Microsoft and Adobe Patch Tuesday, June 2026 Security Update Review

A total of 206 vulnerabilities have been addressed in the latest Microsoft Patch Tuesday update for June 2026. This includes 33 critical and 167 important-severity vulnerabilities that could significantly impact enterprise environments if left unaddressed.

The updates cover multiple Microsoft product families, including Windows DNS, Media, NTFS, Hyper-V, BitLocker, Bluetooth Port Driver, Boot Manager, Copilot, Exchange Server, and more. Several high-severity issues have been fixed, which could potentially enable remote code execution, privilege escalation, or denial-of-service attacks.

The June 2026 Microsoft vulnerabilities are classified as follows: Windows DNS (1), Media (2), NTFS (3), Hyper-V (4), BitLocker (5), Bluetooth Port Driver (6), Boot Manager (7), Copilot (8), Exchange Server (9), and others. The severity of these issues ranges from low to critical, with some potentially allowing remote code execution or privilege escalation.

Adobe has released 11 security advisories to address 123 vulnerabilities in various Adobe products, including Experience Manager, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Acrobat Reader, ColdFusion, Format Plugins, and Campaign Classic. Of these, 47 are rated critical.

Successful exploitation of the Microsoft vulnerabilities could lead to privilege escalation, Security feature bypass, arbitrary file system read, application denial-of-service, or arbitrary code execution. Some of the specific issues include a heap-based buffer overflow vulnerability in Office that allows an unauthenticated attacker to execute code remotely and a type confusion vulnerability in Office that also enables remote code execution.

Meanwhile, Adobe's security advisories address vulnerabilities such as privilege escalation, Security feature bypass, arbitrary file system read, application denial-of-service, or arbitrary code execution. The most severe issues include a heap-based buffer overflow vulnerability in Experience Manager Forms that allows an unauthenticated attacker to execute code remotely and a use-after-free vulnerability in Substance 3D Sampler that enables remote code execution.

Qualys VMDR automatically detects new Patch Tuesday vulnerabilities using continuous updates to its Knowledgebase (KB). Users can see all impacted hosts by these vulnerabilities using the QQL query provided. The tool rapidly remediates Windows hosts by deploying relevant and applicable patches, allowing users to identify and deploy available patches with one click.

Qualys TruRisk Eliminate enables security teams to apply mitigation controls that immediately lower exposure and reduce the Qualys Detection Score (QDS). As part of its monthly Patch Tuesday signature set, Qualys provides mitigants for 94 vulnerabilities. These mitigations modify configuration by changing registry keys and service policy files for affected components such as Remote Access Connection Manager, Remote Desktop Services, Shell, Storage, Subsystem for Linux, Power Automate Desktop, Internet Explorer, Microsoft SharePoint, Exchange Server, Graphics Component, Office Excel, Outlook, Word, Power BI, and Hyper-V.

Qualys Policy Audit's Out-of-the-Box Mitigation or Compensatory Controls reduce the risk of a vulnerability being exploited because the remediation (fix/patch) cannot be done now. These controls are not recommended by industry standards such as CIS or DISA-STIG but are based on Vendor-suggested Mitigation/Workaround. A mitigation refers to a setting, common configuration, or general best practice that exists in a default state and could reduce the severity of exploitation of a vulnerability.

The next Patch Tuesday is scheduled for July 14, with details and patch analysis provided then. Until next time, stay safe and secure by subscribing to the 'This Month in Vulnerabilities and Patches' webinar series hosted by Qualys Research team.