June 2026 Patch Tuesday: 206 CVEs, Three Zero-Days, and One Splunk RCE Already Being Exploited

June 2026 Patch Tuesday landed this week as the largest monthly security release of 2026: 206 unique CVEs, 37 rated Critical, and three vulnerabilities that were already publicly known before Microsoft released patches. The one that should be on your radar right now is not a Microsoft product at all.

The actively exploited Splunk RCE

CVE-2026-20253 in Splunk Enterprise is being exploited in the wild. Attackers started using it within days of Splunk’s public disclosure.

The vulnerability lives in a PostgreSQL sidecar service that ships with Splunk Enterprise. An unauthenticated attacker can reach the endpoint and create or truncate arbitrary files on the underlying system. File creation and truncation privileges translate quickly into code execution in most environments — write a cron job, truncate a configuration file, or replace a script that runs with elevated privileges.

Affected: Splunk Enterprise (self-managed), specific versions — check Splunk’s advisory for your version range.
Not affected: Splunk Cloud (patched automatically by Splunk).

If you run self-managed Splunk Enterprise, this is your first stop before anything else this cycle.

# Check your Splunk Enterprise version
/opt/splunk/bin/splunk version

# Apply the update from Splunk's download page
# https://www.splunk.com/en_us/download/splunk-enterprise.html

The CISA Known Exploited Vulnerabilities catalog was updated to include this shortly after exploitation was reported. If your organization follows CISA KEV for prioritization, this is mandatory.

The two 9.8 Windows RCEs

Two separate Windows vulnerabilities earned CVSS 9.8 scores this cycle, both allowing unauthenticated remote code execution with no user interaction.

CVE-2026-45657: Windows Kernel RCE

An attacker who can reach the system over the network can execute code at SYSTEM level. No authentication needed. No user action needed. The attack surface is any Windows system reachable on the network where the kernel component is accessible.

The Windows Kernel is not typically directly exposed to the internet, but domain-joined internal machines are reachable from any compromised internal system. In a post-breach scenario, this becomes a fast lateral movement path.

Who’s affected: Windows 10, Windows 11, Windows Server 2019 and 2022. Check Microsoft’s advisory for the exact build ranges.

CVE-2026-47291: HTTP.sys RCE

This one has broader direct internet exposure. HTTP.sys is the kernel-mode HTTP stack that Windows IIS and many other Windows web services use. An unauthenticated remote attacker can send a malformed request and execute code on the system.

If you run IIS web servers, Windows-hosted APIs, or any other web service that sits behind HTTP.sys, these machines are potentially directly reachable from the internet with a CVSS 9.8 unauth RCE. This is the class of vulnerability that gets weaponized fast.

Patch Windows servers first. Check your exposure:

# Check if HTTP.sys is loaded and which services use it
Get-Service | Where-Object { $_.DisplayName -like "*HTTP*" }
netsh http show servicestate

CVE-2026-32193: Azure Kubernetes Service path traversal

For teams running AKS, this one matters. A CVSS 8.8 path traversal vulnerability in Azure Kubernetes Service allows a low-privileged local attacker — someone with limited access to a container — to traverse to the host and execute code with no further user interaction.

In multi-tenant Kubernetes environments, container escape vulnerabilities are high-value targets. If a workload is compromised (through a dependency vulnerability, an exposed debug endpoint, etc.), a path traversal to the host means the attacker has gone from controlling one pod to potentially controlling the node.

Microsoft patched AKS automatically for managed clusters. If you use self-managed Kubernetes on Azure or are running older AKS versions without auto-updates, verify your cluster version.

# Check AKS cluster version
az aks show --resource-group mygroup --name mycluster --query kubernetesVersion

# Upgrade if needed
az aks upgrade --resource-group mygroup --name mycluster --kubernetes-version 1.30.2

The three publicly disclosed zero-days

Three vulnerabilities in this cycle were publicly known before Microsoft released patches. The Zero Day Initiative review covers all three; the important point is that attackers who watch security research may already have working exploits against these before you’ve patched.

Microsoft’s advisory pages list the “Publicly Disclosed” and “Exploited” flags for each CVE. Check the three flagged ones to see if they affect systems you care about.

The full picture by product

Windows received the most patches at 120, followed by Extended Security Updates at 103 (relevant if you’re still running Windows Server 2012 or Windows 7/8 under the ESU program), Microsoft Office at 54, and Azure and cloud services at 31. The developer tooling category covers Visual Studio, .NET, and related SDK vulnerabilities.

Prioritization guidance

If you’re doing triage this week:

1. Splunk Enterprise CVE-2026-20253 — actively exploited, patch immediately
2. CVE-2026-47291 (HTTP.sys) — CVSS 9.8, internet-facing Windows servers
3. CVE-2026-45657 (Windows Kernel RCE) — CVSS 9.8, internal servers via lateral movement
4. CVE-2026-32193 (AKS path traversal) — CVSS 8.8, relevant for AKS users
5. The three publicly disclosed zero-days — review them against your stack
6. Remaining Critical CVEs — schedule within your normal patch window

The earlier February 2026 security roundup covered the OpenSSL RCE and Foxit zero-days. June is a heavier cycle, and the Splunk exploitation activity makes it more urgent than most.

CISA’s KEV catalog is the authoritative source for what’s being actively used in attacks: cisa.gov/known-exploited-vulnerabilities-catalog. If you haven’t subscribed to the RSS feed or set up alerts for new KEV additions, now is a good time.