June Patch Tuesday smashes past 500-CVE mark

You didn’t have any other work plans in June, did you? Microsoft on Tuesday released 209 patches affecting 24 product families. Thirty-eight of the addressed issues are considered by Microsoft to be of Critical severity, and 16 of those are expected to be exploited within the next 30 days. An additional CVE, related to the Chaotic Eclipse (aka Nightmare Eclipse) disclosures of the previous weeks, already is. Forty-two have a CVSS base score of 8.0 or higher. Four were publicly disclosed as of release day and just one is acknowledged to be under active exploit in the wild. The numbers in the previous sentence are somewhat confusing in light of (again) the Chaotic Eclipse affair, as we’ll discuss further below.

If the patch count sounds daunting, try the advisory count – 388 of them. As ever, the majority are Edge-related, assigned by Chrome, and patched days in advance of Patch Tuesday. Twenty-three, affecting Adobe Reader and ColdFusion, were issued by Adobe. Two more affect Windows but were issued by CNAs other than Microsoft (specifically, CERT/CC and Arm Limited). As always, we cover all advisories in Appendix D.

Various of this month’s issues are amenable to direct detection by Sophos protections, and we include information on those in the usual table below. These protections include a variety of items targeting the ongoing Chaotic Eclipse vulnerabilities – and, because that situation is volatile as of this writing, we caution that the list in that Sophos Protections section may not reflect all protections we are delivering to customers. 

We are as always including at the end of this post appendices listing all Microsoft’s patches sorted by severity (Appendix A), by predicted exploitability timeline and CVSS Base score (Appendix B), and by product family (Appendix C). Appendix D lists this month’s advisories. Appendix E provides a breakout of 114 CVEs affecting various versions of Windows Server, including one advisory from CERT/CC that is otherwise not counted in the patch totals for the month. Our analysis of CWE (Common Weakness Enumeration) information made available for this month’s patches appears in Appendix F.

By the numbers

• Total CVEs: 209
• Publicly disclosed: 4
• Exploit detected: 1
• Severity
  • Critical: 38
  • Important: 172
• Impact:
  • Denial of Service: 7
  • Elevation of Privilege: 68
  • Information Disclosure: 30
  • Remote Code Execution: 55
  • Spoofing: 27
  • Security Feature Bypass: 19
  • Tampering: 3
• CVSS base score 9.0 or greater: 10
• CVSS base score 8.0 or greater: 42

Figure 1: Amid the chaos of June’s Patch Tuesday, Security Feature Bypass and Spoofing are having a moment, while Denial of Service continues to lag

Products

• .NET: 3
• ASP.NET: 1
• 365: 29
• Azure: 5
• Bing Search for Android: 1
• Defender: 1
• Dynamics 365: 1
• Edge / Copilot Chat: 1
• Excel: 10
• Exchange: 8
• Live Share Canvas SDK: 1
• Dynamics 365: 1
• Edge / Copilot: 1
• Microsoft Graph: 1
• Microsoft Live Share Canvas SDK: 1
• MMPC*: 1
• Nuance PowerScribe: 1
• Office: 28
• PC Manager: 3
• PowerPoint: 3
• PowerToys: 1
• SharePoint: 30
• Teams for Android: 1
• Visual Studio: 8
• Windows: 119
• Windows Narrator Braille: 1
• Word: 10

* It is unclear from context why this CVE is assigned to MMPC rather than Defender, but we leave it as presented to us.

As is our custom for this list, CVEs that apply to more than one product family are counted once for each family they affect. We note, by the way, that CVE names don’t always reflect affected product families closely. In particular, some CVEs names in the Office family may mention products that don’t appear in the list of products affected by the CVE, and vice versa. 

Figure 2: Twenty-four families show up in June’s Patch Tuesday count, including some unusual sightings such as Windows Narrator Braille, which users can easily patch by updating the feature through the Settings → Accessibility → Narrator → Use Braille display → Download BRLTTY menu. Windows, of course, continues to run the game.

Figure 3: We are halfway through the year, three months (more or less) into the AI Bug-Hunting Era, and dangerously low on colored pixels with which to make this chart

Notable June updates

In addition to the issues discussed above, a few items merit general attention. 

