Microsoft's Record-Breaking Patch Tuesday Brings 206 Vulnerabilities

Microsoft's June Patch Tuesday brought a massive release of 206 vulnerabilities, including 37 critical and three zero-days. This marks the largest volume since the program started in 2003.

The three zero-days were publicly disclosed before Microsoft had patches ready, giving attackers a head start. However, Microsoft's own exploitability index rated all three 'Exploitation More Likely,' but none showed evidence of in-the-wild attacks at the time of release.

The most severe vulnerability was CVE-2026-47291, a remote code execution flaw in HTTP.sys with a CVSS score of 9.8. This is higher than the three zero-day vulnerabilities that grabbed headlines.