Microsoft’s June 2026 Patch Tuesday landed on June 9 with 206 vulnerabilities fixed in a single release, the largest volume the company has shipped since the program started in October 2003, according to Arctic Wolf’s analysis of the update. Thirty-seven of those flaws carry a Critical severity rating, and three were publicly disclosed before Microsoft had a patch ready, giving attackers a head start while security teams scrambled to catch up. The release landed days after a separate, already-exploited Windows Server flaw, and in the same week a critical Ivanti Sentry bug was weaponized within 24 hours of its own disclosure. It capped a month that vulnerability management vendors are calling one of the busiest in Patch Tuesday’s 23-year history.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Microsoft’s June 2026 Patch Tuesday, by the Numbers
The monthly release ritual that IT administrators have followed since 2003 delivered an unusually heavy batch this time. CrowdStrike’s Falcon Exposure Management team counted 206 vulnerabilities across the release, including 37 rated Critical and three that were publicly disclosed with no evidence of active exploitation at the time of release. Arctic Wolf’s own recap put the critical count slightly higher, at 39, and described the update as the largest number of vulnerabilities Microsoft has disclosed in a single security release since the Patch Tuesday program began in October 2003.
Not every tracker landed on the same number. Rapid7 logged 200 vulnerabilities and flagged nine with CVSS scores of 9.0 or higher. Computerworld broke the release into 119 Windows fixes and 53 Office fixes, and Splashtop counted 206 Microsoft-authored CVEs plus 362 republished third-party entries, for a combined 568 items in the full bulletin. The spread points to a recurring problem for defenders: there’s no single agreed number for how big a given Patch Tuesday actually is, because vendors count republished CVEs, Chromium-based Edge fixes, and cloud-service patches differently.
What nobody disputes is the scope. June’s release touched Windows, Microsoft Office, Exchange Server, SharePoint, Azure services, BitLocker, and Visual Studio Code, spanning on-premises software and cloud infrastructure in one coordinated bulletin.
The Three Zero-Days Microsoft Shipped Without a Head Start
Three vulnerabilities in the June release were publicly disclosed before Microsoft issued patches, meaning technical details were available to attackers before defenders had a fix to deploy. CrowdStrike, Rapid7, Computerworld, and Splashtop independently confirmed all three:
- CVE-2026-45586, an elevation-of-privilege flaw in the Windows Collaborative Translation Framework (CTFMON), CVSS 7.8. A low-privileged local attacker can exploit a link-following bug to reach SYSTEM privileges with no user interaction required.
- CVE-2026-49160, a denial-of-service bug in HTTP.sys, CVSS 7.5, capable of knocking a Windows web server offline.
- CVE-2026-50507, a security-feature bypass in BitLocker, CVSS 6.8, that undermines Windows’ disk-encryption protections.
Microsoft’s own exploitability index rated all three “Exploitation More Likely,” and none showed evidence of in-the-wild attacks at the moment of release, per Rapid7 and Splashtop. That distinction matters in Patch Tuesday coverage: zero-day typically means publicly known before a patch existed, not necessarily under active attack. Microsoft’s own guidance tells defenders to mitigate zero-day vulnerabilities “by prioritizing patches for vulnerabilities that are actively exploited in the wild or publicly disclosed,” treating both categories as urgent regardless of confirmed exploitation.
Splashtop separately flagged 15 vulnerabilities in the release rated “Exploitation More Likely” by Microsoft’s scoring system, a much wider pool of flaws that security teams were advised to prioritize even without formal zero-day status.
CVE-2026-47291: The 9.8 Hiding Behind the Zero-Day Headlines
The three publicly disclosed zero-days grabbed the headlines, but they weren’t the release’s most severe bugs. That distinction belongs to a cluster of remote-code-execution flaws carrying the maximum practical CVSS score of 9.8, led by CVE-2026-47291, a remote code execution vulnerability in HTTP.sys. Rapid7’s research team noted proof-of-concept code for CVE-2026-47291 was circulating publicly, even though Microsoft had no evidence it was being used in live attacks.
