Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs

Microsoft released patches for 206 vulnerabilities (39 Critical, 167 Important) in June 2026, including high-severity network-exploitable RCEs such as CVE-2026-45657 (use-after-free in Windows Kernel), CVE-2026-47291 (HTTP.sys integer overflow), CVE-2026-44815 (DHCP stack buffer overflow), multiple BitLocker bypasses and publicly disclosed zero-days. The bulletin highlights published PoC exploits (YellowKey, GreenPlasma, RoguePlanet) from researcher Chaotic Eclipse, mitigation changes like MaxHeadersCount for HTTP/2/3, and urges prioritizing patching of systems handling network services and DHCP traffic.