June 2026 Patch Tuesday: What Financial Institutions Must Patch First

The June 2026 Patch Tuesday is the largest single security release Microsoft has ever shipped. On June 9, the Microsoft Security Response Center published fixes for more than 200 vulnerabilities in one cycle, a monthly record by a comfortable margin. For a community bank, a credit union, or a mortgage company running a lean IT team, the headline is not any one of those 200 flaws. The headline is the volume itself, because nobody on a five-person IT team can read 200 advisories, decide which ones matter, and deploy the right patches to the right machines in the right order before an attacker does.

That is the real story of June. The month carried more than thirty Critical vulnerabilities, most of them remote code execution, including three separate flaws rated 9.8 out of 10 on the CVSS scale. It carried three publicly disclosed zero-days. And the same cycle finally delivered the permanent fix for an Exchange Server flaw that attackers had already been exploiting in the wild since the middle of May. Sorting the genuinely urgent from the merely numerous is the entire job, and it is a job that does not fit into the calendar of an IT director who is also running the help desk, the phone system, and the quarterly examination prep.

This article walks through what Microsoft published on June 9, which June flaws demand explicit action from a financial institution and which ones Microsoft already handled inside its own cloud, what to verify in the Microsoft Intune admin center this week, and how ABT's Guardian operating model turns a record-breaking patch month into a fifteen-minute compliance review instead of a multi-day scramble. Every CVE identifier, severity rating, and date in this article traces to a Microsoft canonical source, the National Vulnerability Database, CISA, or a respected security research publication.

The volume is the story, but only a handful of those fixes actually change what your institution does this week. Here is the short version before the section-by-section detail.

What Microsoft Shipped on June 9, 2026

The June 2026 release from the Microsoft Security Response Center is the largest monthly Patch Tuesday Microsoft has ever produced. Vulnerability counts vary by source because two of the entries are non-Microsoft component CVEs, an ARM processor flaw and a UEFI Secure Boot flaw, that some trackers fold into the total and others list separately. Qualys and The Hacker News count 206 Microsoft CVEs. The Zero Day Initiative counts 208. Either way it is a record, and it dwarfs the 137 fixes that made May 2026 feel large at the time.

More than thirty of the June flaws are rated Critical, and the majority of the Critical issues are remote code execution. Three of the month's flaws were publicly disclosed before patches were available, which is the technical definition of a zero-day, although Microsoft stated it was not aware of in-the-wild exploitation of any of the brand new June vulnerabilities at the moment of release. The three publicly disclosed items were a Windows Collaborative Translation Framework privilege escalation (CVE-2026-45586), a BitLocker security feature bypass (CVE-2026-50507), and an HTTP.sys denial of service (CVE-2026-49160).

For a financial institution, the practical question is never "how many CVEs." It is "which of these can actually reach my environment, and what do I do about each one." The table below sorts the June items that matter most for a bank, credit union, or mortgage company by the action they require.

The pattern that matters here is the split between what you patch and what Microsoft already patched for you. The Exchange Server, Windows Kernel, HTTP.sys, DHCP Client, and Active Directory flaws all require the June cumulative update to reach your machines. The Copilot and Exchange Online flaws were fixed inside Microsoft's cloud service before the advisory was even published. Understanding which side of that line a given CVE sits on is the difference between a calm patch cycle and a panicked one, and it is exactly the kind of triage a managed Microsoft partner does so the institution does not have to.

The Actively Exploited Exchange Zero-Day This Cycle Finally Closes

Of everything in the June window, one flaw stands apart because it is the only one attackers were already exploiting in the wild. CVE-2026-42897 is a cross-site scripting vulnerability in the Outlook Web Access component of on-premises Microsoft Exchange Server. Microsoft first disclosed it on May 14, 2026. CISA added it to the federal Known Exploited Vulnerabilities catalog the very next day, May 15, with a remediation deadline of May 29 for federal agencies. Microsoft assigned it a CVSS base score of 8.1.

The exploitation path is deceptively simple. An attacker sends a specially crafted email to a target. If the recipient opens that email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript executes in the user's browser session. The impact Microsoft describes is spoofing, not direct server takeover. There is no public evidence of unauthenticated server-side command execution. But spoofing inside a webmail session at a bank is far from harmless. It is the kind of foothold that supports credential theft, session hijacking, and convincing internal phishing that appears to come from a trusted colleague's mailbox.