CVE-2026-47291 shared the top of the severity list with four other 9.8-rated remote-code-execution bugs: CVE-2026-47643 in Azure Stack Edge, CVE-2026-44815 in the Windows DHCP Client service, CVE-2026-26142 in Nuance PowerScribe, and CVE-2026-45657 in the Windows kernel. None of these five carried zero-day status, since none were publicly known before Microsoft’s fix shipped, but their severity score put them ahead of the three headline zero-days on any risk-based patching queue.
That gap between “disclosed first” and “scored worst” is one enterprise patch teams reconcile every month, and June 2026 made the tension unusually visible.
Why the Vulnerability Count Depends on Who’s Counting
Ask how many vulnerabilities Microsoft really fixed in June 2026, and the honest answer is that it depends which tracker you read. Here’s how six separate write-ups counted the same release:
| Source | Total Vulnerabilities Reported | Critical-Rated | Zero-Days Reported |
|---|---|---|---|
| CrowdStrike | 206 | 37 | 3 publicly disclosed |
| Arctic Wolf | 206 | 39 | 6 (5 disclosed, 1 exploited) |
| Rapid7 | 200 | 9 rated CVSS 9.0+ | 3 publicly disclosed |
| Computerworld | 206 (119 Windows + 53 Office, plus other components) | Approx. 32 (22 Windows + 10 Office) | 3 publicly disclosed |
| Splashtop | 568 (206 Microsoft + 362 republished) | Not separately totaled | 3 disclosed, plus 15 rated “Exploitation More Likely” |
| BleepingComputer | 200 | 33 | 6 (5 disclosed, 1 exploited) |
The spread, from 200 to 568, comes down to methodology rather than disagreement about the underlying advisories. Some trackers count only vulnerabilities Microsoft itself authored. Others fold in the hundreds of republished non-Microsoft CVEs, mostly Chromium fixes shipped through Edge, that Microsoft’s Security Update Guide bundles into the same monthly release. For CISOs comparing vendor reports from Tenable, Qualys, and Rapid7 side by side, that inconsistency is one more reason vulnerability-management platforms spend as much effort on normalization as on detection.
Product by Product: Where the 206 Flaws Landed
Beyond severity, June’s release skewed heavily toward a handful of vulnerability types. BleepingComputer’s breakdown of the update shows elevation-of-privilege bugs as the largest single category, followed closely by remote code execution:
| Vulnerability Type | Count |
|---|---|
| Elevation of Privilege | 65 |
| Remote Code Execution | 55 |
| Information Disclosure | 30 |
| Spoofing | 27 |
| Security Feature Bypass | 19 |
| Denial of Service | 7 |
CrowdStrike’s own count of affected products shows Windows absorbing the bulk of the fixes, at 120 patches, followed by Extended Security Updates for older, out-of-support Windows versions still running in production, at 103 patches, and Microsoft Office, at 54 patches. Because a single CVE can touch more than one product or category, these per-product and per-type totals add up to more than 206.
The Extended Security Updates figure stands out on its own. A hundred and three patches for software Microsoft no longer sells new licenses for is a reminder of how much of the June release existed only because organizations are still paying to keep Windows Server 2012 and similar legacy platforms alive past their support dates.
The BleepingComputer Wrinkle: A Sixth Zero-Day and an Exchange Spoofing Bug
Not every outlet settled on three zero-days. BleepingComputer’s count put the number at six, adding CVE-2026-45585, a second BitLocker bypass distinct from CVE-2026-50507, and an older re-flagged flaw, CVE-2020-17103, to the three zero-days confirmed elsewhere. More significantly, the outlet identified CVE-2026-42897, an Exchange Server spoofing vulnerability, as the release’s sixth zero-day and the only one it described as actively exploited rather than merely publicly disclosed.
