Microsoft Shatters Its Own Patch Tuesday Record: 200 Vulnerabilities, Six Zero-Days, and a New Patching Reality for IT Teams

Released on June 10, 2026, Microsoft's June Patch Tuesday addressed 200 security vulnerabilities across Windows, Office, Azure, and related products, making it the largest single monthly security update in the program's history. It surpasses the previous record of 167 CVEs by a wide margin. The volume itself is the story, and it has direct operational consequences for every IT team running Windows.

What Just Happened

The June 2026 release patched 200 CVEs, including 33 rated Critical. Of those Critical flaws, 28 involve remote code execution, four are elevation of privilege, and one is an information disclosure bug.

That headline number still understates the true scope. The 200 figure excludes fixes Microsoft pushed earlier in the month for Mariner, Azure HorizonDB, Microsoft Copilot, Copilot Chat, M365 Copilot, Exchange Online, and Microsoft Graph. It also excludes 360 Microsoft Edge and Chromium flaws fixed by Google this month.

For context, Amol Sarwate, Head of Security Research and REDLab at Cohesity, notes: "In the first half of 2026, there was a 42% increase in the total number of Patch Tuesday CVEs, with a roughly 3x increase in critical vulnerabilities (9.0 or above) compared to the same time last year."

Why the Volume Is Climbing: AI-Powered Vulnerability Discovery

This is not a one-off spike. Industry analysts point to a clear catalyst: artificial intelligence. Both corporate security teams and independent researchers are using automated large language model tooling to audit codebases, finding flaws at a speed and scale that outpaces traditional manual review.

Microsoft's own Redmond teams use a multi-agent system called MDASH to carry out internal security research. The HTTP/2 Bomb vulnerability (detailed below) was discovered by researcher Quang Luong using the Codex AI, a direct example of this shift playing out in public.

Dustin Childs, Head of Threat Awareness at TrendAI's Zero Day Initiative, put it plainly: "June's record-shattering drop of 210 Microsoft vulnerabilities is a stark warning that AI is supercharging flaw discovery at an uncontrollable scale. The current number of CVEs shipped by Microsoft this year already exceeds the total number shipped in all of 2018."

There is also a human element. Two of the publicly disclosed zero-days stem from a conflict between Microsoft and an independent researcher operating under the name "Nightmare Eclipse," who has been publishing unpatched flaws in protest of how Microsoft handles its bug bounty program. Within hours of Patch Tuesday shipping, Nightmare Eclipse released a proof-of-concept exploit for a new zero-day called "RoguePlanet," which abuses a race condition in Windows Defender to spawn a command shell with SYSTEM-level privileges.

The Vulnerabilities Your Team Must Prioritize

With 200 CVEs on the table, clear triage is essential. Here are the ones that matter most.

CVE-2026-45586, "GreenPlasma": Windows CTFMON Elevation of Privilege (CVSS 7.8) This publicly disclosed flaw in the Windows Collaborative Translation Framework allows a local attacker to elevate to SYSTEM privileges via improper link resolution. Microsoft rates exploitation as "more likely."

CVE-2026-50507, "YellowKey": Windows BitLocker Security Bypass A local attacker with physical access can bypass BitLocker's full-disk encryption and read protected data. The risk is highest for organizations relying on BitLocker to protect lost or stolen hardware. Researchers described it as a potential stealth backdoor in the encryption feature.

CVE-2026-49160, "HTTP/2 Bomb": HTTP.sys Denial of Service This publicly disclosed flaw abuses how HTTP/2 compresses headers. An unauthenticated attacker can send a small amount of data that forces servers to allocate disproportionately large amounts of memory, effectively taking them offline. It was discovered using the Codex AI.

CVE-2026-47291, Windows HTTP.sys: Potentially Wormable RCE Sarwate flags this as a top priority. It allows unauthenticated attackers to achieve full remote compromise with no user interaction, meeting the technical definition of a wormable vulnerability.

CVE-2026-44815, Windows DHCP Client: Critical Network Flaw The DHCP Client runs on virtually every Windows endpoint, giving this flaw an enormous attack surface. It falls in the same critical tier as CVE-2026-47291.

Remote Desktop Client: Seven Critical Flaws Among Eleven Total If a user connects via RDP to a server controlled by an attacker, the attacker can execute code on the user's machine. This is an unusually high concentration of critical bugs in a single component.

Concrete Steps for IT Teams This Week

1. Deploy the June cumulative updates now. Apply KB5094126 for Windows 11 and KB5094127 for Windows 10 immediately. Do not wait for the next patch window.

2. Harden BitLocker-protected devices. Microsoft confirms physical access is required to exploit the BitLocker bypass, typically via a USB drive, on systems using TPM-only unlock. Add a PIN to the TPM configuration as a temporary mitigation while you confirm patching is complete.

3. Patch HTTP.sys and IIS on all internet-facing servers. Prioritize CVE-2026-45657 on all internet-accessible Windows systems and apply the HTTP.sys patch for CVE-2026-49160 on every public-facing web server.

4. Audit RDP exposure. Seven critical Remote Desktop Client flaws is an unusually high number. Review which endpoints can initiate RDP sessions and confirm they are patched before any remote access occurs.

5. Adjust your patch testing cadence. This volume signals a permanent shift from monthly patching as a checkbox to continuous, risk-based patch management. Automated tooling and clear triage criteria are no longer optional.

6. Monitor for RoguePlanet. Researchers have confirmed the proof-of-concept works for local privilege escalation. There is no patch yet. Tighten your endpoint detection rules and watch for unusual SYSTEM-level process spawning from Windows Defender.

The Bigger Picture

This release is a signal, not an anomaly. AI is finding bugs faster than the industry can patch them, and that dynamic is accelerating. Microsoft's own success using AI to find vulnerabilities internally is part of what is driving the record counts. IT and security teams need to treat patching as a continuous operational discipline, with automated tooling and risk-based triage built in from the start, not bolted on after the fact.

How 247techify Can Help

At 247techify, we help businesses stay on top of exactly this kind of high-volume patch cycle, combining automated patch management, risk-based prioritization, and continuous monitoring so nothing slips through. If your team is struggling to keep pace with Microsoft's new normal, reach out to us at https://www.247techify.com/ and let us take the pressure off.