Microsoft Patch Tuesday June 2026: Record 200+ Vulnerabilities in Single Release, Three Pre-Disclosure Zero-Days

On June 9, 2026, Microsoft released Patch Tuesday security updates addressing 206 vulnerabilities—the largest single-month disclosure in the 23-year history of the program, exceeding the previous record of 167 CVEs. The volume alone signals something shifted in the threat landscape or in Microsoft’s own development pipelines. Of the 206 fixes, 39 carry Critical severity rating, 166 are Important, and one is Moderate. The critical tier breaks down into 28 remote code execution vulnerabilities, four elevation-of-privilege flaws, and one information disclosure issue. Additionally, three of the CVEs were publicly disclosed before patches existed, meaning a gap existed during which attackers had proof-of-concept code and unpatched systems both available.

The scope is breathtaking. Windows received 120 patches. Extended Security Updates deployments got 103. Microsoft Office shipped 54, including several critical RCE vulnerabilities in Outlook and Word that can be triggered through the Preview Pane without users explicitly opening files. Remote Desktop Client alone absorbed 11 RCE fixes, with four rated Critical. Windows Hyper-V shipped three Critical RCE vulnerabilities capable of guest-to-host escape. For Microsoft Graph—the API platform underlying Microsoft 365—CVE-2026-47655 discloses sensitive information at CVSS 6.5.

The pre-disclosure zero-days compound the urgency. CVE-2026-45586 (Windows Collaborative Translation Framework CTFMON elevation of privilege), CVE-2026-50507 (Windows BitLocker security feature bypass), and CVE-2026-49160 (HTTP/2 denial of service in HTTP.sys) were all known to attackers before patches dropped. This is not theoretical; it means the 72-hour window between disclosure and organizational patch deployment was a window of active exploitation risk.

Organizations cannot patch all 206 vulnerabilities with equal priority. The security community consensus is immediate: prioritize CVE-2026-45657 on all internet-accessible systems, apply IIS/HTTP.sys patches for CVE-2026-49160 on public-facing web servers, and audit BitLocker-protected device inventory for CVE-2026-50507 before deploying new hardware. The sheer volume suggests systematic triage will become normal. By the time you finish patching critical June CVEs, July’s disclosures will already be in your queue.