That claim doesn’t appear in CrowdStrike’s, Rapid7’s, or Splashtop’s write-ups of the same release, all of which describe zero exploited zero-days at time of publication. The discrepancy is plausible rather than contradictory. Initial vendor blog posts typically go out within hours of Microsoft’s release, while outlets that revise articles in the following days sometimes incorporate later confirmation of exploitation from CISA or independent researchers. Readers comparing Patch Tuesday coverage across outlets should expect these kinds of same-week revisions, especially for Exchange Server bugs, which have a well-documented history of drawing fast attacker interest once a spoofing or authentication flaw becomes public.
Is This Really Microsoft’s Biggest Patch Tuesday Ever?
By Arctic Wolf’s count, yes, at least at the moment it published: 206 vulnerabilities made June 2026 the largest single Patch Tuesday release since Microsoft started the program in October 2003. That record didn’t survive the month. CrowdStrike’s July 2026 analysis put the following month’s release at 622 vulnerabilities addressed, including 62 Critical flaws, two exploited zero-days, and one additional publicly disclosed zero-day. Whether July’s total is truly comparable to June’s 206 depends on the same counting-methodology question raised above, since a large share of July’s total likely includes the same kind of republished third-party CVEs that inflated June’s combined bulletin to 568.
Even accounting for that, the trend across 2026 points one direction. CyberScoop reported Microsoft addressed 59 vulnerabilities in February 2026, including six actively exploited before the patch shipped. The Hacker News put March’s release at 84 vulnerabilities, with two publicly known at disclosure. By June, the monthly count had climbed to 206. By July, several trackers had it well past 500. Whatever the exact figure in any given month, 2026 has been a year of Microsoft shipping more, not fewer, disclosed vulnerabilities with each release.
Expert Reaction: What Security Outlets Are Saying
Coverage of Microsoft’s 2026 patch cadence, read in sequence, traces the climb in the outlets’ own words:
“Mitigate zero-day vulnerabilities by prioritizing patches for vulnerabilities that are actively exploited in the wild or publicly disclosed.”
Microsoft Learn, official vulnerability management guidance
“The vendor addressed 59 vulnerabilities affecting its various products for business operations and underlying systems, including six defects that were actively exploited prior to Microsoft’s release of its monthly batch of patches.”
CyberScoop, on February 2026’s Patch Tuesday
“Microsoft on Tuesday released patches for a set of 84 new security vulnerabilities affecting various software components, including two that have been listed as publicly known.”
The Hacker News, on March 2026’s Patch Tuesday
“This month’s Patch Tuesday fixes six zero-day vulnerabilities, with five publicly disclosed and one exploited in attacks.”
BleepingComputer, on June 2026’s Patch Tuesday
“This month’s patches include fixes for two exploited zero-day vulnerabilities, one publicly disclosed zero-day vulnerability, and 62 Critical vulnerabilities, along with 557 additional vulnerabilities of varying severity levels.”
CrowdStrike, on July 2026’s Patch Tuesday
Read together, the five statements trace Microsoft’s 2026 patch cadence from 59 vulnerabilities in February to 84 in March to the record-setting 206 in June and 622 by July, with the count of pre-patch disclosures and active exploits rising in step. The five sources don’t even agree on terminology (zero-day, publicly known, actively exploited, disclosed), which is itself part of the story: security-focused outlets don’t apply Microsoft’s own severity taxonomy consistently, let alone match each other’s.
The Enterprise Scramble: What CISOs Are Prioritizing This Week
For patch teams, the size of a release matters less than what has to be tested and deployed first. Computerworld described the June cycle as requiring “Patch Now” treatment for Windows, Office, and Exchange, reporting that its Readiness team recommended administrators prioritize testing in a specific order: domain controllers, Hyper-V hosts, any system self-hosting on HTTP.sys, and Outlook-heavy desktops, in that sequence.
