Microsoft June 2026 Patch Tuesday: 198 Vulnerabilities and 3 Actively Exploited Zero-Days

June 2026’s Record-Breaking Patch Drop

On June 9, 2026, Microsoft released its monthly security update batch — and this time, the numbers are staggering. According to cybersecurity researchers tracking the release, 198 vulnerabilities were addressed across Microsoft’s product ecosystem, making it the largest single monthly Patch Tuesday drop in recent memory. Three of those vulnerabilities are being actively exploited in the wild, demanding immediate enterprise action before threat actors escalate their campaigns.

The 198 CVEs span every major attack class: 63 Elevation of Privilege flaws, 54 Remote Code Execution (RCE) bugs, 27 Spoofing vulnerabilities, 26 Information Disclosure issues, 18 Security Feature Bypasses, 7 Denial of Service flaws, and 3 Tampering vulnerabilities. No single product line escaped unscathed — Windows kernel components, Office suite, Exchange Server, SharePoint, Azure Kubernetes Service, and Hyper-V all received significant patches.

For enterprise security teams already managing alert fatigue, this month is not the moment to defer patching cycles. The combination of three in-the-wild zero-days alongside critical RCE chains in Remote Desktop Client and Hyper-V creates a threat surface that adversaries are already probing.

The Three Actively Exploited Zero-Days

Of the 198 CVEs, three have been confirmed by Microsoft as actively exploited before any patch was available. These demand immediate prioritization above all else.

CVE-2026-50507 — Windows BitLocker Security Feature Bypass

BitLocker is the cornerstone of Microsoft’s full-disk encryption story for enterprise endpoints, which makes this bypass particularly alarming. According to the advisory, an attacker with physical or local access can circumvent BitLocker’s encryption protections entirely, potentially reading sensitive data off a device that was supposed to be encrypted at rest. The severity rating is Important rather than Critical, which may mislead triage teams — but real-world exploitation confirmed in the wild changes the calculus. Any organization relying on BitLocker for laptop encryption policies (a near-universal enterprise control) should treat this as an emergency patch.

The physical-or-local-access requirement means the threat model skews toward insider threats, device theft scenarios, and supply-chain interdiction — not remote attackers. However, with nation-state actors documented stealing devices for forensic analysis, and with managed service providers having local access to client endpoints, the blast radius is wider than the classification suggests.

CVE-2026-49160 — HTTP.sys Denial of Service (HTTP/2)

This vulnerability targets HTTP.sys, the kernel-mode HTTP protocol stack that underpins IIS, WinRM, and other Windows web server components. Researchers note that a crafted HTTP/2 request stream can knock exposed web-facing servers offline — a classic volumetric DoS that bypasses traditional rate-limiting because the malformed request triggers a kernel-level fault rather than an application-layer timeout. Any Windows server running IIS or WinRM with HTTP/2 enabled and exposed to the internet (or even to untrusted internal network segments) is vulnerable.

The exploitation in the wild here is particularly concerning for critical infrastructure operators and managed service providers, where server availability is contractually guaranteed. A targeted DoS campaign using this CVE could invalidate SLA commitments, trigger incident response obligations, and disrupt downstream services simultaneously.

CVE-2026-45586 — Windows CTFMON Elevation of Privilege

The Collaborative Translation Framework Monitor (CTFMON) is a background Windows service that handles text input for Office applications and the Windows shell. This Elevation of Privilege vulnerability allows a locally authenticated attacker to escalate from a standard user account to SYSTEM privileges. While local access is required — limiting remote exploitation — this class of vulnerability is the classic second stage in a multi-step attack chain: an adversary delivers an initial foothold via phishing, then uses an EoP bug to gain SYSTEM and move laterally.

Security researchers tracking active exploitation emphasize that CTFMON EoP bugs are high-value commodities for ransomware operators, who routinely chain initial access with privilege escalation before deploying encryption payloads. This zero-day should be patched on all endpoint and workstation classes immediately, even before servers.

Critical RCE Priorities Beyond the Zero-Days

While the three zero-days demand the first wave of patches, several non-zero-day RCE vulnerabilities in this release carry equal or greater architectural risk.

Remote Desktop Client — 11 CVEs including CVE-2026-44801 and CVE-2026-44799. Remote Desktop is deployed across virtually every enterprise Windows environment. Multiple RCE bugs in the client mean a malicious RDP server (or a legitimate server that has been compromised) can execute arbitrary code on the connecting client — reversing the usual attack direction. This is a high-priority patch for any organization where staff connect to external RDP endpoints or use third-party RDP infrastructure.

Hyper-V — VM Escape Vulnerabilities (CVE-2026-47652, CVE-2026-45641, CVE-2026-45607). Virtual machine escapes are among the most severe infrastructure vulnerabilities possible — they break the core security boundary of multi-tenant virtualization. A compromised guest VM could leverage these flaws to reach the host hypervisor, then pivot to sibling VMs or the underlying hardware. Cloud and datacenter operators running Microsoft Hyper-V must treat these as P0 patches, ahead of any endpoint cycles.

Active Directory Domain Services — CVE-2026-45648. An RCE vulnerability in Active Directory means an attacker could target domain controllers directly, potentially compromising the entire identity fabric of an organization in a single exploit. AD RCE bugs are the holy grail for ransomware operators and nation-state actors alike — this patch should be scheduled for the next available maintenance window.

Azure Kubernetes Service — CVE-2026-32193. Cloud-native workloads running on AKS are also in scope, widening the attack surface beyond on-premises Windows environments to cloud-hosted containerized applications. Microsoft is patching the underlying infrastructure, but organizations should verify their AKS node pools are updated.