CVE-2020-17103 – Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2026-41091 – Microsoft Defender Elevation of Privilege Vulnerability
CVE-2026-45585 – Windows BitLocker Security Feature Bypass Vulnerability
CVE-2026-45586 – Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability

Microsoft connects these four CVEs to specific items disclosed by the Chaotic Eclipse researcher earlier this month – respectively, these touch MiniPlasma, RedSun, YellowKey, and GreenPlasma. All are Important-severity issues, and Microsoft judges two of them (CVE-2026-45585, CVE-2026-45586) as more likely to be exploited within the next 30 days; in fact, CVE-2026-45585 is already known to be exploited in the wild. Sharp eyes will notice that one of these bugs is much, much, much older than the others – CVE-2020-17103 was indeed patched back in December 2020 after a responsible disclosure by Google Project Zero’s James Forshaw. To address issues recently uncovered in that patch, Microsoft recommends applying the new update – but will continue to credit Forshaw with the original find.

CVE-2026-44812 – Windows Graphics Component Remote Code Execution Vulnerability
CVE-2026-45456 – Microsoft Outlook and Word Remote Code Execution Vulnerability
CVE-2026-45458 – Microsoft Outlook and Word Remote Code Execution Vulnerability
CVE-2026-45460 – Microsoft Office Information Disclosure Vulnerability
CVE-2026-45461 – Microsoft Office Remote Code Execution Vulnerability
CVE-2026-45463 – Microsoft Office Remote Code Execution Vulnerability
CVE-2026-45472 – Microsoft Office Remote Code Execution Vulnerability
CVE-2026-45474 – Microsoft Office Remote Code Execution Vulnerability
CVE-2026-47635 – Microsoft Outlook and Word Remote Code Execution Vulnerability

All nine of these CVEs have a working vector in Preview Pane and should thus be prioritized – but one of them is unusual. CVE-2026-44812 (more about this one in a minute) can be triggered by viewing in the File Explorer Preview Pane rather than the usual Outlook. All are Critical-severity, but only CVE-2026-44812 is predicted to be exploited in the next 30 days. Speaking of that CVE…

CVE-2026-44803 – Windows Graphics Component Remote Code Execution Vulnerability
CVE-2026-44812 – Windows Graphics Component Remote Code Execution Vulnerability
Here’s something else you don’t see every month: A CVE that affects both Windows itself and various Office components – Excel, PowerPoint, Word. (And now the File Explorer aspect of CVE-2026-44812 makes more sense, right?) These are both Critical-severity integer overflow / wraparound bugs that Microsoft deems more likely to be exploited within the next 30 days, so they’re worth prioritizing.

28 CVEs – Exchange and SharePoint issues

Two of the toughest Microsoft products to update are, as many observers know, usually managed in groups during what we used to know as “quieter” months, unless of course something was on fire. In 2026, the largest CVE release in history includes over two dozen patches for Exchange or SharePoint. The good news, if there is any, is that only two of the SharePoint issues (CVE-2026-45456, CVE-2026-45458) are Critical-severity, and only two of the Exchange issues (CVE-2026-45481, CVE-2026-47634) are judged by Microsoft as more likely to be exploited within the next 30 days. It’s something at least.

CVE-2026-41092 – Microsoft Kinect Elevation of Privilege Vulnerability

With a CVSS base score of 7.8 and a ruling that it’s less likely to be exploited in the next 30 days, this patch, which affects all supported Windows client and server versions, probably won’t trouble your sleep – but it may make you nostalgic for your ancient Kinect games.

Sophos protections

As noted above, we caution readers that due to volatility around certain disclosure-related issues, the table above may or may not reflect all protections currently in place.

As you can every month, if you don’t want to wait for your system to pull down Microsoft’s updates itself, you can download them manually from the Windows Update Catalog website. Run the winver.exe tool to determine which build of Windows you’re running, then download the Cumulative Update package for your specific system’s architecture and build number.

Appendix A: Vulnerability Impact and Severity

This is a list of June patches sorted by impact, then sub-sorted by severity. Each list is further arranged by CVE.

Elevation of Privilege (68 CVEs)

Remote Code Execution (55 CVEs)

Information Disclosure (30 CVEs)

Spoofing (27 CVEs)

Security Feature Bypass (19 CVEs)

Denial of Service (7 CVEs)

Tampering (3 CVEs)

Appendix B: Exploitability and CVSS

This is a list of the 16 June CVEs judged by Microsoft to be more likely to be exploited in the wild within the first 30 days post-release, as well as the single CVE acknowledged as already under attack. The list is arranged by CVE.

