Microsoft Issues Record Patch Tuesday With 206 Fixes and Multiple Zero-Day Risks

Microsoft released its largest Patch Tuesday update to date, fixing 206 vulnerabilities across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included three publicly disclosed zero-days, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw CVE-2026-41091. Publicly disclosed issues in the June bundle included CVE-2026-50507, a BitLocker security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and CVE-2026-45586, a Windows CTFMON elevation-of-privilege flaw that could let a low-privileged local attacker gain SYSTEM access. JPCERT/CC also warned that Microsoft disclosed active exploitation of CVE-2026-42897, a spoofing flaw in Microsoft Exchange Server.