Microsoft Patch Tuesday Breaks Records, and Probably Some Weekend Plans

Microsoft’s June 2026 Patch Tuesday fixed a record 206 vulnerabilities, including 39 critical issues and three publicly disclosed zero-days. The updates cover privilege escalation, remote code execution, information disclosure, spoofing, security bypass and denial-of-service flaws. Major issues include a Windows Kernel remote code execution vulnerability, HTTP.sys RCE, Windows DHCP Client RCE and several BitLocker bypass problems. Microsoft also addressed public exploit research affecting Windows components. The unusually large patch volume reflects the growing effect of AI-assisted vulnerability discovery.

Microsoft’s June Patch Tuesday landed with all the subtlety of a dropped server rack: 206 vulnerabilities fixed in one go.
Of those, 39 were rated critical, with issues covering remote code execution, privilege escalation, spoofing, information disclosure and security feature bypass. In short, there was something for everyone, assuming “everyone” includes attackers, sysadmins and people who enjoy emergency change windows.

Some of the more serious flaws affected the Windows Kernel, HTTP.sys and Windows DHCP Client. These are not obscure bits of software hiding under the stairs. They are core Windows components, which means patching priority should be high, especially for internet-facing services and infrastructure handling network traffic.

There were also several BitLocker bypass issues, including publicly disclosed vulnerabilities that could expose encrypted data under certain conditions. Microsoft also addressed issues linked to public research and proof-of-concept releases.

The sheer size of this patch batch is notable. Security researchers suggest AI-assisted vulnerability discovery is helping uncover more flaws faster. That is useful for defenders, but it also means patch management teams may need stronger coffee and better prioritisation.

The practical advice is simple: patch critical systems first, prioritise exposed services, review known exploited or public disclosure status, and do not assume monthly patching is a “routine admin task”. This month, it is risk reduction with a progress bar.