Wednesday, June 10, 2026
Daily digest
June 2026 Patch Tuesday is the dominant story today: a record 206 CVEs patched, three actively exploited zero-days including two SYSTEM-privilege escalations and a BitLocker bypass, plus a fourth unpatched Defender zero-day (RoguePlanet) dropped publicly hours after the update. Treat this as an all-hands patching event.
Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs
Microsoft's June 2026 Patch Tuesday addressed 206 CVEs — a new record — including 39 rated Critical and three publicly disclosed zero-days. The zero-days include two local privilege escalation flaws (YellowKey, GreenPlasma) that grant SYSTEM privileges on fully patched Windows, and a third (MiniPlasma) that bypasses BitLocker-protected drive encryption. Patch Tuesday also covered 56 remote code execution bugs across the Windows ecosystem.
Why it matters: YellowKey and GreenPlasma are actively exploited LPE bugs on fully patched Windows 11 — your Intune-managed fleet needs these updates deployed immediately. MiniPlasma's BitLocker bypass is particularly acute in a CMMC L2 environment where drive encryption is a baseline control; confirm KB5094126 is installed across all endpoints before EOD.
Microsoft Defender 'RoguePlanet' Zero-Day Grants SYSTEM Privileges — No Patch Yet
A researcher publicly released a proof-of-concept exploit for a new Microsoft Defender zero-day dubbed RoguePlanet, which leverages a race condition to achieve SYSTEM-level code execution on fully patched Windows systems. The exploit was dropped hours after June Patch Tuesday, meaning it is currently unpatched. The researcher reported a 100% success rate under certain conditions despite the race-condition nature of the bug.
Why it matters: Defender is the default AV on your Windows 11 fleet and this exploit is public with no patch available. Enable Attack Surface Reduction rules, monitor for anomalous SYSTEM-level process creation from Defender service processes, and watch for an out-of-band patch — this will move fast.
Microsoft: Some Windows PCs Fail to Install Latest Monthly Updates
Microsoft warned that devices upgraded to Windows 11 24H2 or 25H2 may silently fail to install June 2026 Patch Tuesday updates. The failure affects a subset of upgraded (not clean-installed) systems and does not always surface a visible error to the end user.
Why it matters: With three actively exploited zero-days in this patch cycle, silent update failures on upgraded endpoints are a direct compliance and security risk. Run an Intune compliance report filtering on KB5094126 installation status to identify affected machines — don't assume deployment success.
Ivanti: Max-Severity Sentry Flaws Allow Unauthenticated RCE as Root
Ivanti disclosed and patched two critical vulnerabilities in its Sentry secure mobile gateway, including a CVSS 10.0 flaw enabling remote, unauthenticated code execution with root privileges and a second rated 9.9. No authentication or user interaction is required to exploit the leading flaw. Ivanti is urging customers to patch immediately.
Why it matters: Ivanti appliances have been repeatedly targeted in campaigns against government and defense contractors. If Sentry is in your environment or your mobile management stack, this is patch-now territory; unauthenticated root RCE on an internet-facing gateway is a direct path to CUI-adjacent systems.
Veeam Backup & Replication RCE Flaw (CVE-2026-44963, CVSS 9.4) Lets Domain Users Run Remote Code
Veeam patched CVE-2026-44963, a critical RCE vulnerability in Backup & Replication that allows any authenticated domain user to execute arbitrary code on the backup server. The flaw carries a CVSS score of 9.4 and was addressed in a Tuesday advisory alongside several lower-severity issues.
Why it matters: Veeam is a common backup platform in Nutanix AHV environments. Any authenticated domain user — including compromised service accounts — can pivot to your backup infrastructure, which likely holds credentials, recovery keys, and snapshots of CUI-containing systems. Patch and review Veeam service account privilege levels.
Miasma Supply Chain Worm Compromises 73 Microsoft GitHub Repositories; Toolkit Now Open Source
A supply chain worm dubbed Miasma infected 73 Microsoft open-source GitHub repositories, injecting an information stealer into the codebase. Microsoft temporarily took affected repos offline while investigating; some have been restored. Separately, the Miasma attack toolkit has been published publicly on GitHub, and a related campaign called Hades poisoned 19 PyPI packages with a credential stealer that executes automatically on install.