Microsoft Office (Outlook/Word) — CVE-2026-45458, CVE-2026-45456. Document-based RCE via Outlook and Word remains the most reliable phishing vector in the enterprise threat landscape. These critical document-based exploits mean that a malicious attachment opened in an unpatched Office installation can deliver full code execution — no macros required in some configurations.

The Help Net Security June 2026 Patch Tuesday forecast also highlighted CVE-2026-42897, an Exchange Server Cross-Site Scripting vulnerability in Outlook Web Access with a CVSS score of 8.1 that was already being actively exploited before the patch dropped, underscoring the urgency of Exchange updates this cycle.

What Enterprise Security Teams Should Do Now

Given the scale and severity of June 2026’s Patch Tuesday, a standard monthly patching cadence is not sufficient. The presence of three zero-days in active exploitation means threat actors are already using these techniques — organizations are patching reactively, not proactively.

1. Emergency-Patch Endpoints for BitLocker and CTFMON Zero-Days Within 48 Hours

Both CVE-2026-50507 (BitLocker bypass) and CVE-2026-45586 (CTFMON EoP) require local access — but that access is already present in your environment for attackers who have achieved initial access via phishing or malicious USB. Deploy endpoint patches through your MDM/SCCM infrastructure on an out-of-cycle emergency basis. Do not wait for the next scheduled patch window. For organizations with large managed device fleets, prioritize laptops used by executives, finance staff, and privileged accounts first — these are the highest-value targets for device-theft and insider-threat scenarios.

2. Disable HTTP/2 on Exposed Servers as an Interim Mitigation for CVE-2026-49160

For internet-facing IIS and WinRM servers where immediate patching creates availability risk (e.g., during business hours or critical operations windows), security teams should disable HTTP/2 as an interim mitigation while scheduling an emergency patch deployment. This is a validated Microsoft-recommended workaround for HTTP.sys DoS vulnerabilities when kernel-mode patching cannot be immediate. The command is: netsh http add iplisten ipaddress=:: listenbacklog=0 combined with HTTP/2 registry key disablement. Once the patch is applied, re-enable HTTP/2 per your server configuration baseline.

3. Fast-Track Hyper-V and AD Patches Through Your Change Management Process

VM escape vulnerabilities (CVE-2026-47652 cluster) and Active Directory RCE (CVE-2026-45648) represent existential risks to your infrastructure — an exploited AD controller or hypervisor host is a full organizational compromise. Invoke your emergency change management process to fast-track these patches outside the standard monthly maintenance window. Most enterprise change advisory boards have provisions for security-critical emergency changes; use them. For Hyper-V hosts running production workloads, coordinate with your virtualization team to live-migrate VMs during patching to minimize downtime.

4. Audit Remote Desktop Exposure and Apply RDP Client Patches Immediately

The 11 Remote Desktop Client CVEs this month expose a critical gap: organizations assume RDP vulnerabilities only matter for inbound connections (servers), but client-side RCE means outbound RDP connections are weaponizable too. Audit all endpoints from which staff connect to RDP servers — including jump boxes, bastion hosts, and developer workstations accessing cloud VMs. Patch the RDP client on all these endpoints. Additionally, review whether any external RDP servers your staff connect to could have been compromised — a malicious RDP server is now a valid initial access vector.

5. Update Office Suite and Review Attachment-Handling Policies

With critical RCE in Outlook and Word (CVE-2026-45458, CVE-2026-45456), verify that Office updates are deployed across all workstations. Additionally, review email gateway policies for automatic attachment quarantine — while patches are the permanent fix, an aggressive attachment sandbox policy adds defense-in-depth for the period between patch release and full enterprise deployment.

The Bigger Picture: Patch Velocity in 2026

The 198-CVE June 2026 release is not an anomaly — it reflects a structural shift in the vulnerability disclosure landscape. Microsoft’s products have an enormous attack surface: Windows runs on over 1.4 billion devices globally, Office is deployed in virtually every enterprise, and Azure hosts critical workloads across every industry vertical. As security researchers, threat intelligence teams, and AI-assisted vulnerability discovery tools all scale up, the rate at which new CVEs are found and responsibly disclosed to Microsoft has accelerated sharply through 2025 and 2026.

For enterprise security teams, this trend has a practical implication: the traditional “patch in 30 days” SLA, once considered aggressive, is now dangerously slow. Three zero-days being actively exploited on Patch Tuesday itself means attackers are weaponizing vulnerabilities faster than monthly patch cycles can respond. The security industry is converging on a new operating model — continuous patching with risk-tiered prioritization — where critical and actively-exploited CVEs are treated like security incidents (respond within 24-48 hours) rather than like scheduled maintenance (respond within 30 days).

Organizations that modernize their patching infrastructure — investing in automated patch deployment, comprehensive asset inventory, and vulnerability-to-patch time telemetry — will structurally reduce their exposure window as CVE volumes continue to climb. Those still relying on manual patching spreadsheets and quarterly maintenance windows face an increasingly hostile threat landscape that is evolving faster than their remediation cadence.

Frequently Asked Questions

Sources & Further Reading

• Further Reading
• Microsoft June 2026 Patch Tuesday: 198 Vulnerabilities Including 3 Actively Exploited Zero-Days — Cybersecurity News
• June 2026 Patch Tuesday Forecast — Help Net Security
• Microsoft Security Response Center — June 2026 Update Guide
• Security Week — Microsoft Vulnerability Coverage