Microsoft has released its June 2026 Patch Tuesday security updates addressing 200 vulnerabilities, including five publicly disclosed zero-days (CVE-2026-45586, CVE-2026-49160, CVE-2026-45585 , CVE-2026-50507 , and CVE-2020-17103 ) and one actively exploited zero-day vulnerability (CVE-2026-42897 ), which could result in compromise, exposure, and disruption across affected Microsoft products.

These updates apply to, but are not limited to:

• Windows 11

• Microsoft SQL Server 2022, 2025

• Microsoft Office 2021, 2024

• Exchange Server Subscription Edition (SE)

•  Microsoft Edge

Security Risks

Exploitation of these vulnerabilities could enable remote code execution, privilege escalation, security feature bypass, information disclosure, and denial-of-service attacks, with one vulnerability already being actively exploited.  For the full list of security patches released by Microsoft, please refer to the  Microsoft Security Update Guide and apply the necessary updates.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and administrators:

1. Apply the latest security patches as soon as possible to prevent unauthorized control over unpatched systems.

2. Upgrade immediately to the latest supported version of installed Microsoft software to continue receiving technical support and security patches.

The following Microsoft software products reached their end-of-life and need to be upgraded soon:

• Windows Server 2003, 2003 RE, 2008, 2008 RE, 2008 SP2, 2012, and 2012 R2

• Exchange Server 2003, 2007, 2010, 2013, 2016, 2019, and Windows Vista, XP, 8, and 7, 10.

• Microsoft SQL Server 2005, 2008, 2012, 2014, and MS Office 2013, 2016 and 2019.

Additionally, scheduled for end-of-life in 2026; Upgrade recommended before end of support:

• Microsoft SQL Server 2016: July 14, 2026 and Microsoft Office 2021: October 13, 2026

For more information, including other products reaching end-of-support in 2026, see Microsoft’s official documentation.
 

3. Before any updating task, ensure you have a current, tested backup of your data.

For further information and support, please contact the National Cyber Security Authority (NCSA) by emailing rwcsirt@ncsa.gov.rw or calling us on 9009.

References

• Microsoft June 2026 Security Release Notes

• Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws

• Microsoft Ending Support in 2026