Microsoft’s biggest-ever Patch Tuesday fixes 206 bugs, including 3 zero-days

This Patch Tuesday advisory reports Microsoft fixed 206 security flaws — including 32 critical vulnerabilities and three publicly disclosed zero-days — and urges users to apply updates via Windows Update. Notable issues called out are CVE-2026-50507 (BitLocker protection bypass, CVSS 6.8), CVE-2026-49160 (HTTP.sys HTTP/2 denial-of-service, CVSS 7.5), and CVE-2026-45586 (Windows CTFMON elevation to SYSTEM, CVSS 7.8); the vendor states none are known to be actively exploited. The bulletin includes step-by-step update instructions and emphasizes patching to mitigate risk.