That order isn’t arbitrary. Domain controllers sit at the center of enterprise identity, so a flaw affecting them, like the Netlogon bug disclosed the previous month and discussed below, can compromise an entire network if left unpatched. HTTP.sys underpins both IIS and a wide range of Windows-hosted web services, which is why two of the month’s three zero-days, the HTTP.sys denial-of-service bug and the HTTP.sys remote code execution flaw, both touch that same component. Outlook and Exchange remain among the most consistently targeted enterprise attack surfaces industry-wide, a pattern security teams running SIEM platforms are built to catch once a compromise slips past the patch gap.
The AI Factor in a Growing Patch Load
Computerworld’s own commentary on the release size floated a theory that shows up increasingly in patch-management circles: that AI-assisted code review and fuzzing are surfacing more vulnerabilities before or shortly after release, not because Microsoft’s code is getting worse, but because the tools finding bugs are getting faster. The outlet offered that explicitly as speculation rather than a confirmed cause. Whether the theory holds up will show in whether monthly counts keep climbing at the rate they did between February and July.
From Disclosure to Exploitation: The 24-Hour Clock
June 2026 offered two vivid reminders of how quickly newly disclosed flaws can turn into active attacks, neither of them from the June Patch Tuesday batch itself. On May 12, 2026, Microsoft disclosed CVE-2026-41089 in a separate advisory tracked by CERT-EU: a critical stack-based buffer overflow in Windows Netlogon carrying a CVSS score of 9.8. The flaw let an unauthenticated attacker run arbitrary code with SYSTEM privileges on a domain controller by sending specially crafted network packets, the kind of vulnerability that can compromise an entire Windows domain if left unpatched. Belgium’s national cybersecurity center later confirmed CVE-2026-41089 was under active exploitation.
Then, in the same week as June’s Patch Tuesday, Ivanti disclosed two critical vulnerabilities in its Sentry product on June 9: an OS command-injection bug, CVE-2026-10520, with a maximum CVSS score of 10.0, and an authentication-bypass flaw, CVE-2026-10523, scored 9.9. Both allowed unauthenticated attackers to gain root-level or full administrative access to affected devices. Help Net Security reported that attackers began exploiting CVE-2026-10520 with a public proof-of-concept exploit within 24 hours of disclosure, and CISA added it to the Known Exploited Vulnerabilities catalog on June 9, 2026, two days after Ivanti’s advisory.
Neither Netlogon nor Ivanti Sentry belong to Microsoft’s own June 2026 zero-day count, but both landed in the same stretch of weeks and show the environment those three Microsoft zero-days shipped into, one where a full exploit chain, from disclosure to CISA KEV listing, can close in 48 hours or less. Similarly compressed timelines played out repeatedly across 2026, from SonicWall’s SMA appliances to Adobe’s ColdFusion platform, which is exactly why Microsoft’s own guidance urges treating publicly disclosed flaws as urgent even absent confirmed in-the-wild attacks.
Market Impact: Vulnerability Management Vendors Have Their Moment
Large Patch Tuesday releases don’t just create work for in-house IT teams. They create a marketing and analysis moment for the entire vulnerability-management industry. Within days of Microsoft’s June release, CrowdStrike, Rapid7, Computerworld, Splashtop, and Arctic Wolf had all published competing breakdowns of the same 206-vulnerability batch, each highlighting different CVEs, using different severity cutoffs, and landing on different totals. That crowded field is itself a data point. As Microsoft’s disclosed vulnerability count climbs, from 59 in February to 622 by July per the outlets’ own numbers, the operational burden shifts from “which patches do we apply” to “whose prioritization do we trust,” a question buyers comparing platforms like Tenable, Qualys, and Rapid7 increasingly have to answer against pricing that ranges from roughly $15,000 to $500,000 depending on environment size.