The reassuring detail is that the immediate mitigation has been available, and for most organizations active, since the day of disclosure. Microsoft delivers it through the Exchange Emergency Mitigation Service, which has shipped enabled by default since September 2021. If that service is running, the mitigation for CVE-2026-42897 was applied automatically in mid-May. Institutions in disconnected or air-gapped environments, where the Emergency Mitigation Service cannot reach Microsoft, apply the mitigation manually with the Exchange On-premises Mitigation Tool. Either way, the June 10 security update is the permanent remediation that retires the mitigation as a stopgap.

One clarification matters for the many financial institutions that have moved their mailboxes to the cloud: Exchange Online is not affected by CVE-2026-42897. Only on-premises Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition are in scope. If your institution runs a hybrid configuration with any on-premises Exchange servers remaining, those servers are in scope and need the fix. If you are fully on Exchange Online, this particular flaw is not yours to patch, which is itself a useful argument for the managed cloud migration many community financial institutions are weighing.

The Critical Remote Code Execution Flaws That Demand Action

Beyond the Exchange fix, the June rollup carried three remote code execution flaws rated 9.8 out of 10, the near-maximum on the CVSS scale. All three are reachable over a network, and the most severe requires no authentication and no user interaction at all.

The standout is CVE-2026-45657, a remote code execution flaw in the Windows Kernel. The Zero Day Initiative describes it as a bug in how the kernel handles TCP/IP that lets a remote, unauthenticated attacker execute code at SYSTEM level without any user interaction. Microsoft rated real-world exploitation of this flaw "less likely," but security researchers were quick to flag the underlying mechanism as a candidate for self-propagating, wormable exploitation, the category of vulnerability that can spread from machine to machine across a network without anyone clicking anything.

The second 9.8 flaw, CVE-2026-47291, is a remote code execution vulnerability in HTTP.sys, the Windows kernel-mode component that underpins Internet Information Services and other web-facing Windows workloads. Microsoft rated this one "more likely" to be exploited, a notch above the Kernel flaw. There is one mitigating nuance worth knowing: systems running the default MaxRequestBytes registry value are not affected, so the exposure is concentrated on servers that have been tuned away from that default. For most financial institutions the safe assumption is to patch and not rely on a registry value nobody documented.

The third 9.8 flaw, CVE-2026-44815, is a remote code execution vulnerability in the Windows DHCP Client, the component every Windows machine uses to obtain a network address. A crafted DHCP response on a local network segment can compromise a vulnerable machine. The realistic threat model is an attacker who has already gained a foothold inside the network, on guest Wi-Fi or an untrusted segment, and uses the DHCP flaw to move laterally.

Rounding out the list that a financial institution should care about is CVE-2026-45648, a remote code execution flaw in Active Directory Domain Services. It requires authentication, which lowers its urgency relative to the unauthenticated kernel flaw, but Active Directory is the identity backbone for nearly every bank, credit union, and mortgage company that has not gone fully cloud-native. A code execution flaw on a domain controller is never routine. As with any domain controller patch, the rule is to update every domain controller in the same maintenance window, because a half-patched forest is not a defensible state.

The Office and Outlook document handlers also received a cluster of remote code execution fixes this month, the type-confusion and heap-overflow flaws that get exploited through a malicious document or email. Those propagate to endpoints through the same June cumulative update and the normal Microsoft 365 Apps update channel, so they are covered by the standard fleet patching cycle rather than a separate effort.

Why June Had Two Releases: What Microsoft Patched and What You Patch

June 2026 was unusual in that Microsoft effectively shipped security fixes twice. Five days before the June 9 Patch Tuesday, on June 4, Microsoft published a batch it called the June 2026 Early Security Updates. That earlier batch fixed flaws inside Microsoft's own cloud services, and it required nothing from customers because there was nothing to install.

The two cloud-side items most relevant to financial institutions were a remote code execution flaw in Microsoft 365 Copilot (CVE-2026-45497, CVSS 7.7) and a Critical information disclosure flaw in Exchange Online (CVE-2026-48579, CVSS 9.1). Both run on Microsoft's infrastructure, and Microsoft mitigated both inside the service before disclosing them. We covered the cloud-side story in detail in our breakdown of the June 2026 Microsoft 365 Copilot remote code execution flaw, where the surprising and reassuring answer for IT teams was that there was nothing to patch.

