The week of 9 June is over. Here is what happened:
- Microsoft disclosed 198 vulnerabilities including a wormable HTTP.sys RCE, an actively exploited Windows Kernel RCE, and a domain controller Kerberos RCE
- Ivanti published a CVSS 10.0 advisory for an internet-facing MDM gateway
- SAP published a CVSS 9.9 SAML authentication bypass for enterprise ERP
- Veeam published a CVSS 9.4 RCE exploitable by any domain user
- Palo Alto patched PAN-OS command injection
- A Linux kernel container escape PoC was published
- CISA added three entries to the KEV catalogue
- Gentlemen ransomware was confirmed spreading across 66 countries with a worm module
- Langflow CVE-2026-5027 exploitation accelerated with mass scanning campaigns
By the standards of the security industry in 2026, this was a slightly above-average week.
The Capacity Question
Every enterprise security team I am aware of ended this week having made prioritisation decisions under resource constraint. Not every critical vulnerability was patched within recommended timelines. Not every advisory was fully triaged. Some things fell off the list.
The interesting question is not “what did your team miss this week” — that question has an answer that varies by team and will be measured by the breach statistics in Q3. The interesting question is “what does it mean that this is a slightly above-average week and your team had to make prioritisation decisions under resource constraint to get through it?”
It means the threat environment and the capacity of the defender community are mismatched. The misalignment has been present for years; it is getting worse, not better. The number of critical vulnerabilities per month is increasing. The time to weaponisation after disclosure is decreasing. The average enterprise security team size is not growing in proportion to either.
What Good Looked Like This Week
Some organisations did well this week. The distinguishing characteristics:
They had pre-approved emergency patch procedures. When CVE-2026-47291 (wormable HTTP.sys) was disclosed Tuesday morning, the security team did not need to seek change management approval for patching internet-facing servers — they had a pre-approved procedure for CISA KEV and wormable-class vulnerabilities that authorised immediate action. Patching started within hours of the advisory.
They had accurate asset inventories. The critical question for every June 2026 vulnerability was “which systems in our environment are affected?” Organisations with current CMDB data and accurate network inventories answered that question in hours. Organisations with outdated or incomplete inventories spent days in discovery before patching could begin.
They treated Ivanti differently from Microsoft. Organisations that understood the Ivanti pattern — critical vulnerability, immediate exploitation, internet-facing product — applied Ivanti patches at emergency speed without waiting for the normal patch cycle to bring Sentry into scope. Organisations that treated the Ivanti advisory as a routine patch to schedule in the next window were exposed for the entire window.
They had network segmentation in place. When Gentlemen ransomware worm propagation was confirmed, organisations with VLAN segmentation and SMB controls between user and server networks had contained blast radii. Organisations on flat networks reported propagation to the full environment within hours of the initial compromise.
None of these characteristics require extraordinary resources. They require decisions made in advance, documented, and executed consistently. They require treating security infrastructure — asset inventory, network segmentation, patch procedures — as ongoing operational requirements rather than projects to be completed eventually.
The Signal for Next Week
There are always more vulnerabilities next week. The Microsoft July Patch Tuesday is five weeks away. Between now and then, out-of-band advisories will arrive for vendors who cannot wait for the monthly cycle. Ransomware operators are incorporating this week’s Veeam and Ivanti vulnerabilities into their toolkits.
The organisations that used this week’s pressure as a catalyst to fix their emergency patch procedure, their asset inventory gap, or their network segmentation will be better positioned for the next week like this one. The organisations that managed this week’s backlog and returned to normal mode until July Patch Tuesday will find July familiar.
The choice is made in the quiet weeks.
Share this article