Microsoft Releases Record
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-41091 | Link-Following Local Privilege Escalation in Microsoft Defender (Actively Exploited) Microsoft Defender, through its Microsoft Malware Protection Engine component, contains an improper link-resolution ('link following', CWE-59) flaw in which the engine fails to properly resolve a link, such as a shortcut or symbolic link, before accessing the file it points to. An authorized attacker who already holds limited local privileges can plant or manipulate such a link so that Defender, operating in its privileged context, follows it and performs file operations on the attacker's behalf, elevating the attacker to SYSTEM privileges on the local machine with no user interaction (CVSS 7.8: AV:L/PR:L/UI:N with high C/I/A). Any Windows system running Microsoft Defender is in scope, with version ranges not specified in the available data; because Defender is the built-in default antivirus on Windows 10/11 and is widely deployed on Windows Server, exposure effectively spans the entire Windows installed base. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2026-05-20, and press reports describe a 'RoguePlanet' Defender zero-day granting SYSTEM access even on fully patched Windows, amid Microsoft's record-setting 206-CVE Patch Tuesday that coverage flagged as including one bug under active attack. A public proof-of-concept is available on GitHub, EPSS assigns an 8.2% probability of exploitation within 30 days (95th percentile), and ransomware use is not yet confirmed. Do: Apply Microsoft's current security updates — including the record June 2026 Patch Tuesday release (206 vulnerabilities) — across all Windows clients and servers, and verify the Microsoft Defender / Malware Protection Engine update actually installed rather than definitions only. Because the flaw gives a low-privileged local user SYSTEM access and is actively exploited with a public PoC available, prioritize endpoints where untrusted or low-privileged users log on locally (workstations, VDI, multi-user servers), and organizations subject to CISA BOD 22-01 must apply the required mitigations per vendor instructions or discontinue use per the KEV requirement. On hosts not yet patched, hunt for signs of local privilege escalation involving Defender, and note that ransomware use has not yet… | 7.8 | 8% | KEV PoC |
| mass≈1 billion+ Windows devices (Defender is the default, enabled-by-default antivirus on Windows 10/11) | |
| CVE-2026-47291 | Unauthenticated RCE via Integer Overflow in Windows HTTP.sys CVE-2026-47291 is an integer overflow/wraparound flaw (CWE-190, leading to buffer overflow CWE-122) in HTTP.sys, the kernel-mode HTTP listener built into Windows. An unauthenticated attacker can trigger it by sending specially crafted network requests to any service that exposes an HTTP.sys endpoint, such as IIS-hosted websites or applications built on the Windows HTTP Server API/HttpListener. Successful exploitation grants remote code execution on the target host with no user interaction or privileges required. All listed Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2012, 2016, 2019, 2022) releases are affected. The flaw is not yet in CISA KEV and no public PoC exists, but its EPSS of 22.8% (98th percentile) indicates an elevated likelihood of exploitation within the next 30 days; patches shipped in Microsoft's June 2026 Patch Tuesday release (206 fixes total). Do: Apply the June 2026 Microsoft security updates for every affected Windows release, prioritizing internet-facing servers running IIS or other HTTP.sys-based services. As an interim mitigation, restrict untrusted network access to ports served by HTTP.sys. Identify hosts with active HTTP.sys listeners (e.g., via 'netsh http show servicestate' or reviewing web-server exposure) and monitor for a public PoC or CISA KEV addition given the elevated EPSS. | 9.8 group max | 23% |
| masshundreds of millions of Windows installations ship the affected driver; millions of internet-exposed IIS/HTTP.sys listeners are the primary attack surface | ||
| CVE-2026-45585 | Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable. NVD description · AI analysis pending | 6.8 | 1% | PoC |
| — | |
| CVE-2026-45657 | Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network. Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.8 | 15% |
| — |
Full article690 words · extracted from securityaffairs.com · click to collapse
Microsoft Patch Tuesday security updates for June 2026 fix a record 208 CVEs, including one actively exploited zero-day and multiple critical RCE flaws.
