Microsoft's Biggest Patch Tuesday Ever: 198 CVEs, Three Zero-Days, One Actively Exploited Defender Flaw

Microsoft’s June 2026 Patch Tuesday, released June 9, fixes 198 vulnerabilities — the largest single release in Patch Tuesday history, beating October 2025’s record of 167. The batch includes 32 Critical and 166 Important fixes, three zero-days, and one flaw already being exploited in the wild.

Patch the exploited one first. CVE-2026-41091, dubbed RedSun, is an elevation-of-privilege vulnerability in Microsoft Defender (CVSS 7.8) confirmed exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog. An attacker with local access can abuse the endpoint security agent itself to gain SYSTEM privileges — the security tool becomes the privilege-escalation path. Federal agencies are on a remediation clock; everyone else should treat it the same way.

Two more zero-days were publicly disclosed before patches existed. CVE-2026-50507 (“Bitskrieg,” CVSS 6.8) lets an attacker with physical access bypass BitLocker Device Encryption — relevant for anyone whose threat model includes stolen laptops. CVE-2026-49160 (“HTTP/2 Bomb,” CVSS 7.5) is a denial-of-service flaw in HTTP.sys affecting HTTP/2, rated “Exploitation More Likely.” The third zero-day, CVE-2026-45586 in CTFMON, hands SYSTEM privileges to a local attacker (CVSS 7.8).

The headline severity sits in three unauthenticated remote-code-execution bugs, all CVSS 9.8 and wormable in the right conditions:

CVE-2026-45657 — Windows Kernel RCE affecting supported Windows 11 and Windows Server releases
CVE-2026-47291 — HTTP.sys RCE; remote, unauthenticated, no user interaction
CVE-2026-44815 — DHCP Client Service RCE; an attacker on the local network can execute code via crafted DHCP responses

HTTP.sys deserves special attention this month: it underpins IIS and any Windows service using the HTTP Server API, and it caught both an RCE and a DoS. If you run Windows-based web servers exposed to the internet, that pair is your second priority after Defender.

The breakdown skews toward privilege escalation (31.8% of fixes) and RCE (27.3%), spread across more than 80 products including Windows, Office, Exchange Server, Teams, Remote Desktop Client, Azure services, and Hyper-V.

Action items: run Windows Update or deploy the June cumulative updates now, prioritizing CVE-2026-41091 on every endpoint running Defender, then internet-facing HTTP.sys systems, then domain-joined machines for the DHCP and kernel RCEs. Tenable’s guidance is blunt: patch as soon as possible and scan for stragglers. With 198 CVEs landing at once, attackers get an unusually rich diff to reverse-engineer — the gap between patch release and weaponized exploit keeps shrinking, and a record-size release shrinks it further.

Sources

Related reading