On 9 June 2026 Microsoft shipped one of the heavier Patch Tuesdays of the year — close to 200 vulnerabilities, with around 37 rated Critical and three publicly disclosed zero-days. The headline fixes include CVE-2026-47291, an unauthenticated remote-code-execution flaw in the Windows HTTP protocol stack (http.sys); several Hyper-V guest-escape RCEs that let code break out of a VM onto the host; and a BitLocker bypass that undermines full-disk encryption for an attacker with local access.
An unauthenticated http.sys RCE is the kind that gets weaponised quickly against internet-facing Windows servers, and Verizon’s 2026 DBIR already named vulnerability exploitation the number-one breach vector. The window between “patch released” and “exploit in the wild” keeps shrinking.
Knowing about Patch Tuesday isn’t the value — every MSP gets the same email. The value is a managed patch pipeline that tests and deploys within days, not the quarter-end scramble most unmanaged environments run on. For SMBs, that cadence is the single highest-leverage security control there is.