Windows 11 KB5060999 Update: Security Enhancements & Performance Fixes for 22H2 & 23H2

Microsoft's June 10, 2025, cumulative update, KB5060999, for Windows 11 versions 22H2 and 23H2, introduces a series of security enhancements and quality improvements aimed at bolstering system stability and performance.

Key Highlights​

• Security Enhancements: This update addresses multiple security vulnerabilities within the Windows operating system, ensuring a more secure computing environment for users.
• Quality Improvements: The update includes fixes from the previous optional update KB5058502, notably resolving a graphics support issue that hindered some users from successfully connecting via Remote Desktop. Users previously encountered errors such as "The Remote Desktop Services session has ended" or "A remote desktop connection cannot be established."

Notable Improvements​

Graphics Support​

A significant fix in this update addresses a graphics support issue that prevented successful Remote Desktop connections, leading to errors like "The Remote Desktop Services session has ended" or "A remote desktop connection cannot be established." This resolution is particularly beneficial for users relying on Remote Desktop for remote work or support.

Servicing Stack Update​

The update incorporates a servicing stack update (KB5058546), enhancing the component responsible for installing Windows updates. This improvement ensures a robust and reliable servicing stack, facilitating the seamless reception and installation of future Microsoft updates.

Known Issues​

Noto Fonts Rendering​

Symptom: Users have reported blurry or unclear Chinese, Japanese, and Korean (CJK) text when displayed at 96 DPI (100% scaling) in Chromium-based browsers like Microsoft Edge and Google Chrome. This issue stems from the March 2025 Preview Update, which introduced Noto fonts as fallbacks to improve text rendering when websites or apps don't specify appropriate fonts. The limited pixel density at 96 DPI can reduce the clarity and alignment of CJK characters.
Workaround: Increasing the display scaling to 125% or 150% can enhance text clarity by improving text rendering.

Update Delay with Deferral Policies​

Symptom: Devices in environments where IT administrators use quality update deferral policies might experience delays in receiving the June 2025 Windows security update. Although the update was released on June 10, 2025, its update metadata timestamp reflects a date of June 20, 2025. This discrepancy might cause devices with configured deferral periods to receive the update later than expected.
Workaround: To expedite the deployment of the June 2025 updates, administrators can:

• Create an expedite policy to bypass deferral settings and deliver the update immediately if the organization is using Windows Autopatch.
• Adjust deployment rings or deferral configurations to reduce the delay window for affected devices.

This delay issue affects only the timing of update availability for organizations using quality update deferral policies and doesn't impact the quality or applicability of the update. Microsoft has stated that they will not change the metadata value from the current June 20, 2025, value, and this workaround serves as the final resolution for this issue.

Installation Instructions​

Before Installation: Microsoft combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, refer to Microsoft's documentation on Servicing Stack Updates.
Installation Methods:

• Windows Update: This update downloads and installs automatically from Windows Update and Microsoft Update.
• Microsoft Update Catalog: To manually download the update, visit the Microsoft Update Catalog.

Uninstallation: To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using the command:
DISM /online /get-packages
Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. The SSU cannot be removed from the system after installation.

Conclusion​

The KB5060999 update is a critical release that addresses security vulnerabilities and enhances system stability and performance for Windows 11 versions 22H2 and 23H2. Users are encouraged to install this update promptly to benefit from the improvements and fixes it offers. As with any update, it's advisable to review the known issues and workarounds to ensure a smooth update experience.

---

Source: Microsoft Support June 10, 2025—KB5060999 (OS Builds 22621.5472 and 22631.5472) - Microsoft Support