Microsoft Patch Tuesday security updates for June 2026 mark a record. Microsoft shipped fixes for 208 CVEs across Windows, Office, Azure, Exchange, Hyper-V, Secure Boot, BitLocker, and a range of AI tooling. Add in Chromium and third-party components bundled in Microsoft products and the total lands at 571 CVEs for the month.
“I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time.” reads the report published by ZDI. “The previous record was 177 set last year.”
To put that in context, the total CVE count Microsoft has shipped in 2026 so far already exceeds everything shipped in all of 2018.
One bug, tracked as CVE-2026-41091, is confirmed under active exploitation. Three others were publicly known before today’s patches dropped. All four should be at the top of your list.
Below are the descriptions of some of the most interesting issues addressed with Microsoft Patch Tuesday security updates for June 2026.
CVE-2026-41091 (CVSS score of 7.8) – Microsoft Defender Elevation of Privilege Vulnerability. Multiple researchers were credited for this one, which typically signals active exploitation from more than one source. The practical upside: Defender updates itself, so most users don’t need to do anything manually. If you’ve disabled automatic updates or run in an isolated environment, push the latest version now.
CVE-2026-45657 (CVSS score of 9.8) – Windows Kernel Remote Code Execution Vulnerability. A remote, unauthenticated attacker can run code at SYSTEM level with no user interaction, through a flaw in how the kernel handles TCP/IP. That’s wormable. Microsoft called it “Exploitation Less Likely,” but every security researcher with a disassembler is reversing this patch right now. Test fast, deploy faster.
CVE-2026-47291 (CVSS score of 9.8) – HTTP.sys Remote Code Execution Vulnerability. Another critical issue, same profile: remote, unauthenticated, no user interaction required. There’s one important nuance: systems using the default MaxRequestBytes registry value are not affected. Microsoft has marked this “Exploitation More Likely,” so check your registry settings today. The bulletin includes both manual instructions and a PowerShell script to apply the mitigation while you prepare the patch.
CVE-2026-44815 (CVSS score of 9.8) – DHCP Client Service Remote Code Execution Vulnerability. the write-up contradicts itself: the score says no authentication required, the text says “authenticated user.” When the documentation conflicts, trust the CVSS. If that’s right, a remote unauthenticated attacker can execute code with no user interaction. The DHCP client runs on every Windows installation, which makes this a high-value target. Prioritize testing and deployment.
Three publicly known bugs round out the priority list. CVE-2026-49160 is an HTTP.sys denial-of-service tied to the HTTP/2 Bomb technique. CVE-2026-45586 is a privilege escalation in the Windows Collaborative Translation Framework that can reach SYSTEM. CVE-2026-50507 is a BitLocker bypass requiring physical access, and if you’ve followed the ongoing conflict between researcher Nightmare Eclipse and Microsoft’s security response team, it’s a fix for “YellowKey.” A companion patch, CVE-2026-45585, appears to cover “GreenPlasma.” The researcher has threatened a “bone shattering” new exploit drop on June 14.
Ten Secure Boot patches this month carry what CVSS calls “scope change,” meaning exploitation pushes past the vulnerable component into boot integrity, Virtual Secure Mode, and pre-OS execution. The bulk are credited to Alon Leviev, whose BootKitty and BlackLotus-adjacent research is well known. Two UEFI Secure Boot bugs go deeper still: local admin or physical access is required, but success means running untrusted code before the OS loads. Rootkit territory.
The volume of this release raises a question ZDI’s Dustin Childs asks directly: “Is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates?”
Microsoft isn’t answering. July 14 is next, and it typically arrives heavy ahead of Black Hat and DEF CON. Plan accordingly.
The full list of CVEs addressed by Microsoft is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Microsoft Patch Tuesday)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/193417/security/microsoft-releases-record-breaking-patch-tuesday-with-208-cves.html