In a nutshell: On the second Tuesday of every month, Microsoft addresses the overall security of its many software products. The Patch Tuesday tradition has continued for more than 20 years, but the number of vulnerabilities addressed in monthly updates is now truly skyrocketing.

Microsoft recently released its latest batch of monthly security fixes for vulnerabilities found in Windows, Office, and other products sold by the company. This month's Patch Tuesday stands out for a record number of CVE-tracked flaws, with 200 individual bugs and 33 "critical" vulnerabilities that could have serious consequences for Microsoft customers.

The June updates address a wide range of security issues. The most common categories include elevation of privilege vulnerabilities (65), remote code execution bugs (55), and information disclosure issues (30), among others. The Patch Tuesday release does not include flaws discovered in the Chromium-based Edge browser, which saw 360 issues fixed this month alone.

The updates also addressed five zero-day vulnerabilities, which are publicly disclosed bugs that are already being actively exploited by cybercriminals. The zero-day flaws include CVE-2026-45586, an elevation of privilege vulnerability; CVE-2026-49160, a denial-of-service vulnerability in Http.sys; and CVE-2026-42897, a server spoofing vulnerability in Microsoft Exchange.

The CVE-2026-45586 patch targets a vulnerability previously known as GreenPlasma. The flaw was discovered by a security researcher known as Nightmare-Eclipse, who has been in a dispute with Microsoft over alleged attempts to damage his reputation.

This month's Patch Tuesday also addresses a security flaw discovered by Nightmare-Eclipse. Known as "YellowKey," the bug was described as a potential attempt to introduce a stealth backdoor in Microsoft's BitLocker full-volume encryption feature. Tracked as CVE-2026-45585, the issue should now be fully patched. However, Microsoft has not publicly acknowledged Nightmare-Eclipse's contribution.

Speaking of, the researcher also released another exploit dubbed "RoguePlanet." The proof-of-concept code could potentially be abused to open a command prompt with full "SYSTEM" privileges. It remains to be seen whether Microsoft will quietly address the issue without crediting its original discoverer.

Security experts warn that the number of software bugs addressed through Patch Tuesday and other periodic patching programs is likely to continue increasing. Microsoft noted that both security professionals and threat actors are now using advanced AI models to discover new vulnerabilities. The result is a rapidly expanding attack surface, with software vendors expected to spend increasing time fixing issues uncovered through automated discovery methods.