210 CVEs, Three Zero-Days, and a Microsoft Warning That This Is Just the Beginning
June Patch Tuesday sets a volume record. Microsoft says AI-assisted discovery is why, and that you should get used to it.
Two hundred and ten CVEs in a single Patch Tuesday. That number is not a glitch in the tracking spreadsheet.
Microsoft patched over 200 vulnerabilities this cycle — 32 rated critical, three zero-days, one Exchange Server flaw already under active exploitation, and a separate category of 15 where the company says exploitation is "more likely." SAP dropped 15 patches of its own, four of them critical. Adobe came in at 123 CVEs across a product list long enough to make a triage team weep.
The volume isn't accidental. Microsoft's Security Response Center said publicly that AI-assisted fuzzing, static analysis, and variant hunting are compressing the gap between "a bug exists" and "someone finds it." A Microsoft engineer confirmed via email that 200-plus CVEs is now the baseline, not an outlier. The same AI tooling is surfacing bugs in components that were historically too complex to audit manually — hypervisor code, Kerberos.
In practice, that means the patch cadence you sized your change-management process for two years ago is already obsolete.
The failure mode here is treating this month's record as an exception worth a one-time scramble. It isn't.
What to actually prioritize first
The three zero-days are publicly disclosed but not confirmed as actively exploited: CVE-2026-45586 (CTFMON), CVE-2026-50507 (BitLocker bypass), and CVE-2026-49160, a denial-of-service in the Windows HTTP Protocol Stack. Public disclosure means someone has already done the hard work of documenting these.
CVE-2026-42897, the Exchange Server RCE first disclosed in May and previously managed via workaround, now has an actual patch. If you're running on-prem Exchange, that moves to the front of the queue.
The CVSS 9.8 kernel-level RCE in http.sys, CVE-2026-47291, affects IIS, WinRM, and Windows Admin Center — which is a significant chunk of any on-premises Windows estate. Four Hyper-V VM escape CVEs (CVE-2026-47652, CVE-2026-45641, CVE-2026-45607) and an Active Directory Kerberos RCE (CVE-2026-47288) round out the list of things that will ruin an on-call rotation.
SAP: unauthenticated ABAP compromise is exactly as bad as it sounds
On the SAP side, CVE-2026-27671 is a CVSS 9.8 memory corruption flaw in Application Server ABAP requiring zero authentication. One successful hit can compromise confidentiality, integrity, and availability across the entire ABAP instance and downstream connected systems. Close behind it: CVE-2026-44748, a CVSS 9.9 XML Signature Wrapping flaw in SAP NetWeaver's SAML authentication that lets a low-privilege authenticated user forge identity claims. Any organization running NetWeaver exposed to the internet should treat those two as fire-drill patches.
One thing the post-mortem will say, when it's written: the team knew about the volume problem and still ran a manual patch approval workflow.
If your pipeline isn't automated yet, June is the last reasonable argument for why you're waiting.
