Microsoft Releases Record-Breaking Patch Tuesday With 208 CVEs


Microsoft Releases Record-Breaking Patch Tuesday With 208 CVEs

Pierluigi Paganini
June 09, 2026

Microsoft Patch Tuesday security updates for June 2026 fixes a record 208 CVEs, including one actively exploited zero-day and multiple critical RCE flaws.

Microsoft Patch Tuesday security updates for June 2026 mark a record. Microsoft shipped fixes for 208 CVEs across Windows, Office, Azure, Exchange, Hyper-V, Secure Boot, BitLocker, and a range of AI tooling. Add in Chromium and third-party components bundled in Microsoft products and the total lands at 571 CVEs for the month.

“I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time.” reads the report published by ZDI. “The previous record was 177 set last year.”

To put that in context, the total CVE count Microsoft has shipped in 2026 so far already exceeds everything shipped in all of 2018.

One bug, tracked as CVE-2026-41091, is confirmed under active exploitation. Three others were publicly known before today’s patches dropped. All four should be at the top of your list.

Below are the descriptions of some of the most interesting issues addressed with Microsoft Patch Tuesday security updates for June 2026.

CVE-2026-41091 (CVSS score of 7.8) – Microsoft Defender Elevation of Privilege Vulnerability. Multiple researchers were credited for this one, which typically signals active exploitation from more than one source. The practical upside: Defender updates itself, so most users don’t need to do anything manually. If you’ve disabled automatic updates or run in an isolated environment, push the latest version now.

CVE-2026-45657 (CVSS score of 9.8) – Windows Kernel Remote Code Execution Vulnerability. A remote, unauthenticated attacker can run code at SYSTEM level with no user interaction, through a flaw in how the kernel handles TCP/IP. That’s wormable. Microsoft called it “Exploitation Less Likely,” but every security researcher with a disassembler is reversing this patch right now. Test fast, deploy faster.

CVE-2026-47291 (CVSS score of 9.8) – HTTP.sys Remote Code Execution Vulnerability. Another critical issue, same profile: remote, unauthenticated, no user interaction required. There’s one important nuance: systems using the default MaxRequestBytes registry value are not affected. Microsoft has marked this “Exploitation More Likely,” so check your registry settings today. The bulletin includes both manual instructions and a PowerShell script to apply the mitigation while you prepare the patch.

CVE-2026-44815 (CVSS score of 9.8) – DHCP Client Service Remote Code Execution Vulnerability. the write-up contradicts itself: the score says no authentication required, the text says “authenticated user.” When the documentation conflicts, trust the CVSS. If that’s right, a remote unauthenticated attacker can execute code with no user interaction. The DHCP client runs on every Windows installation, which makes this a high-value target. Prioritize testing and deployment.

Three publicly known bugs round out the priority list. CVE-2026-49160 is an HTTP.sys denial-of-service tied to the HTTP/2 Bomb technique. CVE-2026-45586 is a privilege escalation in the Windows Collaborative Translation Framework that can reach SYSTEM. CVE-2026-50507 is a BitLocker bypass requiring physical access, and if you’ve followed the ongoing conflict between researcher Nightmare Eclipse and Microsoft’s security response team, it’s a fix for “YellowKey.” A companion patch, CVE-2026-45585, appears to cover “GreenPlasma.” The researcher has threatened a “bone shattering” new exploit drop on June 14.

Ten Secure Boot patches this month carry what CVSS calls “scope change,” meaning exploitation pushes past the vulnerable component into boot integrity, Virtual Secure Mode, and pre-OS execution. The bulk are credited to Alon Leviev, whose BootKitty and BlackLotus-adjacent research is well known. Two UEFI Secure Boot bugs go deeper still: local admin or physical access is required, but success means running untrusted code before the OS loads. Rootkit territory.

The volume of this release raises a question ZDI’s Dustin Childs asks directly: “Is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates?”

Microsoft isn’t answering. July 14 is next, and it typically arrives heavy ahead of Black Hat and DEF CON. Plan accordingly.

The full list of CVEs addressed by Microsoft is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Patch Tuesday)







Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


macOS has a built-in screenshot tool that gets the basics right. You can take a screenshot, record your screen, and even annotate your captures. But the moment you want something more, like scrolling capture, advanced annotation tools, or a quick way to share your screenshots via a link, it starts to fall apart.

That’s where CleanShot X comes in. It’s a powerful screenshot and screen recording app for Mac that replaces the built-in screenshot tool. It feels as if the developers looked at the screenshot features in macOS and added everything that was missing.

Over the past few years, the app has added several new features I didn’t know I needed until it offered them. It has become one of my favorite Mac utilities, and in this article, I will show you its features that will convince you to buy the app instantly. 

Scrolling capture saves you from stitching screenshots together

One of the most frustrating limitations of macOS’s screenshot tool is that it can only capture what’s visible on your screen. If I need to capture a long webpage or a full chat history, I am stuck taking multiple screenshots and stitching them together. That wastes an unbelievable amount of time. 