None of the reporting behind this article documented a specific Microsoft stock move tied to the release, and none should be assumed. The measurable impact sits downstream, in the demand for patch orchestration, change-control automation, and compliance validation work that a 206-vulnerability month generates across thousands of enterprise IT departments at once. Computerworld’s “Patch Now” designation for Windows, Office, and Exchange components effectively puts those systems on an accelerated deployment clock that competes with normal change-management review, a tension patch-management vendors have built entire product categories around resolving.
Checking Your Exposure: A Quick Audit
Before the predictions, a practical note. Administrators managing Windows fleets can confirm their June 2026 exposure with built-in commands rather than waiting on a third-party scanner.
PowerShell Commands to Run Today
The following snippets check whether the June cumulative update has installed and flag services tied to the month’s HTTP.sys-related zero-days:
# Check whether the June 2026 cumulative update has installed
Get-HotFix | Where-Object {$_.InstalledOn -ge (Get-Date "2026-06-09")} |
Select-Object HotFixID, Description, InstalledOn
# Confirm HTTP.sys-dependent services are running the current build
Get-Service -Name W3SVC, HTTP -ErrorAction SilentlyContinue |
Select-Object Name, Status, StartType
# Check BitLocker protector status on the local volume
Get-BitLockerVolume -MountPoint "C:" |
Select-Object MountPoint, ProtectionStatus, EncryptionMethodA returned HotFixID confirms the update installed. An empty result means the domain controller, web server, or endpoint in question is still exposed to CVE-2026-45586, CVE-2026-49160, and CVE-2026-50507 until it reboots into the patched build. Because two of June’s three disclosed zero-days touch HTTP.sys, any host running IIS, WinRM, or other HTTP.sys-dependent services should be prioritized ahead of general desktop rollout, consistent with Computerworld’s own testing-order recommendation.
What Comes Next: July’s Even Bigger Load and the KEV Question
June’s record didn’t survive the month. CrowdStrike’s July 2026 write-up counted 622 vulnerabilities addressed, including 62 Critical flaws, two zero-days under active exploitation in AD FS and SharePoint, and one additional publicly disclosed zero-day in BitLocker. BleepingComputer’s own July count landed lower, at roughly 570 flaws, underscoring that the same tracker-to-tracker variance seen in June persisted into the following month.
For June’s own three publicly disclosed zero-days, the open question at publication time is whether any will follow the pattern Rapid7 flagged in its own write-up: several vulnerabilities from May’s Patch Tuesday were added to CISA’s Known Exploited Vulnerabilities catalog within days of that release, despite showing no confirmed exploitation when Microsoft first shipped patches. Given that CVE-2026-47291’s proof-of-concept code was already circulating, and two of the three disclosed zero-days touch the widely deployed HTTP.sys component, security teams that treated June’s release as merely “publicly known but not urgent” carried real risk of that status changing before their patch window closed.
5 Predictions for the Rest of 2026’s Patch Cycles
- Monthly CVE counts stay elevated. If the climb from 59 in February to 622 in July continues even at a fraction of that pace, Microsoft’s remaining 2026 releases will likely stay well above the sub-100 counts common in earlier years, keeping patch teams in a near-permanent “Patch Now” posture.
- At least one June zero-day reaches CISA’s KEV catalog. Given Rapid7’s own observation that May’s routine-looking vulnerabilities were added to KEV within days, and that CVE-2026-47291’s exploit code is already public, a KEV listing for one of June’s flaws before Q3 2026 ends would fit the established pattern rather than break it.
- Vendor CVE counts keep disagreeing. As long as Microsoft’s Security Update Guide bundles republished third-party and Chromium CVEs alongside its own, expect CrowdStrike, Rapid7, and BleepingComputer to keep publishing totals that differ by 5 to 15 percent for the same release.
- HTTP.sys remains a recurring target. With two of three June zero-days and one of the month’s 9.8-severity bugs all touching the same component, expect HTTP.sys-adjacent CVEs to keep appearing in Microsoft’s releases through the rest of 2026.
