A Record-Breaking Patch Tuesday for June 2026

Microsoft has released a record-breaking set of software updates for June 2026, addressing nearly 200 security vulnerabilities across its Windows operating systems and related software. This significant number of patches, with close to three dozen classified as critical, reflects an increasing trend in vulnerability discovery, potentially driven by the growing use of artificial intelligence tools by both Microsoft's engineers and the broader security community.

This surge in patches may become the new normal, according to Satnam Narang, senior staff research engineer at Tenable. He noted that with AI's increasing prevalence in bug hunting, the volume of monthly updates is expected to continue its upward trajectory.

Among the vulnerabilities patched are several zero-day flaws for which exploit code is publicly available. One such vulnerability, CVE-2026-49160, is a denial-of-service flaw affecting web servers, including Microsoft's Internet Information Services (IIS). Microsoft has acknowledged that this particular flaw was reported by OpenAI's Codex.

Two other zero-day vulnerabilities appear to be linked to recent disclosures by a security researcher known as Nightmare Eclipse. This researcher has been releasing exploits for various Windows flaws, including one called GreenPlasma, which targets an elevation of privilege vulnerability in the Windows Collaborative Translation Framework. Microsoft has patched this framework in CVE-2026-45586. Nightmare Eclipse also previously released an exploit named YellowKey, targeting a Windows BitLocker vulnerability that could allow an attacker with physical access to view encrypted data. CVE-2026-50507 addresses an elevation of privilege bug in BitLocker.

Microsoft faced public criticism on social media last month after initially suggesting it might take legal action against security researchers. The company later clarified its stance, stating that while it does not intend to pursue legal action against researchers, it would report those who break the law to authorities. The advisories for CVE-2026-49160 and CVE-2026-50507 do not name specific researchers, instead crediting the security community for coordinated vulnerability disclosures. Nightmare Eclipse has claimed to be a former Microsoft employee, a claim Microsoft has not publicly addressed.

Nightmare Eclipse has indicated plans to release more zero-day exploits for Windows on July 14, coinciding with the next Patch Tuesday. Immediately after Microsoft's June updates were released, the researcher claimed to have published an exploit for a zero-day vulnerability in Windows Defender.

Beyond the Patch Tuesday count, Adam Barnett of Rapid7 highlighted that Microsoft has addressed a substantially larger number of vulnerabilities this month, including 360 browser-related flaws. This significant increase in browser vulnerabilities has led Microsoft to stop enumerating Chromium CVEs in its Security Update Guide.

Microsoft also patched a zero-day vulnerability in Visual Studio Code that could allow attackers to steal GitHub tokens with a single click. A temporary fix was issued on June 3 after a researcher published exploitation details. The researcher reportedly chose not to collaborate with Microsoft due to a previous experience where a reported flaw was silently patched without acknowledgment.

Internally, Microsoft dealt with its own security issues last week, as at least 72 of its public code repositories were infected with a variant of the Shai-Hulud worm. These affected repositories were linked to the Microsoft official Azure Durable Task SDK, which had previously been compromised by the same worm in May.

Other major software vendors are also releasing substantial updates. Adobe has addressed numerous critical vulnerabilities across products like Adobe Experience Manager, Acrobat Reader, and Cold Fusion. Google, on June 3, resolved 429 vulnerabilities in its Chrome browser update. Users are advised to back up their data before applying operating system updates.