Microsoft’s June 2026 Patch Tuesday has set a new record with 206 security vulnerabilities patched across its product ecosystem, surpassing any previous monthly release. Of these, 32 to 39 are rated critical, and at least three zero-day flaws were publicly known or actively exploited before the patches dropped.
The most alarming fix addresses CVE-2026-45657, a use-after-free vulnerability in the Windows Kernel with a CVSS score of 9.8. This flaw allows unauthenticated remote attackers to execute arbitrary code with SYSTEM-level privileges by sending specially crafted TCP/IP traffic to a vulnerable system — no user interaction required. It affects Windows 11 and all current Windows Server releases. Other critical patches include CVE-2026-41089, a Netlogon stack-based buffer overflow that could give attackers SYSTEM-level control of domain controllers, and CVE-2026-50507, a BitLocker security feature bypass allowing physical access to encrypted data.
Three publicly disclosed zero-days were also addressed: a Windows Collaborative Translation Framework elevation of privilege flaw (CVE-2026-45586, dubbed “GreenPlasma” by the Nightmare Eclipse researcher), an HTTP.sys denial-of-service vulnerability (CVE-2026-49160), and the BitLocker bypass.
Source
Coverage from The Hacker News, Krebs on Security, and BleepingComputer.
Commentary
Two hundred and six patches in a single release is staggering. The Windows Kernel RCE (CVE-2026-45657) is the headliner — a network-exploitable, unauthenticated, zero-interaction flaw scoring 9.8 is about as bad as it gets. Combined with the Netlogon buffer overflow that could compromise domain controllers, enterprise security teams have their work cut out for them this month. The sheer volume of patches is itself a signal: attack surface in modern Windows is expanding faster than Microsoft can secure it proactively. If your organization runs Windows in any capacity, this Patch Tuesday is not optional — it’s an emergency.