Loading story…
Microsoft released its largest Patch Tuesday update to date, fixing 206 vulnerabilities across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included three publicly disclosed zero-days, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw CVE-2026-41091. Publicly disclosed issues in the June bundle included CVE-2026-50507, a BitLocker security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and CVE-2026-45586, a Windows CTFMON elevation-of-privilege flaw that could let a low-privileged local attacker gain SYSTEM access. JPCERT/CC also warned that Microsoft disclosed active exploitation of CVE-2026-42897, a spoofing flaw in Microsoft Exchange Server.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
100 events from the most recent confirmed update back to the earliest known activity.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53209. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-9697. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53242. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52930. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53247. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53176. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53154. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53217. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52923. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52922. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53160. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52915. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52934. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53270. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52924. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-9675. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53133. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52943. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53230. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52947. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53186. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53266. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53177. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53143. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53239. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53148. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53228. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52916. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53213. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-52913. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53196. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53146. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53214. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53225. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-55200. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53254. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12442. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-11647. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12028. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-50521. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13035. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13031. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13026. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13038. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13036. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13029. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12087. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-4367. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-13027. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-53689. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-43973. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-9698. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12455. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12447. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12441. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12457. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12445. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12454. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12465. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12459. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12439. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12462. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12464. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12446. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12440. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12466. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12443. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-42895. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-47645. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-48582. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-32208. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-32174. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-48584. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-47646. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-42766. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-48856. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-48860. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-49759. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-7383. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-42767. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-34180. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-48858. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-9076. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-47647. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-54130. The CVE is not present in the existing timeline, making this a new disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12451. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12452. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12458. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-12453. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-48855. The CVE is not present in the existing timeline, making this a distinct disclosure event.
Microsoft published an MSRC vulnerability advisory for CVE-2026-50656. The existing timeline does not already include this CVE, making it a distinct disclosure event.
JPCERT/CC said Microsoft had disclosed active exploitation of CVE-2026-42897, a spoofing vulnerability in Microsoft Exchange Server, and noted the flaw had been publicly announced on May 14. The advisory urged users to apply Microsoft's June 2026 security updates.
New CVE entries were published for CVE-2026-45641 in Windows Hyper-V, CVE-2026-47298 in SharePoint Server, CVE-2026-45503 in Exchange Server, and CVE-2026-45602 in Windows DHCP Server. The entries described high-severity vulnerabilities and referenced Microsoft's Security Response Center guidance.
Microsoft released Windows 10 cumulative update KB5094127 for Enterprise LTSC and Extended Security Updates customers, advancing systems to build 19045.7417 and LTSC 2021 to 19044.7417. The update incorporated June 2026 Patch Tuesday fixes and added Secure Boot monitoring and File Explorer search improvements.
Microsoft released Windows 11 cumulative updates KB5094126 for versions 25H2/24H2 and KB5093998 for version 23H2 as part of Patch Tuesday. The mandatory updates included security fixes plus reliability and feature improvements, and Microsoft said it was not aware of new known issues.
Microsoft disclosed multiple Remote Desktop Client remote code execution vulnerabilities, including CVE-2026-42909, CVE-2026-42913, CVE-2026-42992, CVE-2026-47653, and CVE-2026-47654. The flaws generally required a victim to connect to an attacker-controlled RDP server, and Microsoft said fixes were available.
Microsoft disclosed CVE-2026-45586, an Important elevation-of-privilege flaw in the Windows Collaborative Translation Framework that could let a low-privileged local attacker gain SYSTEM privileges. Microsoft said the issue was publicly disclosed, not actively exploited, and fixed.
Microsoft disclosed CVE-2026-50507, an Important Windows BitLocker security feature bypass vulnerability requiring physical access. Microsoft said the flaw was publicly disclosed, proof-of-concept code was available, exploitation was considered more likely, and a fix was released.
Microsoft published its June 2026 Patch Tuesday advisories and updates, addressing a record 206 vulnerabilities across products and services. Multiple sources describe the release as Microsoft's largest monthly patch set on record.
