Microsoft sets a Patch Tuesday record with 206 fixes, and finally patches every zero-day Nightmare Eclipse disclosed

Microsoft has released its June 2026 Patch Tuesday update, and it is a record-breaker. The company patched 206 vulnerabilities this month, surpassing the previous record of 175 set in October 2025. Of the 206 vulnerabilities patched, 33 are rated Critical, with 28 of those being remote code execution flaws.

The full breakdown covers 65 Elevation of Privilege vulnerabilities, 55 Remote Code Execution vulnerabilities, 30 Information Disclosure vulnerabilities, 27 Spoofing vulnerabilities, 19 Security Feature Bypass vulnerabilities, and 7 Denial of Service vulnerabilities. Five are zero-day vulnerabilities, and one is already being actively exploited in the wild.

CVE-2026-41091 is an Elevation of Privilege flaw in Microsoft Defender that lets attackers gain system privileges. Microsoft has already pushed out a fix through the daily automatic Defender updates, with the patched Malware Protection Engine carrying version 1.1.26040.8 or later. To check your engine version, open Settings > Privacy and Security > Windows Security > About.

2

This month's update also closes out several vulnerabilities tied to security researcher Nightmare Eclipse, who has been publicly disclosing Windows zero-days in protest of Microsoft's bug bounty and disclosure practices.

The patched flaws include GreenPlasma, a Windows CTFMON privilege-escalation exploit, YellowKey, a BitLocker bypass that could grant access to encrypted drives, and MiniPlasma, a privilege-escalation flaw originally reported in 2020 that Nightmare Eclipse claimed was never fully fixed. With this update, all of Nightmare Eclipse's publicly disclosed vulnerabilities have now been patched.

Part of the reason for the record patch count appears to be AI-assisted vulnerability discovery, a trend that shows no signs of slowing. Dustin Childs of TrendAI's Zero Day Initiative added that the number of CVEs Microsoft has shipped this year already exceeds the total for all of 2018.