Microsoft released its largest security update of the year on 9 June 2026, addressing nearly 200 vulnerabilities across Windows and Microsoft 365 products. If your business devices have not yet received this update, it should be prioritised this week.
- What it is: The June 2026 Patch Tuesday release fixes 198 vulnerabilities, including 6 zero-day flaws that were either actively exploited or publicly known before a patch was available. 33 vulnerabilities are rated Critical.
- Who is affected: All businesses running Windows computers, Windows Servers, Exchange Server, or Microsoft 365 applications.
- Key fixes include:
- A remote code execution flaw in Microsoft 365 Copilot (patched before public disclosure)
- A critical information disclosure vulnerability in Exchange Online
- Vulnerabilities in Windows DNS, Windows NTFS, Hyper-V, BitLocker, and Bluetooth drivers
- Multiple Office application security flaws
- What you need to do: Confirm Windows Update has been applied on all company devices. IT administrators should prioritise server patching this week. If you run Exchange Server on-premises, the June Exchange security updates must be applied separately.
We recommend confirming with your IT provider that this update has been applied across your environment, particularly on servers and devices that may be on delayed update schedules.
Sources: BleepingComputer | Microsoft Security Update Guide | Microsoft Tech Community