These are the June CVEs with a Microsoft-assessed CVSS Base score of 8.0 or higher. They are arranged by score and further sorted by CVE. (Please note that the 10.0-scoerd Azure issue noted below has already been mitigated; no action is necessary and we have chosen not to give it further space in this very long writeup.) For more information on how CVSS works, please see our series on patch prioritization schema. 

Appendix C: Products Affected

This is a list of June’s patches sorted by product family, then sub-sorted by severity. Each list is further arranged by CVE. Patches that are shared among multiple product families are listed multiple times, once for each product family. All CVE titles are accurate as made available by Microsoft. For further information on why certain products may appear in titles and not product families (or vice versa), please consult Microsoft.

Windows (119 CVEs)

SharePoint (30 CVEs)

365 (29 CVEs)

Office (28 CVEs)

Excel (10 CVEs)

Word (10 CVEs)

Exchange (8 CVEs)

Visual Studio (8 CVEs)

Azure (5 CVEs)

.NET (3 CVEs)

PowerPoint (3 CVEs)

PC Manager (3 CVEs)

ASP.NET (1 CVE)

Bing Search for Android (1 CVE)

Defender (1 CVE)

See MMPC table below for information on CVE-2026-41091.

Dynamics 365 (1 CVE)

Edge – Copilot Chat (1 CVE)

Microsoft Graph (1 CVE)

Microsoft Live Share Canvas SDK (1 CVE)

MMPC (1 CVE)

Nuance PowerScribe (1 CVE)

PowerToys (1 CVE)

Teams for Android (1 CVE)

Windows Narrator Braille (1 CVE)

Appendix D: Advisories and Other Products

There are 388 Edge-related advisories listed in June’s release, all but three from Chrome. Because virtually all these patches shipped before Patch Tuesday, and because this post is already horrifically long, we are down to just listing those Edge CVEs and exhorting readers to patch, patch, patch.

There are also two Windows-related advisories, to which we afford the dignity of names and severity / impact information. Please note that as mentioned above, that client-only CVE-2026-10263 is sporting a rather high CVSS Base score of 9.3.

Meanwhile, there are 23 CVEs from Adobe. Seven of these affect ColdFusion 2025 Update 8 and earlier as well as ColdFusion 2023 Update 19 and earlier, and are collectively addressed in APSB26-64.  The rest affect Acrobat Reader 26.001.21411 and earlier, 26.001.21411 and earlier, Win: 24.001.30362 and earlier (Windows), and 24.001.30360 and earlier (Mac); they are collectively addressed in APSB26-64. Unusually, a majority of this month’s CVEs come with a Critical severity rating; for that reason, we’re taking the time to mark those troubling items in red.

ForColdFusion

For Reader

Microsoft also issued the usual servicing stack updates this month (ADV990001).

Appendix E: Affected Windows Server versions

This is a table of 113 CVEs in the June release affecting Windows Server versions 2012 through 2025. The table differentiates among major versions of the platform but doesn’t go into deeper detail (eg., Server Core). An “x” indicates that the CVE does not apply to that version. Several Windows CVEs are affect only the client, and those CVEs are omitted from the table entirely. We also include the Important-severity, Windows-touching advisory from CERT/CC, since the Server versions it affects are known, for a grand total of 114. That advisory is indicated in this chart in blue. The Critical-severity patch from Arm Limited is not known to affect any versions of the server.

We remind readers that May was the final month of support for Server 2023 r2, and so that column is out of the table going forward.

Administrators are encouraged to use this appendix as a starting point to ascertain their specific exposure, as each reader’s situation, especially as it concerns products out of mainstream support, will vary. For specific Knowledge Base numbers, please consult Microsoft. 

Appendix F: Common Weakness Enumeration

As mentioned above, Microsoft now (almost always!) states which CWEs affect the CVEs they address. This month, we looked at which CWEs were most heavily represented in the dataset and compared them to last month’s inaugural numbers. The June dataset of 209 CVEs gave us 208 CWEs to examine; 24 CVEs had two CVEs, and one had three CWEs. There were 44 unique CWEs, which is just about average for the CWE project so far. Once again CWE-416, Use After Free, leads the pack, appearing in just over 20 percent of all cases. The rest of the field remains is fairly diffuse, with only four other CWEs appearing more than five percent of the time. We did note one especially forehead-smack item this time around: Visual Studio Code Elevation of Privilege Vulnerability, CVE-2026-47281, not only is the only CVE to sport three different CWE findings this time, one of those findings is CWE-798, Use of Hard-Coded Credentials. Sigh.