Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs
Microsoft fixed 206 vulnerabilities, including three publicly disclosed zero-days and several remote code execution bugs. The update also adds a new setting to help limit HTTP/2 and HTTP/3 denial-of-service attacks.
Intelligence analysis by GPT-5.4 Mini
Microsoft's June 2026 Patch Tuesday is unusually large: 206 flaws across Windows and related products, with 39 rated Critical. The batch includes network-exploitable code-execution bugs, BitLocker bypass issues, and fixes tied to publicly disclosed zero-days.
Microsoft found a huge pile of holes in its software and patched them. Some of the holes could let a stranger sneak in over the internet, like finding a weak door lock on a house.
Analysis
What Microsoft fixed
Microsoft released fixes for a record 206 security vulnerabilities across its software portfolio. Of those, 39 are rated Critical and 167 Important. The breakdown includes privilege escalation, remote code execution, information disclosure, spoofing, security feature bypass, denial-of-service, and tampering bugs.
The most severe issue highlighted in the article is CVE-2026-45657, a Windows Kernel use-after-free flaw with a CVSS score of 9.8. Microsoft says an attacker could trigger it with specially crafted network traffic, potentially leading to code execution with system-level privileges and no user interaction.
Network-facing risks
Two other high-severity bugs stand out. CVE-2026-47291 affects Windows HTTP.sys and can let an unauthorized attacker execute code over the network. CVE-2026-44815 affects Windows DHCP Client and is described as a stack-based buffer overflow that also allows remote code execution. Security researcher Alex Vovk said the DHCP issue needs no credentials or user action and can turn network traffic into full system compromise.
Microsoft also addressed CVE-2026-49160, a Windows HTTP.sys denial-of-service issue tied to HTTP/2 and HTTP/3 header handling. The company introduced a new MaxHeadersCount registry setting to cap header counts and reduce memory and CPU exhaustion risk.
Zero-days and bypasses
The update includes fixes for publicly disclosed zero-days, including CVE-2026-45586, a Windows Collaborative Translation Framework privilege-escalation bug, and CVE-2026-49160. Microsoft also patched CVE-2026-45585, a BitLocker bypass for which a proof-of-concept exploit called YellowKey was released, plus other secure-feature bypasses. Another BitLocker-related issue, CVE-2026-50507, is described by researcher Will Dormann as a fix for a bypass dubbed bitskrieg that can expose encrypted data.
The article also notes that Microsoft recommends the June 2026 updates to fully address an older issue, CVE-2020-17103, after a related vulnerability referred to as MiniPlasma was disclosed.
Bigger picture
The article frames the rising patch volume as partly driven by AI-assisted vulnerability discovery. That means defenders should expect large Patch Tuesday releases to remain common, not unusual.
Key points
- Microsoft fixed 206 vulnerabilities in one release, including 39 Critical issues.
- The update includes three publicly disclosed zero-days and several network-exploitable bugs.
- A Windows kernel flaw could allow remote code execution through crafted network traffic.
- Microsoft added a new `MaxHeadersCount` setting to help limit HTTP/2 and HTTP/3 denial-of-service attacks.
- The article says AI-assisted vulnerability discovery is helping drive the rising patch volume.
If administrators install the June 2026 updates quickly, the most dangerous network-exploitable bugs and the public zero-days will be closed. The new HTTP header limit could also help reduce certain denial-of-service attacks on servers using HTTP/2 and HTTP/3.
If patching is delayed, attackers could use the remote code execution and privilege-escalation bugs to break into systems or move deeper inside networks. The BitLocker bypasses also mean that devices with physical exposure could remain vulnerable to encrypted-data access until they are updated.
