Tuesday, June 9, 2026, has gone down in history as Microsoft’s biggest Patch Tuesday ever, with 208 fixed vulnerabilities, 38 of them classified as critical and three zero-days with public exploit code. In total, adding Adobe’s patches, the figure rises to 331 CVEs, and if Chromium and third-party flaws are included, 571 is reached. The previous record, 177 CVEs, has been shattered.
The most serious: an HTTP.sys RCE that does not affect everyone
The most notable vulnerability in the batch is the CVE-2026-47291, a remote code execution flaw in HTTP.sys with a CVSS score of 9.8. It affects Microsoft’s IIS web engine and allows an unauthenticated remote attacker to execute code in the system kernel. However, there is an important nuance: only systems that have modified the registry value MaxRequestBytes are vulnerable. Microsoft recommends verifying the registry configuration or using the PowerShell script provided in the bulletin.
Actively exploited zero-days
Three zero-days with public exploit code have been confirmed:
- CVE-2026-49160 — Denial of service in HTTP.sys, reported by OpenAI’s Codex model.
- CVE-2026-45586 (“GreenPlasma”) — Privilege escalation in the Windows Collaborative Translation Framework.
- CVE-2026-50507 (“YellowKey”) — Security bypass in BitLocker that allows access to encrypted data with physical access.
These last two have been disclosed by a researcher calling himself Nightmare Eclipse, who claims to be a former Microsoft employee. In addition, he has promised a massive leak of zero-days for July 14, coinciding with the next Patch Tuesday. The company has chosen not to credit the researcher in its bulletins.
A worm in the Windows kernel
The CVE-2026-45657 is another critical vulnerability with CVSS 9.8 that affects the TCP/IP stack of the Windows kernel. It allows remote code execution at the SYSTEM level without user interaction, which makes it potentially wormable. Although Microsoft has classified it as “less likely to be exploited,” security experts anticipate it will be subjected to intensive reverse engineering.
Adobe also shatters records
Adobe has not been left behind: 123 CVEs in 11 bulletins, including two vulnerabilities with CVSS 10.0 in Adobe Campaign Classic —something that Dustin Childs, from Zero Day Initiative, describes as “practically a unicorn”— and 7 critical flaws in ColdFusion with CVSS 9.6 that require priority attention. Adobe Experience Manager adds 57 additional CVEs, although most of them are of the XSS type.
The impact of AI on vulnerability discovery
Microsoft has confirmed that both its engineers and the security community are increasingly using artificial intelligence tools to find flaws. Satnam Narang, from Tenable, notes: “Pandora’s box is open. As AI models become more advanced, we expect this trend to continue rising in all areas, not just on Patch Tuesday”. According to some surveys, 90% of security professionals already use AI in their work.
What to do
For system administrators, the priority is clear: apply the June patches as soon as possible, paying special attention to the HTTP.sys RCE (CVE-2026-47291) and the wormable flaw in TCP/IP (CVE-2026-45657). The Adobe Campaign Classic and ColdFusion patches must also be treated as critical. And let’s not forget to restart the browsers, since Chrome has fixed 429 vulnerabilities so far this month.
Article published on Thursday, June 11, 2026 | Sources: Krebs on Security, Zero Day Initiative, SANS Internet Storm Center, Automox, Splashtop
