Microsoft Patches 198 Vulnerabilities in June 2026 Security Update

Microsoft has released its June 2026 Patch Tuesday security update, addressing 198 vulnerabilities across its product ecosystem, one of the largest single-month patches in recent memory.

The update includes fixes for 3 zero-day vulnerabilities that were publicly disclosed before patching, along with 32 Critical-severity flaws and 166 Important-severity issues requiring immediate attention from administrators and end users.

Microsoft Patch Tuesday June 2026

Three publicly disclosed zero-days headline this month’s release, all rated Important in severity:

• CVE-2026-50507 – Windows BitLocker Security Feature Bypass Vulnerability: A publicly disclosed flaw in Windows BitLocker that allows an attacker to bypass the drive encryption security feature. This is particularly concerning for organizations relying on BitLocker for data-at-rest protection on endpoint devices.
• CVE-2026-49160 – HTTP.sys Denial of Service Vulnerability: A publicly disclosed vulnerability in the HTTP/2 stack (HTTP.sys) that could allow an unauthenticated attacker to crash or destabilize Windows web servers. Organizations running IIS or any HTTP.sys-dependent services should treat this patch as high-priority.
• CVE-2026-45586 – (Zero-day #3): This vulnerability rounds out the trio of zero-days addressed in this month’s update and requires immediate customer action per Microsoft’s advisory.

Among the 32 Critical-rated vulnerabilities, Remote Code Execution (RCE) flaws dominate with 54 RCE issues total across all severities.

CVE-2026-47652 – Windows Hyper-V RCE is a critical flaw enabling remote code execution within Hyper-V hypervisor environments, posing severe risk to virtualized infrastructure.

CVE-2026-47288 – Windows Kerberos KDC RCE targets the Kerberos Key Distribution Center and could allow attackers to execute code against domain authentication infrastructure a worst-case scenario for Active Directory environments.

CVE-2026-47291 – HTTP.sys RCE represents a separate critical RCE in Windows HTTP.sys, distinct from the zero-day DoS variant, enabling potential pre-authentication remote code execution on exposed servers. 

CVE-2026-45648 – Active Directory Domain Services RCE is a critical flaw that could allow attackers to execute code on domain controllers, making it a top-priority patch for all enterprise environments.

Beyond the Windows core, this update spans a wide range of Microsoft products. SharePoint Server received patches for at least 10 spoofing vulnerabilities across CVE-2026-47636 through CVE-2026-48562. 

Remote Desktop Client was patched for multiple Critical and Important RCE flaws, including CVE-2026-44799, CVE-2026-44801, CVE-2026-42985, CVE-2026-42992, and CVE-2026-47654. 

Windows Secure Boot received a cluster of Security Feature Bypass fixes, and Visual Studio Code was addressed for elevation-of-privilege, information-disclosure, and tampering vulnerabilities.

Here is the complete table of all 198 CVEs from the June 2026 Patch

Organizations should apply the June 2026 cumulative updates as soon as possible. The combination of publicly disclosed zero-days and a high volume of Critical RCE vulnerabilities makes this Patch Tuesday one of the most consequential of the year.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.