Cyber & Technology — 2026-06-10

Microsoft Ships Largest Patch Tuesday on Record With 206 Vulnerabilities Including Three Zero-Days Under Active Exploitation

BLUFActive exploitation of an Exchange OWA zero-day with no full patch available leaves email-facing organizations exposed, though attribution to a government or critical infrastructure breach within 45 days remains genuinely uncertain.

Microsoft's June 2026 Patch Tuesday addressed 206 vulnerabilities, which researchers characterize as the vendor's largest single-month patch release on record, with 39 rated Critical 12. BleepingComputer reports six zero-days were patched, one actively exploited: CVE-2026-42897, an Exchange Server spoofing flaw enabling arbitrary JavaScript execution via a crafted email opened in Outlook Web Access 3. Among the five publicly disclosed but not yet exploited zero-days are two BitLocker bypass flaws (YellowKey, bitskrieg) enabling physical-access attackers to read encrypted drives and a Windows CTFMON privilege escalation to SYSTEM (GreenPlasma) 3. CyberScoop additionally notes a max-severity Azure HorizonDB flaw, CVE-2026-48567, and a May 19 out-of-band patch for an actively exploited Defender zero-day, CVE-2026-41091 1.

Analysis
Attribution of CVE-2026-42897 to a government or critical infrastructure breach within 45 days is genuinely uncertain. Moderate confidence reflects confirmed active exploitation via a low-friction email-delivery vector, independently corroborated by four specialist outlets against MSRC guidance, offset by the spoofing flaw's materially lower exploitation-to-breach conversion rate versus ProxyLogon-class server-side RCEs. No full patch exists, leaving OWA-connected organizations exposed; broad automatic Emergency Mitigation Service deployment may already have narrowed the surface enough to push an attributable breach below that baseline. The documented BitLocker bypass techniques shift physical-access threat modeling for any endpoint relying on TPM-only encryption. AI-accelerated vulnerability discovery will continue compressing defender prioritization windows. On-premises Exchange operators must decide whether Emergency Mitigation Service coverage holds or unscheduled maintenance is warranted, a calculus that sharpens if exploitation reaches confirmed government infrastructure.
5 sources
  1. Microsoft breaks Patch Tuesday record with 206 vulnerabilities - CyberScoop
  2. Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs - The Hacker News
  3. Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws - BleepingComputer
  4. Microsoft Patches 200 Vulnerabilities - SecurityWeek
  5. June 2026 Security Update Guide Release Notes - Microsoft Security Response Center

View in full brief →

UNCLASSIFIED // OPEN SOURCE