208 vulnerabilities patched in a single month. Microsoft just broke every record on the books.

June 2026 Patch Tuesday is not routine maintenance. It is the most consequential patch cycle in Microsoft's history. 208 CVEs. 33 critical. Two of them require your immediate attention above everything else on your list.

• CVE-2026-45657 CVSS 9.8 — WORMABLE RCE IN THE WINDOWS TCP/IP KERNEL. ZERO AUTHENTICATION REQUIRED.

A remote attacker sends a crafted packet to any exposed Windows system. No credentials. No user interaction. No prior foothold. The kernel TCP/IP stack processes the malformed input, a memory corruption condition triggers, and the attacker gains arbitrary code execution at kernel privilege level.

Wormable means it self-propagates. One compromised host becomes a scanner. Your flat network becomes a target. This CVE can chain across your entire environment without a single human decision involved.

This is WannaCry territory. Any unpatched Windows system with network exposure is an open door.

• CVE-2026-47281 CVSS 9.6 — ZERO-DAY IN MICROSOFT DEFENDER. ACTIVELY EXPLOITED IN THE WILD. SYSTEM ACCESS.

This vulnerability was already weaponized before the patch shipped.

Attackers found it. Weaponized it. Deployed it. Microsoft confirmed active exploitation in the wild at time of disclosure. A crafted file triggers a privilege escalation flaw in Defender's scan engine and delivers SYSTEM-level access to the attacker.

Your endpoint protection becomes the entry point. The tool built to detect threats is the mechanism being exploited.

HOW TO RESPOND NOW

EMERGENCY DEPLOYMENT — This is not a 30-day patch window. CVE-2026-45657 and CVE-2026-47281 are active threats. Deploy now. This is incident response cadence, not change management.

ISOLATE UNPATCHED SYSTEMS — Any host that cannot be patched immediately must be network-isolated. CVE-2026-45657 requires no authentication. Exposure equals risk.

BLOCK AT THE PERIMETER — Apply network-layer controls while patches propagate. Drop anomalous traffic on high-risk ports. Reduce external attack surface while deployment completes.

HUNT FOR DEFENDER EXPLOITATION — Review scan logs for anomalous process behavior. Any instance of Defender spawning elevated child processes or touching LSASS is a high-priority investigation.

PATCH IN ORDER OF EXPOSURE — Internet-facing systems first. Internal servers next. Then endpoints. Wormable CVEs move at machine speed once one host is compromised.

VALIDATE COVERAGE — Pull compliance reports. Do not assume deployment succeeded. Close every gap today.

208 CVEs. One wormable kernel RCE. One actively exploited Defender zero-day.

The question is not whether you should patch this month.

The question is whether you already have.