On June 9, 2026, Microsoft shipped the largest Patch Tuesday in the program's 23-year history, fixing more than 200 vulnerabilities in a single update. Buried among them was CVE-2026-45657, a Windows Kernel remote code execution flaw carrying a CVSS score of 9.8 — and, according to researchers at the Zero Day Initiative, a "wormable" bug capable of spreading from machine to machine without any user interaction, in the same family of flaws that powered the 2017 WannaCry outbreak. The disclosure landed just days after Check Point confirmed that a separate, actively exploited VPN authentication-bypass vulnerability (CVE-2026-50751) had already been used by a Qilin ransomware affiliate to break into corporate networks. Together, the two stories form a stark snapshot of where enterprise defense stands in mid-2026: record-breaking patch volumes on one side, and live, financially motivated exploitation on the other.
What Happened
CVE-2026-45657 is a use-after-free vulnerability in how the Windows Kernel processes TCP/IP traffic, affecting Windows 11 versions 23H2 through 26H1 on both x64 and ARM64, as well as Windows Server 2022 and 2025, including Server Core installations. Because the flaw sits in network-facing kernel code and requires no authentication or user click, a successful exploit would grant an attacker SYSTEM-level code execution — the highest privilege level on a Windows machine — purely by sending crafted packets to a vulnerable host.
Microsoft itself rated exploitation as "less likely," but multiple independent researchers pushed back on that framing, noting that the gap between a patch's release and the appearance of a working public exploit has been shrinking to a matter of days for kernel-level bugs of this severity. The June update also addressed two other critical zero-days, including an HTTP/2 "bomb" flaw (CVE-2026-49160) and several additional remote code execution issues in TCP/IP, DHCP, and HTTP.sys components — underscoring how much of the modern Windows attack surface still lives in core networking code written decades ago.
The Check Point Connection: A Zero-Day Already in the Wild
While Microsoft's patch addresses a theoretical (if severe) future risk, a second story this week shows what active exploitation actually looks like. Check Point disclosed CVE-2026-50751, a CVSS 9.3 authentication-bypass flaw in its Remote Access VPN and Mobile Access products when configured with the deprecated IKEv1 key exchange protocol. The bug stems from a logic error in how the gateway validates Remote Access and Mobile Access certificates, allowing an unauthenticated attacker to establish a full VPN session without any valid credentials.
- Exploitation began as early as May 7, 2026, and surged in early June — meaning attackers had roughly a month's head start before a patch existed.
- Check Point traced one confirmed intrusion to a Qilin ransomware affiliate, which used a dedicated VPS infrastructure, the Tox messaging protocol for coordination, and the open-source Rclone tool to exfiltrate stolen data.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave U.S. federal civilian agencies until June 11 to remediate — a three-day turnaround reflecting the severity of an unauthenticated VPN bypass.
- Mitigations for organizations that can't patch immediately include disabling legacy IKEv1 clients, forcing IKEv2-only authentication, and making machine-certificate authentication mandatory.
What This Means for Defenders
The juxtaposition of these two stories captures a defining tension in enterprise security: patch velocity versus patch volume. Security teams now face a Patch Tuesday with over 200 line items to triage, prioritize, and test, at the exact moment a separate, unrelated vendor's product is being actively exploited by a ransomware crew that has already had a month inside some victim networks. For most organizations, the realistic response isn't "patch everything by Friday" — it's risk-based triage: internet-facing VPN gateways and kernel-level network stack bugs jump to the front of the queue, while lower-severity desktop application fixes can follow on a normal cadence.
The Check Point case is also a reminder that legacy protocol support is one of the most persistent sources of risk in enterprise infrastructure. IKEv1 has been considered deprecated for years, yet it remained enabled — and exploitable — in production VPN gateways at organizations around the world. Removing legacy protocol support proactively, rather than waiting for a CVE to force the issue, remains one of the highest-leverage and lowest-cost defensive moves available to IT teams.
🔬 TITS Research Perspective
Our cybersecurity research group has long tracked the growing gap between the rate of vulnerability disclosure and organizations' actual remediation capacity — a trend this week's record Patch Tuesday makes vividly concrete. We're particularly interested in the Qilin affiliate's month-long exploitation window before a patch existed, which reinforces a pattern we've observed across 2025–2026 ransomware campaigns: attackers increasingly favor slow, quiet initial access through edge infrastructure (VPNs, firewalls, remote access gateways) over noisy phishing campaigns, precisely because these devices are patched on a slower cycle than endpoints. This is an area where AI-assisted vulnerability triage — automatically correlating CVE severity, exploitability signals, and an organization's actual exposed asset inventory — could meaningfully compress the time-to-patch gap that attackers are exploiting.
Looking Ahead
Expect proof-of-concept exploit code for CVE-2026-45657 to begin circulating within days to weeks, given the intense researcher interest in wormable kernel bugs and the financial incentives for exploit brokers. Organizations running affected Windows Server and Windows 11 builds should treat this patch as a "patch now" item regardless of Microsoft's "less likely" exploitation rating — historically, that label has not been a reliable predictor of how quickly working exploits appear once a patch reveals the underlying flaw.
On the Check Point front, organizations still running IKEv1-based Remote Access VPN configurations should assume compromise is possible if they were exposed during the May–June window, and should audit VPN logs for anomalous sessions established without valid client certificates. As ransomware groups like Qilin continue to professionalize their initial-access tradecraft, the line between "patch management" and "incident response" is increasingly blurred — and the organizations that fare best in 2026 will be the ones that treat edge infrastructure with the same urgency they apply to their most critical internal systems.