Microsoft has released a new batch of security updates for Windows and other supported software that fix a total of 50 security vulnerabilities including six zero-day issues that are said to be exploited in real-world attacks.

The six zero-days are as follows:

CVE-2021-31955 - Windows Kernel Information Disclosure Vulnerability

CVE-2021-31956 - Windows NTFS Elevation of Privilege Vulnerability

CVE-2021-33739 - Microsoft DWM Core Library Elevation of Privilege Vulnerability

CVE-2021-33742 - Windows MSHTML Platform Remote Code Execution Vulnerability

CVE-2021-31199 - Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

CVE-2021-31201 - Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

While Microsoft did not share additional details on vulnerabilities or the nature of attacks exploiting them, researchers from Kaspersky shed some light on a couple of bugs, namely CVE-2021-31955 and CVE-2021-31956. According to the cybersecurity firm, a new threat actor named PuzzleMaker has been observed leveraging these flaws as well as a Google Chrome zero-day exploit chain in highly targeted attacks against companies across the world.

June’s Patch Tuesday release also patches a number of high-risk vulnerabilities affecting Microsoft Defender, Exel, Microsoft Kerberos AppContainer, Microsoft VP9 Video Extensions, Microsoft Office Graphics, and other products.