206 CVEs and a Wormable Kernel RCE

A sysadmin at a mid-size financial firm opens their vulnerability scanner dashboard on Tuesday morning, June 9th. The number staring back at them: 206 new Microsoft CVEs, including a kernel-level bug that can propagate itself across the network like it's 2017 and WannaCry just dropped. No user click required. No authentication. Just a malformed TCP packet and full SYSTEM-level code execution.

This is not a drill. Microsoft's June 2026 Patch Tuesday shattered every previous record, eclipsing October 2025's already-brutal 167 CVEs. Buried in that mountain of patches are five CVSS 9.0+ remote code execution flaws, three publicly disclosed zero-days, and a kernel vulnerability that Microsoft itself classified as wormable.

The Big One: CVE-2026-45657 — Wormable Kernel RCE

CVE-2026-45657 is the one that should have every defender's hair standing up. It is a use-after-free flaw (CWE-122) in the Windows Kernel's TCP/IP processing stack, scoring a perfect CVSS 9.8.

Here is why it matters: the vulnerable code path sits inside the kernel's TCP/IP handler — the layer that processes raw network packets before any user-space firewall, EDR, or application-layer security control ever sees them. An unauthenticated attacker on the internet sends a specially crafted TCP packet, the kernel processes it, references freed memory, and the attacker controls what occupies that reclaimed region. Execution redirects to their payload. Game over — SYSTEM-level access, no clicks, no credentials.

Microsoft flagged this as wormable under certain network configurations. That word — wormable — carries weight. It means a successful exploit can self-propagate to adjacent vulnerable machines without human assistance. Think EternalBlue and WannaCry, except targeting the kernel's TCP/IP stack directly rather than SMBv1.

A malformed TCP packet bypasses user-space defenses to trigger a use-after-free in the kernel's networking stack.

Affected Systems

The blast radius is enormous:

• Windows 11 (23H2, 24H2, 25H2, 26H1) — x64 and ARM64
• Windows Server 2022 and Windows Server 2025 (including Server Core)