Summary
Microsoft dropped a massive June 2026 Patch Tuesday, addressing over 200 security vulnerabilities across its product line — one of the largest patch cycles in the company’s history. Among the fixes were 33-37 critical-severity bugs spanning remote code execution, elevation of privilege, security feature bypass, information disclosure, and denial of service categories. Six zero-day vulnerabilities were patched, including one actively exploited in the wild.
The actively exploited flaw, CVE-2026-41091, is a Microsoft Defender elevation-of-privilege vulnerability that had already been targeted before the patch. Among the publicly disclosed zero-days: CVE-2026-45586 (“GreenPlasma”), a CTFMON elevation of privilege flaw granting SYSTEM access; CVE-2026-50507 (“YellowKey”), a BitLocker security feature bypass; CVE-2026-49160 (“HTTP/2 Bomb”), an HTTP.sys denial of service vulnerability reported by OpenAI’s Codex; and CVE-2020-17103 (“MiniPlasma”), an incomplete fix for a 2020 vulnerability that still allows SYSTEM privileges.
A prolific independent researcher known as “Nightmare Eclipse” was responsible for publicly disclosing several of these zero-days, including the GreenPlasma, YellowKey, and MiniPlasma exploits. Their uncoordinated disclosure approach has reignited the debate around responsible vulnerability disclosure in the security community.
Sources
- BleepingComputer — Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200+ flaws
- Krebs on Security — A Record-Breaking Patch Tuesday for June 2026
- CrowdStrike — Patch Tuesday Analysis, June 2026
Commentary
A 200+ vulnerability Patch Tuesday is not a rounding error — it reflects an expanding attack surface that security teams are increasingly struggling to manage. The involvement of AI tools in finding vulnerabilities (OpenAI’s Codex reported CVE-2026-49160) signals a new era where automated discovery is accelerating the disclosure pipeline faster than most organizations can patch. Expect these numbers to keep climbing.
The Nightmare Eclipse disclosures also highlight a real tension: uncoordinated public drops of working exploits put defenders on an immediate clock, but they also force vendors to stop sitting on incomplete fixes like the MiniPlasma re-emergence of a 2020 bug. Either way, if you haven’t patched yet, you’re already behind.