Microsoft on Tuesday issued patches for a record-breaking 206 security vulnerabilities across its software lineup, including three flaws that were already publicly known at the time of release.
Among the 206 flaws, 39 are classified as Critical, while 167 are rated Important in severity. This includes 63 privilege escalation issues, 56 remote code execution bugs, 30 information disclosure vulnerabilities, 27 spoofing flaws, 20 security feature bypass problems, seven denial-of-service issues, and three tampering vulnerabilities.
The updates also cover two non-Microsoft CVEs: a privilege escalation flaw affecting Windows Kernel (CVE-2025-10263) and a UEFI Secure Boot security feature bypass (CVE-2026-8863). These come on top of more than 350 security flaws that Google has addressed in Chromium, which is used by Microsoft's Edge browser.
Leading the list of fixes is CVE-2026-45657 (CVSS score: 9.8), a use-after-free vulnerability in Windows Kernel that could enable remote code execution.
"An attacker could exploit this vulnerability by sending specially crafted network traffic to a vulnerable Windows system," Microsoft stated. "If successful, the malicious network packets could trigger a flaw in how the Windows kernel processes certain TCP/IP data, potentially allowing the attacker to run code with system-level privileges without needing to sign in or interact with a user."
Other notable vulnerabilities include the following -
CVE-2026-47291 (CVSS score: 9.8) - An integer overflow or wraparound bug in Windows HTTP.sys that enables an unauthorized attacker to execute code over a network.
CVE-2026-44815 (CVSS score: 9.8) - A stack-based buffer overflow vulnerability in Windows DHCP Client that allows an unauthorized attacker to execute code over a network.
"This flaw needs no credentials or user action and can turn network traffic into a full system compromise," said Alex Vovk, CEO and co-founder of Action1, regarding CVE-2026-44815. "An attacker could send specially crafted network traffic to a system configured for DHCP services."
"Successful exploitation could allow unauthorized code execution over the network with high impact to confidentiality, integrity, and availability. This vulnerability creates serious risk because DHCP is a core network function. Successful exploitation could lead to server compromise, malware deployment, data theft, service disruption, and movement deeper into the network. Systems handling DHCP traffic should be treated as high-priority patch targets."
Microsoft has also released patches to address CVE-2026-45585 (CVSS score: 6.8), a Windows BitLocker security feature bypass vulnerability for which a proof-of-concept (PoC) exploit called YellowKey was published by security researcher Chaotic Eclipse (aka Nightmare-Eclipse) last month.
CVE-2026-45585 is among several security feature bypasses that the Windows maker has addressed this month -
CVE-2026-45655 (CVSS score: 5.3)
CVE-2026-45658 (CVSS score: 7.8)
CVE-2026-50507 (CVSS score: 6.8)
"A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device," Microsoft said in its advisories for the three issues. "An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data."
According to security researcher Will Dormann, CVE-2026-50507 is believed to be a fix for a BitLocker bypass named bitskrieg that provides full access to encrypted data. It is worth noting that CVE-2026-50507, along with CVE-2026-49160 and CVE-2026-45586, are listed as publicly disclosed zero-days.
CVE-2026-45586 (CVSS score: 7.8) - Windows Collaborative Translation Framework (CTFMON) privilege escalation vulnerability
CVE-2026-49160 (CVSS score: 7.5) - HTTP.sys denial-of-service vulnerability
CVE-2026-49160 is linked to HTTP2/Bomb, an attack technique that can be used to take web servers offline within seconds. In tests conducted by Calif, an IIS server was found to exhaust 64 GB of RAM in roughly 45 seconds. To mitigate the attack, Microsoft has introduced a new "MaxHeadersCount" registry setting to restrict the number of headers in HTTP/2 and HTTP/3 requests.
"Limiting HTTP headers can help protect systems and servers from excessive memory use, high CPU consumption, and denial-of-service attacks," Microsoft stated. "Because HTTP/2 (HPACK) or HTTP/3 (QPACK) header compression is used and more complex protocol processing, enforcing a header limit such as MaxHeadersCount can help maintain performance and reliability."
On the other hand, CVE-2026-45586 is suspected to be a fix for a zero-day privilege escalation exploit that Chaotic Eclipse released under the name GreenPlasma.
Lastly, the June 2026 update also addresses MiniPlasma, a separate vulnerability disclosed by Chaotic Eclipse as an incomplete fix for CVE-2020-17103, which was originally patched by Microsoft in December 2020.
"To comprehensively address the vulnerability identified by CVE-2020-17103 and recently publicly referred to as 'MiniPlasma,' Microsoft recommends installing the June 2026 updates for your Windows operating systems," the tech giant said in an update to its advisory.
The growing number of patches has been attributed to the use of artificial intelligence (AI)-assisted vulnerability discovery methods, a trend that Microsoft said will continue in the foreseeable future.
"Pandora's proverbial box has been opened, and as more advanced AI models become available, we expect the norm to continue upward across the board, not just for Patch Tuesday," said Satnam Narang, senior staff research engineer at Tenable, in a statement.
Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative (ZDI), described the massive set of Microsoft vulnerabilities as a testament to how AI is supercharging flaw discovery at an uncontrollable scale.
"The current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018," Childs said. "It is extraordinary that Microsoft can produce so many patches in a single month, and I expect many testers are wondering what quality issues may exist."
The patches come as Chaotic Eclipse released a PoC exploit for yet another Microsoft Defender zero-day called RoguePlanet, characterizing it as a race condition that could be used to spawn a Windows command prompt with SYSTEM privileges.