- Enterprise patch-automation spending grows. As monthly patch volume climbs, expect continued enterprise investment in automated patch orchestration and AI-assisted triage tools, the same trend Computerworld’s coverage speculated is partly behind the rising CVE counts in the first place.
Frequently Asked Questions
What is Microsoft Patch Tuesday?
Patch Tuesday is Microsoft’s monthly, scheduled security-update release, issued on the second Tuesday of each month since October 2003. It bundles fixes for Windows, Microsoft Office, Azure services, developer tools, and other Microsoft products into one coordinated release instead of shipping patches individually as they’re found.
How many vulnerabilities did Microsoft fix in June 2026?
Most trackers, including CrowdStrike and Arctic Wolf, counted 206 Microsoft-authored vulnerabilities, with 37 to 39 rated Critical depending on the source. Rapid7 counted 200, and once republished third-party CVEs are included, Splashtop put the full bulletin at 568 total items.
Were any of June 2026’s zero-days actively exploited?
CrowdStrike, Rapid7, Computerworld, and Splashtop all reported no evidence of active exploitation for the three confirmed publicly disclosed zero-days (CVE-2026-45586, CVE-2026-49160, and CVE-2026-50507) at the time of release. BleepingComputer separately flagged a sixth vulnerability, CVE-2026-42897 in Exchange Server, as showing signs of active exploitation.
What was the most severe vulnerability in the June 2026 release?
Several remote-code-execution flaws tied for the release’s highest CVSS score of 9.8, including CVE-2026-47291 in HTTP.sys, CVE-2026-47643 in Azure Stack Edge, CVE-2026-44815 in the Windows DHCP Client service, CVE-2026-26142 in Nuance PowerScribe, and CVE-2026-45657 in the Windows kernel.
Why do security vendors report different vulnerability counts for the same Patch Tuesday?
Trackers differ on whether they count only Microsoft-authored CVEs, include republished third-party and Chromium-based Edge fixes, or fold in cloud-service patches that don’t require a traditional install. That methodology gap is why June 2026 counts ranged from 200 to 568 depending on the source.
Is the Windows Netlogon flaw part of the June 2026 Patch Tuesday?
No. CVE-2026-41089 was disclosed on May 12, 2026, a separate advisory on June 9, 2026, before June’s Patch Tuesday. It’s relevant context because, unlike June’s three zero-days, it was later confirmed under active exploitation according to Belgium’s Centre for Cybersecurity.
When is the next Microsoft Patch Tuesday?
Patch Tuesday falls on the second Tuesday of every month. Following July 14, 2026, the next scheduled release landed on July 14, 2026, and CrowdStrike’s analysis put the July 2026 release at 622 addressed vulnerabilities, larger than June’s roughly 206 CVEs.
Should home users worry about this Patch Tuesday, or is it an enterprise-only story?
Most of the highest-severity flaws, including the domain-controller and Extended Security Updates issues, primarily affect enterprise infrastructure. But standard consumer Windows updates still include fixes for components like BitLocker and HTTP.sys, so home users should still install monthly cumulative updates promptly rather than deferring them for weeks.
Related Coverage
- Tenable vs Qualys vs Rapid7: $15K-$500K Price Gap [2026]
- SonicWall Zero-Days: CVSS 10.0 Bug Exploited 22 Days [2026]
- Adobe ColdFusion Zero-Day: CVSS 10.0, 2-Hour Exploit [2026]
- Chrome 151 Patches 370 Vulnerabilities, 7 Critical [2026]
- NetScaler’s 4th Bleed Flaw Exploited in 24 Hours [2026]
- Verizon DBIR: Exploits Overtake Credentials at 31% [2026]
- Microsoft Sentinel vs Splunk vs Elastic: $24K-250K [2026]
- Linux Copy Fail Flaw: CVSS 7.8, Root in Seconds [2026]
