Microsoft has rolled out its June security updates, addressing a record-breaking 206 vulnerabilities across its software ecosystem. The total surpasses the previous high of 175 flaws patched in a single month, highlighting the growing complexity of securing modern platforms. The fixes cover a broad range of products, including Windows, Office applications, Exchange Server, and various cloud-based services.
Among the vulnerabilities corrected this month, 38 have been classified as critical, while the remaining issues carry high-severity ratings. Most notably, one of the flaws had already been exploited by attackers before the patches became available, making this update cycle especially significant for organizations and individual users alike.
Windows accounts for the largest share of the fixes, with 118 vulnerabilities affecting supported versions of Windows 10, Windows 11, and Windows Server. Security experts are urging users to install updates promptly due to the number of serious flaws addressed.
The actively exploited vulnerability was discovered in Microsoft Defender and allows attackers to elevate their privileges on a compromised system. Successful exploitation could grant access to system-level permissions, giving malicious actors broad control over affected devices. Microsoft has already distributed a corrected version of the Malware Protection Engine through Defender’s automatic update mechanism, ensuring that many systems receive protection without requiring manual intervention.
This month’s updates also focus heavily on Secure Boot protections. As older Secure Boot certificates reach expiration, Microsoft has introduced additional safeguards while patching multiple vulnerabilities that could potentially allow malicious code to execute during the startup process. Such attacks are particularly dangerous because they occur before many security mechanisms are fully active.
Several critical remote code execution vulnerabilities were also eliminated. One of the most severe flaws affects the Windows kernel and could allow attackers to remotely run code with full system privileges without requiring authentication. Additional vulnerabilities were found in Windows networking components, including the HTTP service and DHCP Client service, both of which are widely used across enterprise and consumer environments.
BitLocker security received attention as well, with updates addressing vulnerabilities that could weaken the platform’s encryption protections. These issues had attracted considerable attention within the cybersecurity community due to their potential impact on data security.
Microsoft Office saw a substantial increase in patched vulnerabilities compared to previous months. The company fixed 54 flaws, including 25 remote code execution vulnerabilities. Several of these are considered critical because attackers could potentially exploit them through the preview pane alone, meaning users might not need to open a malicious document for an attack to succeed. Other vulnerabilities require victims to interact directly with compromised files.
Virtualization environments were another focus area. Multiple critical flaws in Hyper-V could allow malicious code running inside a virtual machine to escape its isolated environment and execute on the host system. Such vulnerabilities are particularly concerning for businesses that rely heavily on virtualization technologies.
Exchange Server administrators also received important security fixes. Eight vulnerabilities were addressed, including a remote code execution issue that could be exploited during a man-in-the-middle attack. Microsoft additionally corrected a critical data exposure flaw affecting its cloud-based email services. In a successful attack scenario, cybercriminals could potentially hijack an administrator’s session by convincing them to interact with a specially crafted malicious link.
The latest version of Microsoft Edge also includes a significant collection of security improvements. Beyond browser-specific fixes, the update incorporates dozens of Chromium security patches. Among them is a zero-day vulnerability that had already been identified in the Chromium codebase, making prompt browser updates highly recommended.
With more than 200 vulnerabilities addressed in a single release cycle and at least one flaw already under active exploitation, this month’s updates rank among the most important Microsoft security releases in recent years. Security professionals are encouraging organizations and home users alike to prioritize patch deployment to reduce exposure to potential attacks.