Microsoft disclosed CVE-2026-48567, a critical Azure HorizonDB elevation-of-privilege vulnerability with a CVSS score of 10.0. Microsoft said the cloud service issue had already been fully mitigated and required no customer action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its June Patch Tuesday updates to address more than 200 vulnerabilities across Windows, .NET, Office, Teams, Exchange Server, Azure, Visual Studio Code, and other products, including three publicly disclosed zero-days: `CVE-2026-45586` in the Windows Collaborative Translation Framework (`CTFMON`), `CVE-2026-49160` in `HTTP.sys`, and `CVE-2026-50507` in Windows BitLocker. The update covered a broad range of impact types, including elevation of privilege, spoofing, denial of service, security feature bypass, information disclosure, and remote code execution, with notable high-severity issues such as `CVE-2026-44815`, a DHCP Client Service RCE flaw rated `CVSS 9.8`, and `CVE-2026-47281`, a Visual Studio Code elevation-of-privilege bug rated `CVSS 9.6`. Researchers described the release as part of a wider 2026 "patch tsunami," estimating roughly 198 to 208 Microsoft CVEs in the June cycle and about 571 CVEs overall when Chromium and other third-party issues were included, with 38 rated critical. One of the zero-days, `CVE-2026-49160`, was detailed as an `HTTP/2` and `HTTP/3` header compression flaw that can trigger resource exhaustion through a "compression bomb," and Microsoft added a `MaxHeadersCount` registry mitigation; the bug was reportedly credited to OpenAI Codex, underscoring claims that AI-assisted discovery is accelerating vulnerability reporting and increasing patch-management pressure on enterprises.
Jul 8, 2026
Microsoft released fixes for **163 vulnerabilities** in its April Patch Tuesday update, marking one of its largest security releases on record. The bundle includes **8 Critical** flaws, **154 Important** issues, and **1 Moderate** bug, with seven of the Critical vulnerabilities enabling remote code execution across products and components including **Windows TCP/IP**, **Windows IKE Service Extensions**, **Active Directory**, **Remote Desktop Client**, **Microsoft Office**, and **Microsoft Word**. Belgian authorities urged organizations to apply the updates immediately. The most urgent issues include **`CVE-2026-32201`**, an actively exploited **Microsoft SharePoint Server** vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalog, and **`CVE-2026-33825`** in **Microsoft Defender**, a publicly disclosed zero-day tied to proof-of-concept code associated with the **BlueHammer** exploit. Microsoft also shipped Windows 11 cumulative updates with security hardening changes, including safer handling of **`.rdp`** files and improved visibility into **Secure Boot** certificates, while the broader patch set addressed numerous elevation-of-privilege and security feature bypass flaws that could support post-compromise escalation.
Jun 29, 2026
Microsoft’s March 2026 Patch Tuesday shipped fixes for **79 vulnerabilities**, including **two zero-day flaws**. Public reporting and third-party patch reviews highlight a mix of *Important* and *Critical* issues across Microsoft’s ecosystem, including **.NET** (`CVE-2026-26127` DoS; `CVE-2026-26131` EoP), **Active Directory Domain Services** (`CVE-2026-25177` EoP), **ASP.NET Core** (`CVE-2026-26130` DoS), and multiple Azure components such as **ACI Confidential Containers** (`CVE-2026-23651`, `CVE-2026-26124` EoP; `CVE-2026-26122` information disclosure) and **Azure IoT Explorer** (`CVE-2026-26121` spoofing; `CVE-2026-23661/23662/23664` information disclosure). Independent analysis (ZDI and SANS ISC) corroborated the breadth of affected products and provided additional scoring/metadata, including CVSS ratings and exploitability flags. ZDI’s review also called out additional *Critical* items in the release such as **Microsoft Office RCE** (`CVE-2026-26110`, `CVE-2026-26113`) and other high-impact vulnerabilities, while SANS ISC’s Patch Tuesday coverage additionally noted bundled **Chromium**-tracked fixes (multiple `CVE-2026-3536` through `CVE-2026-3544` entries) that commonly map to Microsoft’s browser/embedded Chromium components. Organizations should prioritize patching systems exposed to untrusted content or authentication boundaries (e.g., Office, AD DS, Azure agents/extensions) and validate deployment coverage across both Windows and cloud-connected workloads.
Jun 29, 2026