This split is more than a technical footnote. It is the line that determines where your IT team spends its time. Treating every Microsoft CVE as an internal patching emergency wastes effort on flaws Microsoft already closed in the cloud. Ignoring the split and assuming "Microsoft handles everything" leaves the genuinely customer-side flaws, the Exchange Server and Windows and Active Directory ones, unpatched and exposed. Getting the line right every month, across a 200-CVE release, is the work.

What Banks, Credit Unions, and Mortgage Companies Should Verify This Week

The customer-side action for June 2026 concentrates in two Microsoft surfaces: Microsoft Intune's Windows Update for Business policies, and Microsoft Defender's vulnerability management view. Both are part of the Microsoft 365 E3 or E5 security entitlement for organizations that license the stack, and both are managed by ABT for customers under the Guardian operating model. The seven steps below map the June cumulative update to the exact admin-center surfaces where an IT director or security lead can confirm the rollout actually happened across the fleet.

That checklist takes a healthy fleet roughly two to four hours of focused work. It takes much longer when patch compliance has been allowed to drift and a portion of the fleet has stopped checking in. In ABT's experience, the common pattern at institutions that have never done structured verification is that seventy to ninety percent of devices are up to date within a week, with the rest spread across genuine patch failures, devices off the network, and corrupted Windows Update agents that need a manual reset. For a deeper look at how the underlying license entitlements support this work, see our analysis of continuous security monitoring for financial institutions and last month's walkthrough of the May 2026 Patch Tuesday Netlogon and DNS Client flaws.

How ABT's Guardian Operating Model Runs the June Cycle for You

Financial institutions under ABT's Guardian operating model do not run the seven-step checklist by hand each month. ABT's managed security operations team configures the Microsoft Intune ring policies, monitors deployment across the fleet, cross-checks Microsoft Defender vulnerability management, and reports the result, the same managed cycle ABT runs every month across more than 750 financial institutions. A 200-CVE month and a 50-CVE month look the same from the institution's chair: a short operations report confirming the fleet is covered.

Guardian covers the June 2026 cycle in five concrete ways. First, the Microsoft Intune ring policies for Guardian customers are pre-configured to take Critical and Important security updates with a quality update deferral of seven days or less, so the June cumulative update reaches the fleet on Microsoft's intended schedule rather than a delayed one. Second, ABT's security operations team watches the Microsoft Defender vulnerability management view continuously, with alerts on any device that fails to remediate a June critical flaw inside the policy window. Third, ABT's managed Microsoft Sentinel deployment carries detection rules for the behaviors that would signal exploitation of the Exchange, kernel, or Active Directory flaws on a machine that has not yet been patched, which is the detection-and-response layer that matters most in the gap between disclosure and full deployment.

Fourth, the Microsoft Entra ID Conditional Access policies for Guardian customers block corporate resource access from devices that fall below the Intune compliance baseline, so an unpatched device cannot reach Microsoft 365 services once the policy window closes. Fifth, ABT files the June evidence packet into the institution's compliance binder as part of the monthly Guardian operations report, with the specific Intune compliance percentages and Defender remediation status captured for examination evidence. That combination, managed deployment plus continuous monitoring plus filed evidence, is the difference between hoping the fleet is patched and knowing it is.

Frequently Asked Questions

The questions below come up most often from credit union CIOs, community bank IT directors, and mortgage company CTOs during the Patch Tuesday review week. The answers reflect Microsoft canonical guidance and ABT's standard operating practice for the Guardian operating model.

Justin Kirsch

CEO, Access Business Technologies

Justin Kirsch leads Access Business Technologies, the largest Tier 1 Microsoft Cloud Solution Provider dedicated to financial services. For more than twenty-five years he has helped banks, credit unions, and mortgage companies turn the monthly Microsoft Patch Tuesday cycle from a fire drill into a predictable, audit-ready operations rhythm. He writes regularly about how the Microsoft 365 security stack maps to FFIEC, NCUA, OCC, and FDIC examination expectations for more than 750 financial institutions.