Microsoft Ships Its Largest Patch Tuesday on Record, Led by a Wormable CVSS 9.8 Windows Kernel Flaw

Overview

Microsoft released its June 2026 Patch Tuesday updates on June 9, the largest single monthly security release in the program’s history. As The Record reported, the previous high was 177 CVEs set in 2025. The most severe new flaw is CVE-2026-45657, a use-after-free vulnerability in the Windows kernel that researchers describe as wormable.

What We Know

The headline figure varies by who is counting. Microsoft itself listed 206 CVEs, Trend Micro’s Zero Day Initiative counted 208, and Tenable counted 198, as reported by The Record. Counting from Microsoft’s own bulletin but excluding Edge/Chromium issues and earlier fixes, BleepingComputer put the total at 200 flaws. By BleepingComputer’s tally, those break down into 65 elevation-of-privilege, 55 remote-code-execution, 30 information-disclosure, 27 spoofing, 19 security-feature-bypass and 7 denial-of-service bugs, of which 33 are rated Critical, according to BleepingComputer.

The wormable kernel flaw

The most-discussed bug is CVE-2026-45657. The National Vulnerability Database describes it as a “[u]se after free in Windows Kernel allows an unauthorized attacker to execute code over a network” and assigns it a base score of “9.8 CRITICAL” with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, according to NVD. The Record reported that the bug “[s]its in Windows kernel and processes network traffic, allowing remote attackers to take full control with no user action,” and that the Zero Day Initiative “described it as ‘wormable,’ enabling self-spreading attacks across networks similar to WannaCry.” The NVD entry lists Windows 11 versions 23H2 through 26H1 on x64 and ARM64, plus Windows Server 2022 and 2025, among affected products, according to NVD.

It was not the only 9.8-rated remote-code-execution flaw. CVE-2026-47291 in Windows HTTP.sys is described by the NVD as an “[i]nteger overflow or wraparound in Windows HTTP.sys [that] allows an unauthorized attacker to execute code over a network,” also scored “9.8 CRITICAL.”

Zero-days already under exploitation

The wormable kernel flaw is not known to be exploited and does not appear in CISA’s Known Exploited Vulnerabilities catalog. Two other bugs addressed this cycle, however, had already been added to that catalog weeks earlier. The Record reported that CVE-2026-41091, which affects Microsoft Defender and carries a CVSS score of 7.8, lets “attackers already on a system” gain full control “by tricking Defender into writing malicious files to protected locations.” Separately, BleepingComputer noted that Microsoft “fixed an actively exploited Microsoft Exchange Server spoofing vulnerability that can execute JavaScript in a target’s browser,” CVE-2026-42897. CISA’s catalog lists CVE-2026-41091 with a date added of May 20, 2026, and CVE-2026-42897 with a date added of May 15, 2026, both before this Patch Tuesday.

What We Don’t Know

There is no public proof-of-concept exploit or confirmed in-the-wild attack for CVE-2026-45657 at the time of writing, and the cited sources do not report one. How quickly a working remote exploit will emerge for a wormable kernel bug of this profile is uncertain. The precise CVE count also remains a matter of methodology rather than a single agreed number, as the divergence between Microsoft’s, ZDI’s and Tenable’s tallies shows.

Analysis

The scale continues a year-over-year climb in Patch Tuesday volume. The Machine Herald previously reported on Microsoft’s April 2026 release of 163 fixes; June’s total, on every counter, is substantially larger. For defenders, the practical priority is less the raw count than the small set of unauthenticated, network-reachable 9.8 bugs — the kernel and HTTP.sys flaws in particular — which require no credentials or user interaction and, in the kernel case, carry self-propagation risk.