Full Report
Microsoft warned customers on Tuesday that they may have issues installing the latest monthly updates on some Windows devices that were upgraded to Windows 11 24H2 or 25H2. [...]
Analysis Summary
# Vulnerability: Windows Cumulative Update Installation Failure (June 2026)
## CVE Details
- **CVE ID**: N/A (Functional Bug / Deployment Issue)
- **CVSS Score**: N/A
- **CWE**: CWE-439: Proxy or Broken Chain of Trust (Specifically: Component Store Corruption/Hydration failure)
## Affected Systems
- **Products**: Windows 10 and Windows 11
- **Versions**:
- Windows 10, versions 21H2 and 22H2
- Windows 11, version 23H2
- **Configurations**: Devices previously running the versions above that were subsequently **upgraded** to Windows 11, version 24H2 or 25H2.
## Vulnerability Description
A technical flaw in the Windows servicing stack prevents the installation of June 2026 cumulative updates on specific upgraded paths. The issue manifests as a failure in the SxS (Side-by-Side) component store or hydration process. When the update client attempts to apply the cumulative update, it triggers one of two primary errors:
1. **0x800f0993 (PSFX_E_REBASE_HYDRATION_CANDIDATES_MISSING)**: The system cannot find the necessary source files to "rebase" or hydrate the compressed components.
2. **0x80073712 (ERROR_SXS_COMPONENT_STORE_CORRUPT)**: The component store is flagged as inconsistent or missing required manifests.
## Exploitation
- **Status**: Not exploited (This is a reliability/availability issue rather than a security bypass).
- **Complexity**: N/A
- **Attack Vector**: Local (System maintenance)
## Impact
- **Confidentiality**: None
- **Integrity**: None
- **Availability**: **Medium** (Prevents the application of critical security patches, leaving the system vulnerable to other exploited CVEs over time).
## Remediation
### Patches
Microsoft has released updated builds to prevent this issue for future upgrades. If the device has not yet been upgraded to 24H2/25H2, ensure the following KBs are present:
- **Windows 10 (21H2/22H2)**: KB5094127
- **Windows 11 (23H2)**: KB5093998
- **Windows 11 (24H2/25H2)**: KB5094126
### Workarounds
For systems **already upgraded** and currently failing to update:
1. **Manual Package Removal**: Open an elevated Command Prompt and execute:
`dism /online /remove-package /packagename:Package_for_RollupFix~31bf3856ad364e35~amd64~~26100.1742.1.10`
2. **System Restart**: Unmanaged/Home devices may receive a background fix that requires a reboot to finalize.
3. **In-place Upgrade**: If the DISM command fails, perform a Windows 11 in-place upgrade using official installation media to repair the component store.
## Detection
- **Indicators of Compromise**: N/A (Functional failure)
- **Detection methods and tools**:
- **Windows Update History**: Look for failed installation attempts with error codes `0x80073712` or `0x800f0993`.
- **Log Analysis**: Review `C:\Windows\Logs\CBS\CBS.log` for the string `PSFX_E_REBASE_HYDRATION_CANDIDATES_MISSING`.
## References
- Microsoft Service Alert: [https[:]//admin.cloud.microsoft/Adminportal/Home?source=applauncher#/windowsreleasehealth/:/issue/WI1317180]
- Microsoft Support KB5094127: [https[:]//support.microsoft.com/help/5094127]
- Microsoft Support KB5093998: [https[:]//support.microsoft.com/help/5093998]
- Microsoft Support KB5094126: [https[:]//support.microsoft.com/help/5094126]