Why it matters: If any Ansible roles, automation pipelines, or containerized workloads pull dependencies from affected Microsoft repos or PyPI, audit your dependency manifests and build logs for the affected packages. The public release of the Miasma toolkit means commodity threat actors can now replicate these attacks.
ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances
ServiceNow disclosed a security incident in which attackers exploited an unauthenticated API endpoint vulnerability to query data from customer-hosted instances. An emergency patch was applied to hosted instances on June 5, 2026, but on-premises and self-hosted customers must apply the update manually. The full scope of data accessed has not been publicly detailed.
Why it matters: If your organization uses ServiceNow for ITSM, asset management, or workflow automation — including any GRC or CMMC evidence-tracking workflows — verify whether your instance is hosted or self-managed and confirm the June 5 patch has been applied.
Chrome V8 Zero-Day CVE-2026-11645 Actively Exploited in the Wild
Google released Chrome 149.0.7827.103 patching 74 vulnerabilities, including CVE-2026-11645, an out-of-bounds read/write in the V8 JavaScript engine rated CVSS 8.8 that is confirmed exploited in the wild. This is the fifth Chrome zero-day exploited so far in 2026. Google paid the reporting researcher a $55,000 bounty.
Why it matters: Confirm Intune compliance policies are enforcing Chrome version floors and that auto-update is not blocked by GPO on any endpoint. V8 exploits are reliable browser-based initial access vectors — especially relevant if users access GCC High portals or web-based admin consoles via Chrome.
Microsoft Exchange 'Ghost-Sender' Flaw Lets Attackers Spoof Any Email Address
A vulnerability in Microsoft Exchange allows attackers to spoof arbitrary email addresses by routing messages through Exchange Online or on-premises Exchange in hybrid mode combined with a third-party mail server or spam filter. The technique bypasses standard sender-verification controls and was included in the June 2026 Patch Tuesday release.
Why it matters: GCC High tenants using hybrid Exchange or third-party mail hygiene appliances (e.g., Proofpoint, Mimecast) in front of Exchange Online are in the specific attack path described. Verify the patch is applied and review hybrid connector configurations for overly permissive relay settings.
New CISA Directive Would Reshape How Agencies Prioritize Cyber Risk
CISA is developing a new binding operational directive that would shift federal agencies away from time-based patch SLAs toward a consequence-driven triage model, prioritizing vulnerabilities based on the real-world impact of a successful exploit rather than CVSS score or disclosure date alone. Acting CISA Director Nick Andersen described the change as part of a broader 'ruthless prioritization' strategy for federal cyber defense.
Why it matters: Defense contractors operating under CMMC L2 often align vulnerability management timelines to CISA KEV and BOD deadlines. A consequence-based prioritization model from CISA could influence how DIBCAC assessors evaluate your vulnerability management program under NIST 800-171 RA.3.139 — worth tracking as this directive takes shape.
HCP Packer Adds Enforced Provisioners for Mandatory Build Steps
HashiCorp's HCP Packer now supports enforced provisioners, allowing platform and security teams to centrally mandate specific provisioning steps — such as security hardening scripts or compliance checks — that must run on every image build regardless of individual team configurations. The feature is designed for organizations that need policy-level control over golden image pipelines.
Why it matters: If you use Packer to build hardened VM images for Nutanix AHV or AWS GovCloud, enforced provisioners let you guarantee STIG or CIS benchmark scripts run on every build — closing a common drift gap where individual teams skip hardening steps. Worth evaluating as a compliance guardrail in your image pipeline.
Microsoft Publishes AI Activity Investigation Playbook for M365 Copilot and Azure AI
Microsoft's Security Blog released a structured playbook for investigating AI-related activity in Microsoft 365 Copilot and Azure AI services, covering telemetry sources, event reconstruction, data exposure assessment, and threat detection methodology. The guide is aimed at security operations teams handling incidents involving AI workloads.
Why it matters: As M365 Copilot rolls out in GCC High environments, your incident response procedures need to account for AI-generated data access and exfiltration paths. This playbook is directly applicable to building those IR runbooks before an incident requires them.