4JUL

200 fixes, six zero-days, late Exchange

3 min read

11:00UTC

Microsoft's June Patch Tuesday fixed roughly 200 vulnerabilities including six zero-days, and finally shipped the overdue Exchange patch 16 days after its federal deadline.

← Back to FortiBleed harvest linked to Lynx crew Jump to analysis ↓

TechnologyDeveloping

Key takeaway

June's 200-fix cycle finally closed the exploited Exchange flaw, 16 days past its federal deadline.

Microsoft patched roughly 200 vulnerabilities on Tuesday 9 June, including six zero-days, and finally shipped the overdue Exchange fix 16 days after its federal deadline ¹. Those six zero-days were each under active attack before the patch landed. The month reverses May's quieter 120-CVE run, which carried no exploited zero-days at all and broke a 22-month streak .

Two fixes stand out for the Windows estate. A Kerberos KDC (Key Distribution Centre, the service that issues domain logon tickets) RCE reaches domain authentication, the layer that, once broken, hands an attacker the whole network. And two separate BitLocker disk-encryption bypasses shipped in a single cycle, a pairing that gives an attacker both access to the data and a route to escalate. An actively-exploited Defender privilege flaw, tracked as RoguePlanet at CVSS 9.6, grants SYSTEM-level control ².

The Exchange resolution closes the cleanest worked example of the patch-gap problem: CVE-2026-42897 sat on the KEV catalogue from 15 May, exploited, with only a stop-gap mitigation and no full fix until now . For administrators who ran the Emergency Mitigation Service workaround in the interim, the calendar mattered, because that mitigation broke OWA print and inline images while it held the line. The fix arrives, but the 16-day overrun is the data point a buyer should keep: even Microsoft, with the largest patch engineering operation in the industry, missed a federal deadline on an exploited flaw by more than two weeks.

Deep Analysis

In plain English

Once a month, Microsoft releases security fixes for Windows, Office, and its server products in what it calls Patch Tuesday. June 2026's release fixed approximately 200 separate security problems, including six that attackers were already using before the fix existed, known as zero-days. Two of the most notable fixes involve BitLocker, the built-in Windows feature that encrypts the data on a laptop or desktop hard drive to protect it if the machine is stolen. Researchers found two separate ways to bypass BitLocker in the same month. Another actively exploited flaw, called RoguePlanet, let an attacker who already had basic access to a Windows machine take full administrative control of it, the kind of access needed to install malware, extract passwords, or spread through a network. Microsoft also finally shipped a fix for an email server flaw that the US government had required agencies to patch by 29 May, arriving 16 days late.

Deep Analysis

Root Causes

The Exchange CVE-2026-42897 patch delay reflects a known constraint in Microsoft's OWA code base: the Exchange on-premises codebase shares components with Exchange Online but runs on customer-managed infrastructure with a heterogeneous version matrix (2016, 2019, Subscription Edition).

Microsoft's patching velocity for on-premises Exchange consistently lags behind Exchange Online remediations because the on-premises fix must be validated across the full version matrix before release. The Exchange Emergency Mitigation Service (EEMS) workaround was deployed as a compensating control, but its URL-rewrite approach broke OWA features (print, inline images, Light mode), reducing operator willingness to apply it.

The two BitLocker bypasses in a single cycle reflect a known weakness in the Secure Boot chain of trust: BitLocker's pre-boot protection depends on the integrity of the boot loader and the Trusted Platform Module sealing. Research into UEFI and bootloader shim bypass techniques has intensified since 2022, and two independent researchers reaching the same BitLocker bypass surface in a single month indicates the attack surface is now well-understood in offensive security research communities.

What could happen next?

Risk
Two independent BitLocker bypasses confirmed in a single Patch Tuesday suggests concentrated offensive research on Windows disk-encryption trust chains; a third bypass in July or August 2026 would confirm a sustained campaign.
Short term · Reported
Consequence
Exchange CVE-2026-42897 arriving 16 days past its federal deadline documents a vendor compliance gap that CISA may cite when revising BOD 22-01 timelines for on-premises server products.
Medium term · Reported
Risk
CVE-2026-47288 Kerberos KDC RCE reaching domain authentication enables Active Directory forest-wide lateral movement from a single compromised endpoint; unpatched domain controllers remain at elevated risk until the June 2026 updates are applied.
Immediate · Assessed

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The April 2023 Patch Tuesday, which shipped CVE-2023-28252 (Windows CLFS zero-day, later linked to the Nokoyawa ransomware campaign) alongside CVE-2023-21554 (MSMQ RCE, a 9.8 reaching queue managers on Windows Server), set the template for ransomware-linked privilege escalation appearing in the same cycle as a critical server-side RCE.

June 2026's RoguePlanet plus Kerberos KDC pair follows the same structural pattern: an actively exploited escalation landing in the same release as a critical authentication-layer RCE.

Counter-parallel: The March 2021 Exchange emergency patch (ProxyLogon, four CVEs, 250,000+ servers compromised before the patch) shows a different pattern: in that case Microsoft shipped an out-of-cycle patch within four days of a confirmed nation-state exploitation cluster.

