Microsoft's security release of 9 June 2026
Patch Tuesday, June 2026
As of , CISA lists none of the 200 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2026-42980, NT OS Kernel Elevation of Privilege.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 200 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 199 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 8 CVEs |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-42980NT OS Kernel Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.00 |
| 2 | CVE-2026-26142Nuance PowerScribe Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 3 | CVE-2026-45484Microsoft SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 4 | CVE-2026-48573Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.02 |
| 5 | CVE-2026-48576Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.02 |
| 6 | CVE-2026-45591ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 7 | CVE-2026-45454Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 8 | CVE-2026-44815DHCP Client Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 9 | CVE-2026-45657Windows Kernel Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 10 | CVE-2026-47291HTTP.sys Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 11 | CVE-2026-47643Azure Stack Edge Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 12 | CVE-2026-42904Windows TCP/IP Elevation of Privilege | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 13 | CVE-2026-47281Visual Studio Code Elevation of Privilege | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 14 | CVE-2026-40371Microsoft Dynamics 365 (on-premises) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 15 | CVE-2026-42985Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 16 | CVE-2026-45504Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2026-45648Windows Active Directory Domain Services Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2026-47289Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2026-47653Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2026-41098Azure Stack Edge Spoofing | None | Not on CISA's list | 8.4 High | 0.01 |
| 21 | CVE-2026-44822Microsoft Excel Information Disclosure | None | Not on CISA's list | 8.2 High | 0.01 |
| 22 | CVE-2026-42835Microsoft Teams for Android Information Disclosure | None | Not on CISA's list | 8.1 High | 0.01 |
| 23 | CVE-2026-42974Windows Performance Monitor Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 24 | CVE-2026-42981Windows Performance Monitor Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 25 | CVE-2026-42987Windows Deployment Services (WDS) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 26 | CVE-2026-45503Microsoft Exchange Server Information Disclosure | None | Not on CISA's list | 8.1 High | 0.01 |
| 27 | CVE-2026-45599Windows UPnP Device Host Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 28 | CVE-2026-45635Windows UPnP Device Host Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 29 | CVE-2026-45644Microsoft Live Share Canvas SDK Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 30 | CVE-2026-47298Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 31 | CVE-2026-44819Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2026-44824Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2026-45471Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2026-45475Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2026-40376Visual Studio Code Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 36 | CVE-2026-42908Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 37 | CVE-2026-42992Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 38 | CVE-2026-42993Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 39 | CVE-2026-44799Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 40 | CVE-2026-44801Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 41 | CVE-2026-45583Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 42 | CVE-2026-45639Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 43 | CVE-2026-47654Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 44 | CVE-2026-48563Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 45 | CVE-2026-49160HTTP.sys Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 46 | CVE-2026-45481Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 47 | CVE-2026-47634Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 48 | CVE-2026-42903Windows Kerberos Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 49 | CVE-2026-42907Windows Shell Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 50 | CVE-2026-47284Visual Studio Code Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 51 | CVE-2026-47287Visual Studio Code Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 52 | CVE-2026-50508Windows NTLM Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 53 | CVE-2026-44821Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 54 | CVE-2026-33113Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 55 | CVE-2026-45453Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 56 | CVE-2026-45464Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 57 | CVE-2026-45465Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 58 | CVE-2026-47636Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 59 | CVE-2026-47639Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 60 | CVE-2026-48560Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 5.4 Medium | 0.01 |
| 61 | CVE-2026-42914Windows Kerberos Denial of Service | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 62 | CVE-2026-45502Microsoft Exchange Server Information Disclosure | None | Not on CISA's list | 5.0 Medium | 0.01 |
| 63 | CVE-2026-45462Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 64 | CVE-2026-45467Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 65 | CVE-2026-45468Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 66 | CVE-2026-45479Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 67 | CVE-2026-45483Microsoft Office Project Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 68 | CVE-2026-47637Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 69 | CVE-2026-47638Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 70 | CVE-2026-47640Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 71 | CVE-2026-47641Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 72 | CVE-2026-48562Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 73 | CVE-2026-45650Microsoft Bing Search Spoofing | None | Not on CISA's list | 4.3 Medium | 0.01 |
| 74 | CVE-2026-45455Microsoft Excel Information Disclosure | None | Not on CISA's list | 3.3 Low | 0.01 |
| 75 | CVE-2026-45485Microsoft Office Information Disclosure | None | Not on CISA's list | 3.3 Low | 0.01 |
| 76 | CVE-2026-45602Windows Dynamic Host Configuration Protocol (DHCP) Tampering | None | Not on CISA's list | 9.1 Critical | 0.00 |
| 77 | CVE-2026-32193Azure Kubernetes Service (AKS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.00 |
| 78 | CVE-2026-44810Microsoft Cryptographic Services Elevation of Privilege | None | Not on CISA's list | 8.4 High | 0.00 |
| 79 | CVE-2026-45456Microsoft Outlook and Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 80 | CVE-2026-45458Microsoft Outlook and Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 81 | CVE-2026-45461Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 82 | CVE-2026-45463Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 83 | CVE-2026-45472Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 84 | CVE-2026-45474Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 85 | CVE-2026-45482Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass | None | Not on CISA's list | 8.4 High | 0.00 |
| 86 | CVE-2026-45607Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 87 | CVE-2026-45641Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 88 | CVE-2026-47635Microsoft Outlook and Word Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 89 | CVE-2026-45476Microsoft Azure Network Adapter Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.00 |
| 90 | CVE-2026-47652Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 8.2 High | 0.00 |
| 91 | CVE-2026-47631Microsoft Exchange Server Spoofing | None | Not on CISA's list | 8.1 High | 0.00 |
| 92 | CVE-2026-45588Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 93 | CVE-2026-45654Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 94 | CVE-2026-47656Windows Boot Manager Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 95 | CVE-2026-48568Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 96 | CVE-2026-48570Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 97 | CVE-2026-48575Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 98 | CVE-2026-48578Secure Boot Security Feature Bypass | None | Not on CISA's list | 7.9 High | 0.00 |
| 99 | CVE-2026-33828Windows Device Health Attestation (DHA) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 100 | CVE-2026-40404Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 9 June 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.