Patch Tuesday: June 2026

Next Patch Tuesday: Tue 13 Oct 2026 (in 3 days)

June 2026 Patch Tuesday: Microsoft fixed 201 vulnerabilities, 32 of them Critical. None was known to be exploited on the day. Released Tue 9 Jun 2026.

• 201vulnerabilities fixed
• 32Critical
• 0exploited before the fix
• 3publicly disclosed
• 0now on CISA KEV

By type: 66 elevation of privilege, 54 remote code execution, 27 spoofing, 26 information disclosure, 18 security feature bypass, 7 denial of service, 3 tampering.

Update problems? Ask in Patch Tuesday & Updates. From October 2026 a “what broke for you?” thread opens there at 1 pm Eastern every Patch Tuesday.

Patch these first

Being exploited, already public, or on CISA’s list of vulnerabilities attackers are using. Whatever else waits for testing, these should not.

Critical (32)

Microsoft’s top rating: usually code execution with little or no user action.

Added to CISA KEV in June 2026 (23)

Every vendor, not only Microsoft. CISA adds a vulnerability when it has evidence attackers are using it. US federal agencies must fix it by the deadline shown; for everyone else, it is the best free “patch this now” list there is.

All 201 fixes

Published later in the month (19)

Microsoft Edge updates, out-of-band fixes and cloud services. “Fixed by Microsoft” means a cloud service Microsoft has already patched: there is nothing to install.

From Microsoft’s Security Update Guide and CISA’s Known Exploited Vulnerabilities catalog, checked 2 weeks ago. Only vulnerabilities Microsoft itself issued are counted; Chromium fixes that Edge inherits are left out. For known problems with the updates themselves, see Windows release health.