Microsoft's June Patch Tuesday: 200+ vulnerabilities amid researcher tensions

Microsoft's June Patch Tuesday arrived this week carrying the weight of more than 300 browser vulnerabilities—a staggering number that has forced the company to stop listing Chromium CVEs individually in its official Security Update Guide. But the raw count of patches tells only half the story. Running parallel to this surge in vulnerability reports is an escalating conflict between the software giant and an independent researcher operating under the pseudonym Nightmare Eclipse, who has spent recent weeks publishing detailed exploits for Microsoft flaws that remain unpatched, complete with working proof-of-concept code.

The scale of what Microsoft is addressing this month is genuinely unusual. Browser vulnerabilities alone represent an order of magnitude increase over typical monthly volumes from recent years. The spike reflects a broader shift in how vulnerabilities are being discovered: artificial intelligence is now assisting researchers in probing not just individual software packages, but the underlying standards those packages implement. Linux kernel vulnerabilities are experiencing a similar surge. This acceleration has outpaced Microsoft's ability to track and enumerate every flaw in its traditional reporting channels.

Nightmare Eclipse's campaign began weeks ago with the disclosure of six Microsoft vulnerabilities, several of them elevation-of-privilege flaws affecting Windows Defender and a critical bypass in Secure Boot disk encryption. The researcher provided complete working code for some exploits and substantial—though deliberately incomplete—technical detail for others. Microsoft confirmed these disclosures were uncoordinated, and the relationship between vendor and researcher has deteriorated sharply. Two of the initial disclosures landed in the hours immediately following last month's Patch Tuesday, a timing choice that maximized public visibility while minimizing Microsoft's window to respond without emergency out-of-cycle patches.

As of now, Microsoft has patched four of the disclosed vulnerabilities: CVE-2026-33825, CVE-2026-45585, CVE-2026-45498, and CVE-2026-41091. Two elevation-of-privilege flaws—internally nicknamed MiniPlasma and GreenPlasma—remain unpatched. But Nightmare Eclipse's recent cryptic blog post, titled simply "7" and containing only an image of Albert Vesker, a character from Resident Evil who worked as a corporate researcher before turning rogue, strongly suggests at least one more vulnerability is coming. Hours after Microsoft published this month's Patch Tuesday updates, a seventh disclosure appeared: a flaw called RoguePlanet, which describes another path to SYSTEM-level privilege escalation in Defender.

The tension between Microsoft and the research community has become impossible to ignore. In late May, Microsoft's Digital Crimes Unit issued a blog post that many in the security community interpreted as a warning to researchers—a move that has sparked genuine concern among leading voices in vulnerability disclosure. The worry is straightforward: if researchers fear legal consequences for responsible disclosure, they may simply stop reporting flaws to vendors altogether. Microsoft issued a clarification days later, stating it has no intention of pursuing researchers engaged in legitimate security work, only those who break laws or cause direct harm. The distinction has done little to ease the underlying tension.

Beyond the Nightmare Eclipse saga, Microsoft is grappling with other emerging vulnerability classes. A new category of denial-of-service flaws affecting HTTP/2 and HTTP/3 implementations is expanding rapidly as researchers use large language models to probe the standards themselves, not just the software built on them. CVE-2026-49160 exemplifies this trend, with credits going to both a third-party research firm and OpenAI's Codex. More immediately concerning is CVE-2026-49975, known as HTTP/2 Bomb, which became public a week ago. This flaw allows trivial denial-of-service attacks against default HTTP/2 configurations on multiple platforms, including Microsoft's own IIS web server. Unlike distributed denial-of-service attacks, exploitation requires no significant bandwidth—only the ability to exhaust server memory. Patches exist for NGINX and Apache; IIS patches are presumably forthcoming. For now, disabling HTTP/2 entirely remains a valid mitigation.

One more detail worth noting: Microsoft PowerToys, a utility offering advanced configuration options for Windows power users, contained an undocumented elevation-of-privilege vulnerability, CVE-2026-42902, that was silently patched in version 0.99.1 on April 29 without mention in release notes. Attackers with patch-diffing tools will likely notice this discrepancy and begin reverse-engineering the fix. What began as a routine monthly patch cycle has become a multifaceted crisis of discovery, disclosure, and trust—one that shows no signs of resolution.