Microsoft’s June Patch Tuesday Fixes 206 CVEs, Including Actively Exploited Defender Bug
Summary
Microsoft’s June Patch Tuesday listed 206 CVEs, with trackers counting up to 208. The release includes an actively exploited Defender flaw, a potentially wormable Windows vulnerability, and a BitLocker bypass.
Key points
- Microsoft listed 206 CVEs in its June release; ZDI counted 208 and Tenable 198. Both trackers called it Microsoft’s largest monthly release.
- CVE-2026-45657 is a severe, potentially wormable Windows flaw. ZDI said it could spread across networks, but it had not been observed in the wild.
- CVE-2026-41091 is an elevation-of-privilege flaw in Microsoft Defender that Microsoft said could let an attacker with an existing foothold gain full system control. CISA added it to its actively exploited vulnerabilities catalog.
- CVE-2026-50507 is a BitLocker bypass. The article links both it and the Defender flaw to researcher Nightmare Eclipse.
- Microsoft has said AI tools are driving increased vulnerability discovery and expects Patch Tuesday releases to continue growing.
Article Details
- Event Type
- Microsoft’s June Patch Tuesday security update and disclosure of vulnerabilities.
- Impact
- Microsoft released fixes for 206 CVEs. The release included CVE-2026-45657, a severe Windows flaw described by ZDI as wormable, though it had not been observed in the wild; CVE-2026-41091, a Microsoft Defender elevation-of-privilege flaw reported as actively exploited; and CVE-2026-50507, a BitLocker bypass. Microsoft said attackers could abuse the Defender flaw to write a malicious file to a protected location. ZDI counted 208 CVEs and Tenable counted 198, and both described the release as the largest monthly Microsoft release to date.
CVE
People
Nightmare EclipsePseudonymous researcher who posted working exploit code for unpatched Windows flaws and is linked in the article to CVE-2026-41091 and CVE-2026-50507. The researcher alleged Microsoft deleted their bug-reporting account, withheld bounty payments, and removed their name from an advisory; Microsoft denied the account-deletion claim.Tom GallagherMicrosoft Security Response Center vice president of engineering; said Microsoft expects Patch Tuesday releases to continue trending larger as AI tools drive vulnerability discovery.
Vendors
Products
BitLockerThe update includes a critical wormable Windows flaw, an actively exploited Microsoft Defender bug, and a BitLocker bypass tied to the researcher known as Nightmare Eclipse.Microsoft Defender Antimalware PlatformThe update includes a critical wormable Windows flaw, an actively exploited Microsoft Defender bug, and a BitLocker bypass tied to the researcher known as Nightmare Eclipse.Microsoft WindowsThe update includes a critical wormable Windows flaw, an actively exploited Microsoft Defender bug, and a BitLocker bypass tied to the researcher known as Nightmare Eclipse.