Microsoft's June 2026 Patch Tuesday Addresses 65 CVEs, Includes Fixes for Exploited Defender Threats
Microsoft's June 2026 Patch Tuesday rollout included 65 CVEs for Windows 11 and 58 for Windows 10, alongside updates for Microsoft Office and fixes for recently exploited Microsoft Defender threats.
Microsoft's June 2026 Patch Tuesday has arrived, delivering a substantial set of security updates across its product lines. The company addressed a total of 65 Common Vulnerabilities and Exposures (CVEs) impacting Windows 11 and 58 CVEs for Windows 10. Additionally, updates for Microsoft Office online versions included approximately 19 CVEs, and Apple released its own OS security updates the day prior, facilitating a combined Windows and macOS deployment cycle.
This month's Patch Tuesday also includes critical fixes for recently exploited threats targeting Microsoft Defender. Specifically, patches were released for vulnerabilities associated with the RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) exploits. These vulnerabilities were controversially disclosed with proof-of-concept code and were rapidly weaponized by threat actors. Microsoft dynamically updated its Defender malware protection engine on May 19th to address these issues, underscoring the importance of keeping the security software up-to-date.
Microsoft also addressed a critical remote code execution (RCE) vulnerability in Microsoft Exchange Server, identified as CVE-2026-42897. This cross-site scripting issue within Outlook Web Access carries a CVSS score of 8.1. While no direct patch is immediately available, Microsoft stated that the Exchange Emergency Mitigation Service (EMS) will automatically provide mitigation, as it is enabled by default. Users are advised to confirm their EMS configuration to ensure protection against this actively exploited threat.
In a move to enhance software integrity, Microsoft held its first Windows Hardware Engineering Conference (WinHEC) since 2018. During the event, the company unveiled the new Driver Quality Initiative project. This initiative aims to significantly elevate the standard of driver quality, reliability, and security across the Windows ecosystem. Microsoft plans to collaborate closely with hardware and software vendors, providing them with tools and utilities to improve driver development and ensure a smoother user experience.
Further updates include a fix for a minor Windows 11 issue that caused failures and errors when installing KB5089549, particularly on devices with limited EFI System Partition (ESP) space. Additionally, a previously released out-of-band update for SharePoint Server addressing CVE-2026-45659, a remote code execution vulnerability, will be incorporated into the June Patch Tuesday release.
Beyond Microsoft's offerings, the June Patch Tuesday cycle is expected to see updates from other major vendors. Adobe's Creative Cloud applications, including inCopy, inDesign, Photoshop, and potentially Acrobat, are likely to receive security patches. Google Chrome 150 is anticipated to be released, and Mozilla is expected to provide updates for Firefox and Thunderbird following recent vulnerability disclosures.
Oracle has also committed to providing security updates in the months between its quarterly Critical Product Updates, with its May 2026 Critical Security Patch Update Advisory already released. This proactive approach from vendors highlights the ongoing effort to address the ever-evolving threat landscape and secure user systems against emerging vulnerabilities.