CleanShot X solves this with its scrolling capture feature. I can trigger the scrolling capture, and CleanShot X automatically scrolls through the content and delivers a single image. I don’t even have to manually scroll the page if I don’t want to.

This feature alone saves me hours of time every month. If you have to deal with long screenshots, you should definitely try it out. 

Time delay capture lets you screenshot the impossible

Some screenshots are tricky to take because they require you to trigger something before capturing. For example, sometimes the on-screen feature you want to capture disappears as soon as you use a keyboard shortcut or click anywhere with your mouse. 

Sometimes, the on-screen elements appear for a short time, and by the time you hit the screenshot shortcut, they disappear. CleanShot X’s time delay capture gives me a few seconds to set things up before the screenshot is taken. I trigger the capture, put everything in place, and CleanShot X does the rest. 

It’s a small feature that solves a genuinely annoying problem.

Capture text from images with OCR

I love that CleanShot X has a built-in OCR function. It lets me capture text directly from any image or video on my screen. Although it happens rarely, I have come across websites that don’t let me copy content. With CleanShot X’s OCR function, that’s not an issue. 

I use this constantly when reviewing PDF documents with restricted permissions or watching a video on YouTube. It is far faster than typing things out manually, and it works surprisingly well. There are many apps that let you capture text with OCR, but since CleanShot X has this feature built in, I don’t need to install an extra app. 

Add beautiful backgrounds to your screenshots

If you share screenshots for work, tutorials, or social media, you know how plain a raw screenshot looks. CleanShot X lets me add beautiful backgrounds to my screenshots, turning a flat capture into something that looks polished and share-ready.

For backgrounds, I can choose from solid colors, gradients, or even my current desktop wallpaper. I can also adjust the padding and shadow, align the screenshot to the edges, and adjust the corner radius. It takes a few seconds and makes a huge difference in how professional your screenshots look.

Annotation tools that get the job done

While macOS’s screenshot tool lets you annotate your screenshots, the annotation tools inside CleanShot X are, in my opinion, the best available on the Mac. 

I can add arrows, text labels, shapes, highlights, and more. I can also change the weight and color of annotations. There are also multiple arrow styles I can choose from. I especially like the curved arrow style that lets me curve the arrows and make them pop. 

One of my favorite new additions is the “Highlighter” tool. It snaps to the text in a screenshot, which makes it really easy to highlight it before sharing. 

Then there’s the “Spotlight” tool that highlights your selection by darkening the rest of the screenshot. It’s perfect for drawing someone’s attention to a specific part of a screenshot. 

No matter what annotation tools you need, you can find them and more in CleanShot X. 

Hide sensitive information before you share

You can find hundreds of instances in the news where a prominent figure shared a screenshot and inadvertently revealed private information. Thankfully, CleanShot X has a dedicated tool to blur or black out sensitive information, so such accidents never happen.

I can choose to pixelate, blur, or completely black out the information. The best part is that I can also adjust the strength of these effects. It lets me blend in the hidden information so the blur doesn’t stand out from the rest of the screenshot. 

Video and GIF recording built right in

CleanShot X also lets you record your screen as a video or export directly as an optimized GIF. The GIF export is particularly useful for sharing quick demos or showing someone how to do something without creating a large video file. 

It can record the entire screen, a specific window, or a custom region. It can also show my mouse clicks and keyboard shortcuts. I can record my computer audio, my microphone, and webcam video. 

I love that it automatically adds the webcam video in the corner, so it doesn’t interfere with the rest of the recording. I can also change the video size and shape. All these features make it really easy to create video tutorials. 

Quick share with cloud links

Once you take a screenshot or finish a recording, you need to share it. Of course, you can easily share screenshots via messages or emails. But CleanShot X gives me a better way. 

Whenever I capture something, it opens a quick share overlay. I can use it to instantly upload my screenshots to CleanShot Cloud and grab a shareable link with a single click.

I no longer have to drag files into cloud storage, attach images to emails, or upload to third-party services. I capture it, click share, and paste the link. It is one of those workflow improvements that sounds minor until you use it every single day.

Capture beautiful screenshots with CleanShot X

CleanShot X has become one of my most dependable apps on Mac. In fact, all the screenshots you see in this article or any of my articles have been captured using CleanShot X. Yes, it’s a paid app, but it has paid its cost multiple times over with the time it has saved me. 

CleanShot X is available as a one-time purchase or through a SetApp subscription. If you want unlimited cloud storage, you have to pay for a monthly subscription. That will also get you advanced features like a custom domain and branding, password-protected link sharing, and more. 

For most users, the one-time purchase is more than enough, and it’s what I use. If you spend any time taking screenshots or recording your screen on a Mac, it is absolutely worth every penny.



Source link