Microsoft Unleashes an Unprecedented Patch Flood in June 2026

Microsoft has rolled out an unprecedented wave of security updates this month, issuing fixes for nearly 200 vulnerabilities across Windows and its broader software ecosystem — the largest Patch Tuesday release in the company’s history. Roughly one-third of these flaws received Microsoft’s highest severity rating, and exploit code for at least three is already circulating publicly.

Security researchers say this surge may not be a one‑off event. Microsoft noted last month that both internal teams and outside analysts are increasingly using AI‑powered tools to uncover bugs. Satnam Narang, senior staff research engineer at Tenable, believes this shift is reshaping the scale of monthly patch cycles.

“AI adoption among security professionals is approaching 90%, so it’s no surprise that patch volumes are climbing,” Narang said. “Pandora’s box is open. As AI models grow more capable, we expect these numbers to keep rising — not just for Patch Tuesday, but across the entire vulnerability landscape.”

Zero‑Days in the Spotlight

June’s Patch Tuesday includes several zero‑day fixes, among them CVE‑2026‑49160, a denial‑of‑service flaw affecting multiple web servers, including Microsoft IIS. The issue was reported by OpenAI’s Codex system.

Two additional zero‑days appear connected to recent disclosures by a researcher operating under the alias Nightmare Eclipse, who has been releasing Windows exploits publicly. One of these, nicknamed “GreenPlasma,” abuses a privilege‑escalation flaw in the Windows Collaborative Translation Framework — the same component addressed in CVE‑2026‑45586.

Nightmare Eclipse also published “YellowKey,” an exploit targeting a BitLocker weakness that exposes encrypted data to attackers with physical access. Microsoft’s fix for that issue appears as CVE‑2026‑50507.

The company faced heavy criticism last month after suggesting it might pursue legal action against the researcher. Microsoft later clarified on X/Twitter that it does not intend to sue security researchers but may involve law enforcement if illegal activity occurs. Notably, the advisories for CVE‑2026‑49160 and CVE‑2026‑50507 omit researcher acknowledgments, instead offering a generic nod to the security community.

Nightmare Eclipse claims to be a former Microsoft employee — a claim the company has not addressed. Rapid7 observed that one of the researcher’s recent posts included an image of Albert Wesker from Resident Evil, a fictional scientist who turns against his employer.

The researcher has promised a “bone‑shattering” batch of additional Windows zero‑days on July 14, coinciding with next month’s Patch Tuesday. Within hours of today’s updates, they released yet another exploit, this time claiming a zero‑day in Windows Defender.

Browser Bugs and a Worm Outbreak

While the nearly 200 vulnerabilities patched today set a Patch Tuesday record, the total number of Microsoft flaws fixed this month is far higher. According to Rapid7’s Adam Barnett, Microsoft has already shipped patches for 360 browser vulnerabilities in June alone — an order of magnitude above typical monthly totals.

The spike has become so large that Microsoft has stopped listing individual Chromium CVEs in its Security Update Guide.

Microsoft also addressed a zero‑day in Visual Studio Code that allowed attackers to steal GitHub tokens with a single click. The company rushed out an emergency mitigation on June 3 after a researcher publicly demonstrated the exploit, saying they bypassed coordinated disclosure because Microsoft had previously patched one of their reports without credit.

Compounding the month’s challenges, Microsoft spent last week dealing with an internal outbreak of the Shai‑Hulud worm, which infected at least 72 public code repositories. Investigators linked all affected packages to the Azure Durable Task SDK — the same component hit by Shai‑Hulud in May.

Other Vendors Face Heavy Patch Loads Too

Microsoft isn’t alone in shipping massive updates this month. Adobe released fixes for a large collection of critical vulnerabilities across Experience Manager, Acrobat Reader, ColdFusion, and other products. Google, meanwhile, patched 429 vulnerabilities in its June Chrome update. Although Chrome updates install automatically, users must restart the browser for the fixes to take effect.

Remember

As always, it’s wise to back up important data before applying system updates. If you encounter issues with June’s patches, feel free to share your experience in the comments.

Further reading:

Microsoft’s Security Update Guide