On Tuesday, Microsoft rolled out security updates addressing a record-breaking 206 vulnerabilities across its software products. Three of these flaws were already publicly known when the patches were released.
Among the 206 vulnerabilities, 39 are classified as Critical and 167 as Important. The breakdown includes 63 privilege escalation issues, 56 remote code execution flaws, 30 information disclosure bugs, 27 spoofing vulnerabilities, 20 security feature bypasses, seven denial-of-service issues, and three tampering weaknesses.
The update also covers two vulnerabilities not originating from Microsoft: a privilege escalation flaw in the Windows Kernel (CVE-2025-10263) and a UEFI Secure Boot bypass (CVE-2026-8863). These are separate from the over 350 security issues Google recently fixed in Chromium, the engine behind Microsoft’s Edge browser.
The most critical fix is CVE-2026-45657 (CVSS score: 9.8), a use-after-free vulnerability in the Windows Kernel that could allow remote code execution.
“An attacker could take advantage of this flaw by sending specially designed network traffic to an affected Windows machine,” Microsoft explained. “If the attack succeeds, the malicious packets could trigger a weakness in how the Windows kernel handles specific TCP/IP data, potentially letting the attacker execute code with system-level access—no login or user interaction required.”
Other significant vulnerabilities include –
- CVE-2026-47291 (CVSS score: 9.8) – An integer overflow or wraparound issue in Windows HTTP.sys that enables an unauthenticated attacker to run code remotely over a network.
- CVE-2026-44815 (CVSS score: 9.8) – A stack-based buffer overflow in the Windows DHCP Client that lets an unauthenticated attacker execute code over a network.
“This vulnerability requires no credentials or user interaction and can transform ordinary network traffic into a complete system takeover,” said Alex Vovk, CEO and co-founder of Action1, regarding CVE-2026-44815. “An attacker would simply need to send specially crafted network traffic to a system running DHCP services.”
“If exploited, this could allow unauthorized remote code execution with severe consequences for confidentiality, integrity, and availability. The danger is amplified because DHCP is a fundamental networking service. A successful attack could lead to server takeover, malware installation, data theft, service outages, and lateral movement within the network. Any system processing DHCP traffic should be patched as a top priority.”
Microsoft has also fixed CVE-2026-45585 (CVSS score: 6.8), a Windows BitLocker security feature bypass for which a proof-of-concept exploit named YellowKey was published by security researcher Chaotic Eclipse (also known as Nightmare-Eclipse) last month.
CVE-2026-45585 is among several security feature bypasses Microsoft has resolved this month –
“A successful attacker could circumvent the BitLocker Device Encryption feature on the system’s storage drive,” Microsoft stated in its advisories for the three issues. “Someone with physical access to the target machine could exploit this flaw to access encrypted data.”
Security researcher Will Dormann noted that CVE-2026-50507 appears to address a BitLocker bypass called bitskrieg, which grants full access to encrypted data. It’s important to note that CVE-2026-50507, along with CVE-2026-49160 and CVE-2026-45586, are publicly disclosed zero-day vulnerabilities.
- CVE-2026-45586 (CVSS score: 7.8) – A privilege escalation flaw in the Windows Collaborative Translation Framework (CTFMON)
- CVE-2026-49160 (CVSS score: 7.5) – A denial-of-service vulnerability in HTTP.sys
CVE-2026-49160 is tied to an attack method called HTTP2/Bomb, which can crash web servers in seconds. In tests performed by Calif, an IIS server consumed 64 GB of RAM in roughly 45 seconds. To counter this attack, Microsoft has added a new “MaxHeadersCount” registry setting that restricts the number of headers allowed in HTTP/2 and HTTP/3 requests.
“Restricting HTTP headers can shield systems and servers from excessive memory consumption, high CPU usage, and denial-of-service attacks,” Microsoft explained. “Since HTTP/2 (HPACK) and HTTP/3 (QPACK) use header compression and involve more complex protocol handling, setting a header limit like MaxHeadersCount can help preserve system performance and stability.”
Meanwhile, CVE-2026-45586 is believed to address a zero-day privilege escalation exploit that Chaotic Eclipse published under the name GreenPlasma.
Additionally, the June 2026 update fixes MiniPlasma, a separate vulnerability disclosed by Chaotic Eclipse. This flaw stems from an incomplete fix for CVE-2020-17103, which Microsoft originally patched in December 2020.
“To fully address the vulnerability tracked as CVE-2020-17103 and recently referred to publicly as ‘MiniPlasma,’ Microsoft recommends installing the June 2026 updates for your Windows operating systems,” the company stated in an updated advisory.
The growing volume of patches has been linked to the adoption of AI-powered vulnerability discovery methods—a trend Microsoft expects to persist going forward.
“Pandora’s box has been opened, and as more sophisticated AI models emerge, we anticipate this upward trend to continue across the industry, not just for Patch Tuesday,” said Satnam Narang, senior staff research engineer at Tenable.
Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative (ZDI), called the enormous batch of Microsoft vulnerabilities evidence of how AI is accelerating flaw discovery at an unprecedented pace.
“The total number of CVEs Microsoft has issued this year already surpasses the entire count from 2018,” Childs remarked. “It’s remarkable that Microsoft can deliver so many patches in a single month, and I imagine many testers are concerned about potential quality concerns.”
The patches arrive as Chaotic Eclipse published a proof-of-concept exploit for yet another Microsoft Defender zero-day called RoguePlanet. The researcher described it as a race condition that could be leveraged to open a Windows command prompt running with SYSTEM-level privileges.
