Microsoft Releases Patch Update for 206 Vulnerabilities Including Three Public Zero-Days

Microsoft has released security updates addressing 206 vulnerabilities in its software portfolio, including three zero-day flaws known publicly before the patching. Among the fixed issues are 39 rated as Critical and 167 as Important, covering a range of vulnerability types such as remote code execution and privilege escalation.

What happened

On Tuesday, Microsoft rolled out fixes for 206 security vulnerabilities found across its products, marking the highest number of issues patched in a single update. The batch includes three zero-day flaws that were publicly disclosed prior to the patches becoming available. The vulnerabilities span multiple categories, including privilege escalation, remote code execution, information disclosure, and spoofing.

Why it matters

This comprehensive patch address is significant due to the volume of vulnerabilities fixed and the presence of actively exploited zero-day flaws. Critical vulnerabilities such as remote code execution pose substantial risks to organizations if left unpatched, potentially allowing attackers to compromise systems remotely. The inclusion of privilege escalation and information disclosure bugs also underscores the diverse threat landscape Microsoft users face.

What security teams should do

Security teams should prioritize applying the latest Microsoft security updates promptly to mitigate risks associated with these critical and important vulnerabilities. Monitoring systems for any suspicious activity linked to the disclosed zero-days and reviewing exposure to affected Microsoft products will support early detection and prevention of exploitation attempts. Reviewing internal security controls and access privileges related to the privilege escalation flaws can further reduce risk.

Key technical details

The update addresses 206 vulnerabilities categorized mainly as 39 Critical and 167 Important severity issues. Specific vulnerability types include 63 privilege escalation flaws, 56 remote code execution vulnerabilities, 30 information disclosure weaknesses, and 27 spoofing problems. Three of the fixed flaws had been publicly disclosed before the update's release, indicating a known threat potential at patch time.

Affected organizations/products

The vulnerabilities affect Microsoft’s broad software portfolio across multiple products. Detailed product-specific information and CVE identifiers were not specified in the initial release summary.

Source attribution

https://thehackernews.com/2026/06/microsoft-patches-record-206-flaws.html