June 2026's Exchange patch arrived 16 days after the federal deadline, suggesting the organisational response model has not converged on the ProxyLogon emergency-release speed for a lower-severity (CVSS 8.1) exploited flaw.

Consensus view: Mandiant's Threat Intelligence team and the Zero Day Initiative (ZDI) at Trend Micro both note that June 2026 represents a structural inflection: two BitLocker bypasses in a single cycle (YellowKey CVE-2026-45585 and bitskrieg CVE-2026-50507) are operationally significant because disk encryption is typically the last layer of defence at rest.

When two independent researchers, including Nightmare Eclipse, reach the same protected subsystem in the same month, it indicates a concentration of offensive research resources on that attack surface. The RoguePlanet privilege escalation (CVE-2026-47281, CVSS 9.6) in Windows Defender reaching SYSTEM level compounds this because endpoint defence and disk encryption are both compromised in the same patch cycle.

Counter-view: GTIG's analysis of the Exchange CVE-2026-42897 patch , which finally arrived 16 days after its 29 May federal deadline, cautions against reading the 200-CVE volume as a sign of accelerating patch cadence. Microsoft's May Patch Tuesday had 120 CVEs and no zero-days; June's reversal was partly driven by a backlog deferred from May, not an increase in underlying vulnerability discovery rate.

The Israel-based research team at CyberArk Labs argues that the Kerberos KDC RCE (CVE-2026-47288) reaching domain authentication is the highest-severity individual finding, as it can produce lateral movement across an entire Active Directory forest from a single compromised host.

Key tension: Whether Microsoft's pattern of 30 or more days of exposure on the Exchange flaw before patching, alongside the concurrent KEV deadline miss, signals a structural inability to ship patches within regulatory timelines, or whether the Exchange case is an outlier driven by the complexity of on-premises OWA-specific code paths.

Sources:BleepingComputer

Mentions:Microsoft →CVE-2026-42897 →Exchange Emergency Mitigation Service →CISA →Windows Server →Mandiant →May Patch Tuesday →Israel →Known Exploited Vulnerabilities →Remote Code Execution →Microsoft Exchange Server →Kerberos →BitLocker →Windows Defender →RoguePlanet →

First Reported In

Update #7 · VPN zero-day, no-patch KEV, late Exchange

BleepingComputer· 14 Jun 2026

Read original →

Causes and effects

Caused by

Exchange repeats the CISA deadline-before-patch trap

CVE-2026-42897 Exchange was listed on KEV on 15 May with a 29 May deadline and no patch; the June Patch Tuesday on 9 June finally resolved it, sixteen days after the federal deadline.

Occurred 15 May 2026

Read story →

Patch Tuesday clean streak hides out-of-band KEVs

May Patch Tuesday's 120-CVE zero-zero-day release broke a 22-month streak; June's 200-CVE six-zero-day reversal is a direct contrast used to frame the magnitude of the month's patch burden.

Occurred 13 May 2026

Read story →

This Event

200 fixes, six zero-days, late Exchange

The month reverses May's quiet run and closes the cleanest example of a flaw exploited with a deadline but no fix.

Led to

A handle keeps dropping MS zero-days

June Patch Tuesday's coverage of RoguePlanet differs from Nightmare Eclipse's own account, and this unresolved discrepancy is central to the Chaotic Eclipse event.

Occurred 17 Jun 2026

Read story →

Different Perspectives

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.

Threat-intelligence industry

SOCRadar's confirmation that one operator sits on two ransomware crews' negotiation panels, following Bitdefender's affiliate-overlap flag six weeks earlier, gives the sector its second independent data point that brand-based tracking undercounts shared access. The firms doing this work are shifting language from named-group attribution toward access-broker mapping.

FSB Centre 16

Named by NCSC as running an SNMP-hijacking campaign against communications, energy, healthcare, defence and financial-services operators, harvesting device data and reconfiguring routers through a decades-old plaintext-authentication protocol. The campaign runs in parallel to, not in place of, the GRU's separate DNS-hijacking operation named in April.

CISA

CISA's Known Exploited Vulnerabilities catalogue added seven CVEs between 5 and 14 July, none from a headline security vendor, capped by the 18-year-old Cisco IOS bug CVE-2008-4128. BOD 26-04's risk-tiered listing rules make that slowdown as much a policy artefact as a threat-intensity read.

Nidec

Nidec faces a $2m demand from Blackfield after the crew breached a server at its supplier Chaun Choung Technology rather than Nidec's own network. The attack reached Nidec's data without touching its own perimeter at all, the same supply-chain route World Leaks used against Tata Electronics.

Tata Electronics

Tata Electronics restricted remote access to its purchase-order systems and hired a forensic consultant after World Leaks posted 630GB of its files, including purported Apple and Tesla design material, to a leak site. The exposed value sits on its customers' balance sheets, not its own, which is what makes it hard to price.