Microsoft patches a record 206 flaws—and one is already being exploited

Yesterday, on Patch Tuesday for June, Microsoft released security updates to address 206 vulnerabilities. This is a new record, breaking the previous record of 175 in October 2025. In addition to Windows and Office, both Exchange Server and Microsoft’s cloud services are also affected. One of the vulnerabilities is already being exploited in the wild. Microsoft classifies a total of 38 vulnerabilities as critical, while the remainder are all designated as high risk.

The next Patch Tuesday is scheduled for July 14th, 2026.

A large number of the vulnerabilities—118 this time around—are spread across the various Windows versions (10, 11, Server) for which Microsoft still officially provides security updates.

The only security vulnerability in this massive update package that’s actively being exploited in the wild is the Elevation of Privilege (EoP) vulnerability CVE-2026-41091 in Microsoft Defender. With it, an attacker can gain system privileges—and with Microsoft thanking various individuals for reporting this vulnerability, it suggests that these attacks may be quite widespread already.

Microsoft has replaced the vulnerable Malware Protection Engine via the daily automatic Defender updates. The patched engine has a version number of at least 1.1.26040.8.

To check whether your PC already has this engine version in Windows 11, go to Settings → Privacy & security → Windows Security → [Open Windows Security] → Settings → About. In Windows 10, start by going to Settings → Update & Security → [Open Windows Security] and then follow the same steps as for Windows 11.

June is an important month for Windows because it’s the month when old Secure Boot certificates expire, which entails all kinds of non-trivial update work. Microsoft is also addressing 10 security vulnerabilities in the Security Feature Bypass (SFB) category, which were discovered and reported by independent researchers. Anyone able to exploit one of these could load malicious code as soon as the system starts up, before the appropriate security measures can catch it.

Among the 118 vulnerabilities in Windows fixed this month, 19 are Remote Code Execution (RCE) vulnerabilities classified as critical. CVE-2026-47288 in the Windows kernel is especially problematic, as an attacker can remotely execute injected code with system privileges without authentication.

There’s also CVE-2026-47291 in the HTTP service (http.sys), where an attacker can inject and execute code without needing to authenticate. However, if a default value for MaxRequestBytes is set in the Windows registry, the system is not vulnerable. Microsoft describes how to achieve this if necessary in the security bulletin for this vulnerability, including a PowerShell script. The Denial of Service (DoS) vulnerability CVE-2026-49160 in http.sys was already publicly known beforehand.

There’s also CVE-2026-44815 in the DHCP Client service, which runs on all PCs, making it an attractive target for any attacker. Here, too, an attacker can inject and execute code without having to authenticate.

There’s also CVE-2026-45585 and CVE-2026-50507, which target the “YellowKey” and “GreenPlasma” security flaws in BitLocker, which were disclosed by notorious security researcher Nightmare Eclipse. Microsoft patched the former in May, but updated the relevant bulletin in June.

Microsoft has fixed 54 vulnerabilities in its Office products, twice as many as in May. These include 25 RCE vulnerabilities, nine of which are classified as critical. In these cases, the preview pane itself is an attack vector—a user does not need to actually open a malicious file in Office to enable a successful attack. The remaining RCE vulnerabilities can be exploited if a user opens a malicious file in a vulnerable Office product.

Exploitation of the critical RCE vulnerabilities CVE-2026-45607, CVE-2026-45641, and CVE-2026-47652 could allow malicious code to escape from a guest system and execute code on the host system.

Microsoft has fixed eight vulnerabilities in Exchange Server. These include CVE-2026-45583, an RCE vulnerability that can only be exploited in a MITM (man-in-the-middle) scenario.

Only the data leak CVE-2026-48579 in Exchange Online is classified as critical, and Microsoft has already patched it. An attacker could exploit CVE-2026-48579 by tricking an Exchange administrator into opening a malicious link, which would allow them to execute code within the administrator’s web session using the administrator’s privileges.

The latest security update to Edge 149.0.4022.62 is dated June 9th and is based on Chromium 149.0.7827.103. It also addresses 74 Chromium vulnerabilities, which are not included in the total number of vulnerabilities mentioned above, nor are the over 400 Chromium vulnerabilities from the previous week. A zero-day vulnerability in the Chromium base (CVE-2026-11645) is also addressed.

Tip: Whether you keep your Windows up to date, you need proper antivirus protections if you want your PC to remain secure and private. Check out our picks for the best antivirus software for Windows as well as best VPN services to stay ahead of security problems.