received, ensuring a controlled, phased rollout.

The cumulative update KB5094127 for PCs installs automatically via Windows Update. To check for it, go to Settings > Update & Security and click Check for updates. A system restart is required to complete the installation. After the update, the Windows 10 (version 22H2) build number will change to 19045.7417.

How the new features work:

Enhanced Search in File Explorer: The search engine now correctly processes text files encoded in UTF-8 without a Byte Order Mark (BOM), as well as Chinese script characters. The indexing system utilizes heuristic analysis to determine the code page based on bigram frequency in the absence of a BOM, thereby minimizing transcoding errors. Query results, the "Contents" view, and tooltips render glyphs via DirectWrite, employing ClearType sub-pixel anti-aliasing to improve readability regardless of DPI density.

Dynamic Secure Boot Reporting: The security component now polls UEFI variables (SecureBoot, SetupMode) in real time through the Windows Management Instrumentation (WMI) interface to display the current status in the Windows Security app. Unlike a static boot-time check, this method instantaneously reflects changes in the firmware configuration (e.g., platform key reset) without rebooting the OS, utilizing the TPM event filter driver.

LimitSecureBootRequiredServiceData Group Policy: This parameter controls the telemetry channel, limiting the transmission of diagnostic events related to the Secure Boot service by setting the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows\SecureBoot\LimitSecureBootRequiredServiceData. When activated, a filter at the diagtrack.dll service level suppresses the event ID that logs the state of firmware variables, complying with the restricted traffic baseline requirements for isolated environments.

Secure Boot Certificate Update: The distribution of updated Signature Database (DB) and Forbidden Signature Database (DBX) signatures is now managed by a high-confidence targeting phased rollout algorithm. The system analyzes successful installation signals from a fleet of telemetry-collector devices; new certificates are released into the quality update channel only after a statistically significant threshold of successful installations is exceeded, preventing brick-scenarios due to firmware incompatibility.

The last 10 Windows updates: