Microsoft has issued security updates for 198 flaws, including over 50 vulnerabilities rated as "Critical," as part of the Patch Tuesday updates for June 2026. This month stands out as one of the largest single releases in history, putting immense pressure on IT and security teams. The massive cycle is driven by multiple publicly disclosed zero-day vulnerabilities and a dangerous wave of wormable, critical-severity flaws affecting core enterprise infrastructure and network layers.
Zero-Days Fixed
Microsoft confirmed the inclusion of three prominent zero-day flaws that were publicly known or actively discussed prior to a patch being available. These require immediate, out-of-band deployment.
- CVE-2026-49160 - HTTP.sys Denial of Service ("HTTP/2 Bomb")
- CVE-2026-50507 - Windows BitLocker Security Feature Bypass ("YellowKey" / "Bitskrieg")
- CVE-2026-45586 - Windows CTFMON Elevation of Privilege ("GreenPlasma")
Critical Vulnerabilities to Prioritise
Out of the 198 flaws, over 50 received a "Critical" rating, carrying CVSS scores up to 9.8. The following infrastructure and application flaws require immediate mitigation.
- CVE-2026-45657 - Windows Kernel Remote Code Execution
- CVE-2026-44815 - Windows DHCP Client Remote Code Execution
- CVE-2026-45607, CVE-2026-45641, & CVE-2026-47652 - Windows Hyper-V Guest-to-Host Escape
- CVE-2026-47288 & CVE-2026-45648 - Windows Kerberos KDC & Active Directory Domain Services RCE
- CVE-2026-45456 & CVE-2026-47635 - Microsoft Outlook & Word Critical RCE
Vulnerabilities by Category
The June 2026 updates addressed a total of 198 flaws, categorised as follows,
- Elevation of Privilege Vulnerabilities - 63
- Remote Code Execution Vulnerabilities - 54
- Spoofing Vulnerabilities - 27
- Information Disclosure Vulnerabilities - 26
- Security Feature Bypass Vulnerabilities - 18
- Denial of Service Vulnerabilities - 7
- Tampering Vulnerabilities - 3
- Total Flaws - 198
Need Help with Patch Management?
Struggling with the relentless pace and record-breaking volume of monthly patching? In 2026, "good enough" security is no longer an option. NOCTeam can secure your environment with proactive Patch Management, M365 hardening, and advanced Endpoint Detection and Response (EDR) services.
Email [email protected] today for a free security checkup of your IT systems.
#PatchTuesday #CyberSecurity2026 #M365 #ZeroDay #VulnerabilityManagement #NOCTeam #Infosec #Remediation #WindowsSecurity #SysAdmin
Originally published on LinkedIn.