KB37864969: Second update rollup for Configuration Manager 2509

The second Configuration Manager 2509 rollup supersedes KB36949461 and adds co-management scan-source, offline-feedback, CMG image and console-extension security fixes.

What changed

Includes KB36495448, KB36419072, KB37942646 and KB38232642 in addition to the first rollup. The console becomes 5.2509.1036.1700 and the client 5.0.9141.1032.

Technical details

Co-managed third-party update scan-source correction
Offline feedback authentication-library correction
CMG VMSS image removes end-of-life .NET 6
Console-extension security correction for CVE-2026-47301
Inherited OSD, ARM64, NAA and Endpoint Protection fixes

Why it matters

These changes affect managed-client reliability, update-source ownership and site security. Match the applicable release and replacement chain before deployment.

Known limitations

Supersedes KB36949461 and includes its fixes.
Installation initiates a site reset without requiring an operating-system restart.
Existing secondary sites require manual recovery.

Now check

Install through Updates and Servicing on the globally available 2509 build, following prerequisite checks.
Verify console 5.2509.1036.1700 and client 5.0.9141.1032, then recover existing secondary sites and check dbo.fnGetSecondarySiteCMUpdateStatus returns 1.
Validate Intune/WUfB update sources, CMG image deployment, offline feedback and console-extension import behavior.