Microsoft Patch Tuesday June 2026: 206 Vulnerabilities and Security Updates

Key Findings

• Microsoft released 206 vulnerabilities in June 2026 Patch Tuesday, the largest monthly batch on record

• 32 vulnerabilities marked as critical, with 28 being remote code execution flaws

• 4 critical vulnerabilities flagged as more likely to be exploited in active attacks

• 23 critical vulnerabilities assessed as less likely to be exploited but still pose significant risk

• 3 vulnerabilities were publicly known but not yet exploited at time of release

• Affected products span Windows core services, Microsoft Office applications, Azure services, and enterprise infrastructure

• Security researchers attribute the surge to AI-assisted vulnerability discovery becoming mainstream

Background

The June 2026 Patch Tuesday represents a watershed moment for Microsoft's monthly security updates. With 206 total vulnerabilities addressed, the company has shattered its previous record, continuing an alarming trend seen throughout the first half of 2026. Security researchers note that the volume of vulnerabilities patched this year has already exceeded the entire output from 2018. Industry experts attribute this explosion to the proliferation of advanced artificial intelligence models that can discover vulnerabilities faster and aid in patch development and testing. Some analysts question whether this represents the new normal for software maintenance and how organizations will prioritize deploying patches across such massive batches.

Critical Vulnerabilities Assessed as More Likely to Be Exploited

Four critical vulnerabilities received heightened attention from Talos researchers due to Microsoft's assessment that active exploitation is more probable. CVE-2026-42985 is a heap-based buffer overflow in the Remote Desktop Client that enables remote code execution without authentication. An attacker can send specially crafted packets over the network to achieve code execution on vulnerable systems.

CVE-2026-47291 represents an integer overflow flaw in the Windows HTTP Protocol Stack (http.sys). Unauthenticated attackers can send malicious packets to servers utilizing the HTTP stack, potentially leading to remote code execution. This vulnerability is particularly concerning because it requires no special privileges or user interaction.

CVE-2026-44803 and CVE-2026-44812 are both integer overflow vulnerabilities in the Windows Graphics component affecting the Win32K graphics subsystem. Unlike the network-based flaws above, these require local access but allow attackers to execute arbitrary code with elevated privileges once they gain a foothold on the system.

Critical Vulnerabilities Assessed as Less Likely to Be Exploited

Twenty-three critical vulnerabilities were categorized by Microsoft as less likely to be exploited, though they still warrant immediate attention. However, "less likely" does not mean safe to ignore, as exploitation often requires additional preparation steps rather than being fundamentally impossible.

Five vulnerabilities in the Remote Desktop Client (CVE-2026-42992, CVE-2026-44799, CVE-2026-44801, CVE-2026-47289, and CVE-2026-48563) stem from heap-based buffer overflows. These allow remote code execution when an attacker controls a Remote Desktop Server and waits for a victim to connect. While this requires the attacker to set up infrastructure and lure victims, it remains a viable attack path.

Three Hyper-V vulnerabilities (CVE-2026-45607, CVE-2026-45641, and CVE-2026-47652) involve out-of-bounds reads that enable local code execution. These require an authenticated attacker operating from within a guest virtual machine to send specially crafted requests to hardware resources, potentially compromising the host system.

CVE-2026-45657 is a use-after-free vulnerability in the Windows Kernel that allows remote code execution through specially crafted network traffic. An attacker exploiting this flaw could run code with system-level privileges without user interaction.

CVE-2026-48574 is a heap-based buffer overflow in Windows Media, enabling local code execution. CVE-2026-42987 is a use-after-free flaw in Windows Deployment Services that permits remote code execution over the network. CVE-2026-44815 involves a stack-based buffer overflow in the Windows DHCP Client, allowing remote code execution when an authenticated user sends malicious network traffic to a DHCP server.

Office and Productivity Application Vulnerabilities

Three critical vulnerabilities affect Microsoft Outlook and Word through type confusion flaws in the Microsoft Office framework. CVE-2026-45456, CVE-2026-45458, and CVE-2026-47635 all stem from improper resource access using incompatible types. These flaws can be triggered through Outlook's preview pane when rendering emails, since Outlook leverages Word's rendering engine. An attacker need only send a specially crafted email to achieve local code execution.

Publicly Known but Not Yet Exploited Vulnerabilities

Microsoft disclosed three vulnerabilities that were already public knowledge at the time of the June patch release but had not been actively exploited in the wild. These CVEs (CVE-2026-45586, CVE-2026-50507, and CVE-2026-49160) represent a different threat category than zero-days, as the security community and attackers alike are aware of their existence. Organizations should prioritize patches for these flaws given that exploit development timelines are often compressed once vulnerabilities are disclosed.

Industry Perspective on Vulnerability Surge

The record-breaking patch count has prompted serious discussion among cybersecurity leaders about sustainability and resource allocation. Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, noted the extraordinary nature of Microsoft producing so many patches simultaneously while raising concerns about the broader implications. Satnam Narang, senior staff research engineer at Tenable, warned that "Pandora's proverbial box has been opened" and expects the vulnerability flood to continue upward as advanced AI models become more widely available. This sentiment reflects growing uncertainty about whether defenders can realistically maintain pace with patch deployment at scale.

Sources

• https://blog.talosintelligence.com/microsoft-patch-tuesday-for-june-2026-snort-rules-and-prominent-vulnerabilities/

• https://cyberscoop.com/microsoft-patch-tuesday-june-2026/

• https://krebsonsecurity.com/2026/06/a-record-breaking-patch-tuesday-for-june-2026/

• https://www.socdefenders.ai/item/9d5dd43a-7613-44d2-8d7c-b1b669ac92db