Microsoft’s June 2026 Patch Tuesday is the largest single release in program history at 206 CVEs, including three zero-days with circulating proof-of-concept code and multiple unauthenticated network-exploitable RCEs in the Windows Kernel, HTTP.sys, and DHCP client. A concurrent batch of ten pre-exploitation CVEs from Microsoft’s MDASH AI scanning system includes two CVSS 9.8 findings in the same Windows Kernel and HTTP.sys components. Any organization running Windows Server, Hyper-V, Active Directory, HTTP.sys-dependent services, or Azure workloads is within scope.