Microsoft set a record with its June Patch Tuesday release, addressing 206 CVEs across its products and shipping fixes for them, with 38 deemed critical and the rest important. Three are listed as publicly known, but none (so far) have been exploited in the wild.<\/p>\n
We have no idea how many of these June bugs<\/a> were uncovered using AI tools. Unlike last month\u2019s patching event, when Redmond disclosed<\/a> its agentic bug-hunting system found 16 of the 137 vulnerabilities, there\u2019s no word on any AI assists for new releases.\u00a0<\/p>\n Still, it\u2019s safe to assume AI played a major role. As Tom Gallagher, VP of engineering at Microsoft Security Response Center, said about May’s Patch Tuesday with a whopping 30 critical flaws: \u201cWe expect releases to continue trending larger for some time.\u201d<\/p>\n June\u2019s Patch Tuesday proved Gallagher correct, surpassing May in both overall volume and critical bugs.<\/p>\n \u201cI\u2019ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time,\u201d Zero Day Initiative\u2019s bug hunter in chief Dustin Childs said<\/a> in his review.\u00a0<\/p>\n \u201cIt is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns,\u201d he added, asking, as we did: How many were found via AI?<\/p>\n And: \u201cHow many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal?\u201d<\/p>\n Childs noted that May and April<\/a> also saw mega releases. <\/p>\n \u201cShould sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now,\u201d he wrote, adding in this fun fact: \u201cThe current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.\u201d<\/p>\n Wowza.\u00a0<\/p>\n While it\u2019s fun to watch from a purely speculative standpoint, as in: “Will Microsoft top 300 next month?”, our thoughts and prayers are nonetheless with sysadmins and vulnerability management teams drowning in the AI-induced vulnpocalypse by now.\u00a0<\/p>\n None of the Patch Tuesday security holes are listed as under attack \u2013 at least not yet\u00a0\u2013 but three are listed as publicly known. Let\u2019s take a look at those first.<\/p>\n Three known vulnerabilities<\/p>\n CVE-2026-49160<\/a> is an HTTP.sys denial of service vulnerability that we wrote about earlier<\/a> this month. Calif researcher Quang Luong discovered the attack with an assist from OpenAI’s Codex agent, named it HTTP\/2 Bomb, and said it exploits the HTTP\/2 header compression algorithm by sending thousands of tiny messages to the server, forcing it to rapidly allocate memory and ultimately crash.<\/p>\n At the time, a Microsoft spokesperson told The Register that Redmond was \u201caware and actively investigating appropriate mitigations.\u201d On Tuesday, the tech giant fixed the security issue by introducing a new MaxHeadersCount registry setting, which allows users to limit the number of headers included in HTTP\/2 and HTTP\/3 requests, and should prevent denial-of-service attacks.<\/p>\n CVE-2026-50507<\/a>, a security feature bypass bug in Windows BitLocker, is the second CVE listed as publicly disclosed, and \u201cexploitation more likely.\u201d An attacker with physical access to the vulnerable system could bypass the BitLocker Device Encryption feature and gain access to the device’s encrypted data, according to the advisory.<\/p>\n This flaw also seems to be a patch for one of the zero-days dropped<\/a> in the ongoing war<\/a> between Microsoft and a disgruntled bug hunter<\/a> known as Nightmare Eclipse – likely the YellowKey vulnerability<\/a> disclosed in May. Nightmare has published details about and in some cases, full proof-of-concept exploit code for six zero-days, and promised a \u201cbone shattering\u201d release on June 14.<\/p>\n The third publicly known bug, CVE-2026-45586<\/a>, is a Windows Collaborative Translation Framework (CTFMON) elevation of privilege vulnerability that can be abused by an authorized attacker to elevate privileges locally and gain SYSTEM access. From there, miscreants could deploy malware, steal data, and move laterally through the victim’s environment – so patch this one sooner.<\/p>\n Plus these two (of 38) critical bugs<\/p>\n In addition to those three known vulnerabilities that made the rounds before Microsoft issued a patch, a couple of critical-rated 9.8 security flaws are worth highlighting this month.<\/p>\n