Record-breaking June 2026 Patch Tuesday: 200 CVEs and 6 zero-days in one Microsoft patch cycle

10 Jun 2026 4 min read 1849 views Technology
Technology

The June 2026 Patch Tuesday has set a record: 200 vulnerabilities fixed in a single cycle, 6 zero-days among them, and — just hours after the patches dropped — a researcher published RoguePlanet, a new Microsoft Defender exploit that works on fully updated systems. The sheer volume is not just a statistic: it's a signal of the mounting pressure on security teams to triage, patch, and contain within ever-shrinking windows.

Patch Tuesday has been the reference cadence for Windows vulnerability management for decades. But June 2026 has broken every record in absolute CVE count, attack vector variety, and the speed at which an external researcher published a new exploit on the same day Microsoft closed the previous ones. This scenario — simultaneous patch and zero-day — is a structural stress signal for the monthly patch model.

Weekly context

Microsoft released its June security updates on Tuesday the 10th. Simultaneously, CISA issued a directive requiring government agencies to apply critical patches within 3 days — down from the usual 15 — indicating that at least some vulnerabilities are already being actively exploited in critical infrastructure. Oracle also warned of a critical PeopleSoft Suite zero-day (CVE-2026-35273) enabling unauthenticated remote code execution, already being exploited in data theft attacks.

Key vulnerabilities

  • RoguePlanet (Microsoft Defender): published by researcher "Nightmare Eclipse" hours after Patch Tuesday. Exploits a race condition in Defender to spawn a shell with SYSTEM privileges on fully patched Windows 10 and Windows 11. No patch available at time of publication.
  • GreenPlasma and MiniPlasma: privilege escalation in the Collaborative Translation Framework (CTFMON) and the Cloud Files Mini Filter Driver respectively. Allow a local attacker to obtain a SYSTEM shell on fully patched systems.
  • YellowKey (Windows Recovery Environment): a backdoor in WinRE that can persist even after a Windows reinstall, since it targets the recovery partition outside the normal update cycle.
  • HTTP/2 Bomb: denial-of-service on servers implementing HTTP/2. Allows an unauthenticated remote attacker to crash the service using minimal traffic by abusing header compression.
  • Critical ASP.NET (emergency patch): Microsoft issued an out-of-band patch for a critical ASP.NET vulnerability already being exploited in the wild.
  • CVE-2026-35273 (Oracle PeopleSoft): unauthenticated RCE in Oracle's ERP suite, actively exploited in targeted attacks against enterprise environments.

Impact for development and operations teams

Teams running enterprise Windows environments must immediately prioritize patches for YellowKey and GreenPlasma: both enable local privilege escalation and are standard vectors for lateral movement after an initial intrusion. RoguePlanet represents an uncovered risk in the current monthly cycle: it affects updated Windows 10 and 11 and has no patch available. Development teams running CI/CD pipelines on Windows agents should evaluate the risk of running elevated-context processes on exposed machines. CISA's 3-day patch mandate sets a new speed standard that should be adopted beyond government environments wherever critical infrastructure is involved.

Practical recommendations

  1. Apply June patches immediately, prioritizing YellowKey (WinRE), GreenPlasma (CTFMON), and MiniPlasma (Cloud Files) as the most readily exploitable local escalation vectors.
  2. Monitor IoCs published by CISA and the Nightmare Eclipse researcher until Microsoft releases a fix for RoguePlanet.
  3. Tighten Microsoft Defender configurations to restrict which processes can inherit elevated privileges as a temporary mitigation against RoguePlanet.
  4. Audit WinRE partition integrity on critical servers to rule out YellowKey persistence in already-compromised systems.
  5. Identify HTTP/2-enabled exposed servers and activate rate limiting as a mitigation for the HTTP/2 Bomb until the patch is confirmed applied.
  6. If your environment uses Oracle PeopleSoft, treat CVE-2026-35273 as critical-priority: it is being actively exploited.

What to watch next

  • RoguePlanet patch release: no confirmed date, may require an out-of-band emergency update from Microsoft.
  • Attack evolution using YellowKey: its WinRE persistence makes it a high-severity vector for APT campaigns.
  • Microsoft's response to the monthly patch model: three zero-days with public exploits on Patch Tuesday day itself suggest the monthly cadence is no longer adequate for all critical vectors.
  • Impact of the HTTP/2 Bomb on cloud services using HTTP/2 by default on their load balancers.

Conclusion: The June 2026 Patch Tuesday is not just a record in volume — it is a warning about the sustainability of the monthly patch model. With zero-days published the same day as the fixes and vulnerabilities persisting in recovery partitions, security teams need shorter response cycles, patch automation, and containment strategies that do not depend on patches arriving in time. The window between disclosure and exploitation has never been narrower.

Sources and documentation

Share