Full Report
Today is Microsoft's June 2026 Patch Tuesday, with security updates for 200 flaws and three publicly disclosed zero-day vulnerabilities. [...]
Analysis Summary
# Vulnerability: Microsoft June 2026 Patch Tuesday Zero-Days
## CVE Details
- **CVE ID:** CVE-2026-45586, CVE-2026-49160, CVE-2026-50507
- **CVSS Score:** N/A (Not explicitly listed in source, but classified as "Critical" or "Important" by Microsoft)
- **CWE:**
- CVE-2026-45586: CWE-59 (Link Following)
- CVE-2026-49160: CWE-400 (Uncontrolled Resource Consumption)
- CVE-2026-50507: Protection Mechanism Failure
## Affected Systems
- **Products:**
- Windows Operating System (Multiple versions)
- Windows Collaborative Translation Framework (CTFMON)
- HTTP Server (HTTP.sys)
- Windows BitLocker
- **Versions:** Applicable to supported Windows 10, Windows 11, and Windows Server versions.
- **Configurations:** HTTP/2 and HTTP/3 enabled servers; BitLocker-encrypted drives.
## Vulnerability Description
This summary covers the three publicly disclosed zero-day vulnerabilities addressed in the June 2026 update cycle:
1. **CVE-2026-45586 (CTFMON EoP):** An improper link resolution (link following) flaw in the Windows Collaborative Translation Framework. It allows an authorized attacker to escalate privileges to SYSTEM by manipulating file access.
2. **CVE-2026-49160 (HTTP/2 Bomb):** A denial-of-service vulnerability in HTTP.sys. Attackers abuse HTTP/2 header compression/management, sending small data packets that force the server to allocate massive amounts of memory, potentially crashing the server or causing significant performance degradation.
3. **CVE-2026-50507 (BitLocker Bypass):** Known as the "YellowKey" vulnerability, this flaw allows an attacker with physical access to bypass BitLocker encryption and access protected data.
## Exploitation
- **Status:** Publicly disclosed; not yet observed in the wild. PoC available for CVE-2026-50507.
- **Complexity:**
- CVE-2026-45586/49160: Low to Medium.
- CVE-2026-50507: Requires physical access.
- **Attack Vector:**
- CVE-2026-45586: Local
- CVE-2026-49160: Network
- CVE-2026-50507: Physical
## Impact
- **Confidentiality:** High (BitLocker Bypass)
- **Integrity:** High (Elevation of Privilege to SYSTEM)
- **Availability:** High (HTTP/2 Server Crash)
## Remediation
### Patches
- Apply the June 2026 cumulative updates (e.g., KB5094126, KB5093998 for Windows 11).
### Workarounds
- **For CVE-2026-49160 (HTTP/2 Bomb):** Use the newly introduced `MaxHeadersCount` registry setting to limit the number of headers in HTTP/2 and HTTP/3 requests. Refer to Microsoft support bulletin KB5102602.
## Detection
- **Indicators of compromise:** Monitor for unexpected spikes in memory usage on web servers (HTTP.sys). Monitor for suspicious local file system link creation by CTFMON.
- **Detection methods and tools:** Review Windows Event Logs for BitLocker access attempts and check for unusually high memory allocation in the `System` process related to networking.
## References
- hxxps://msrc.microsoft[.]com/update-guide/en-US/advisory/CVE-2026-45586
- hxxps://msrc.microsoft[.]com/update-guide/en-US/advisory/CVE-2026-49160
- hxxps://msrc.microsoft[.]com/update-guide/en-US/advisory/CVE-2026-50507
- hxxps://support.microsoft[.]com/en-us/topic/084da156-7a99-4abf-b759-f973c35eded3