Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs
Summary: Microsoft released fixes for a record 206 vulnerabilities on Tuesday, including 39 rated Critical and 167 rated Important, among them three publicly disclosed zero-days. The set covers 56 remote code execution and 63 privilege escalation flaws, led by CVE-2026-45657 (CVSS 9.8), a Windows Kernel use-after-free that Microsoft says can be triggered by specially crafted network traffic to run code with system-level privileges without user interaction.
Bottom line: CVE-2026-44815 needs no credentials or user action and turns DHCP network traffic into a full system compromise, so systems handling DHCP traffic are high-priority patch targets. TrendAI's Dustin Childs notes Microsoft's CVE count this year already exceeds all of 2018, and that volume raises the question of what quality issues may exist in the patches themselves.