Full Report
32Critical166Important0Moderate0LowMicrosoft addresses 198 CVEs in the largest Patch Tuesday release, including three zero-days.Microsoft patched 198 CVEs in its June 2026 Patch Tuesday release, with 32 rated critical and 166 rated as important. Our counts omitted 6 CVEs that were already addressed by Microsoft via servicing and do not require additional customer action to resolve as well as 2 CVEs that were disclosed by other CNAs (CVE-2025-10263 and CVE-2026-8863). This Patch Tuesday release is the largest release since the Patch Tuesday program began, smashing the previous record of 167 CVEs in the October 2025 Patch Tuesday release.This month’s update includes patches for:.NETASP.NET CoreActive Directory Domain ServicesAzure HorizonDBAzure Stack EdgeCopilot Chat (Microsoft Edge)Function Discovery Service (fdwsd.dll)GitHub Copilot and Visual Studio CodeHTTP/2Linux MANA DriverM365 CopilotMicrosoft Azure Attestation service and Device Health Attestation ServiceMicrosoft Azure Kubernetes ServiceMicrosoft BingMicrosoft CopilotMicrosoft Defender for EndpointMicrosoft Dynamics 365 (on-premises)Microsoft Exchange OnlineMicrosoft Exchange ServerMicrosoft GraphMicrosoft Graphics ComponentMicrosoft KinectMicrosoft Live Share Canvas SDKMicrosoft OfficeMicrosoft Office Click-To-RunMicrosoft Office ExcelMicrosoft Office ProjectMicrosoft Office SharePointMicrosoft Office WordMicrosoft PC ManagerMicrosoft PowerToysMicrosoft Teams for AndroidMicrosoft UxTheme Library (uxtheme.dll)Microsoft Windows DNSNuance PowerScribeOffice for AndroidRemote Desktop ClientRole: Windows Hyper-VUI Automation Manager (uiamanager.dll)Universal Plug and Play (upnp.dll)Visual Studio CodeWindows Administrator ProtectionWindows Ancillary Function Driver for WinSockWindows Application Identity (AppID) SubsystemWindows BitLockerWindows Bluetooth Port DriverWindows Bluetooth ServiceWindows Boot ManagerWindows Collaborative Translation FrameworkWindows Common Log File System DriverWindows Cryptographic ServicesWindows DHCP ClientWindows DHCP ServerWindows DWM Core LibraryWindows Deployment ServicesWindows HTTP.sysWindows Hotpatch Monitoring ServiceWindows Hyper-VWindows Internet (wininet.dll)Windows KerberosWindows KernelWindows Kernel-Mode DriversWindows Mark of the Web (MOTW)Windows MediaWindows NT OS KernelWindows NTFSWindows Narrator BrailleWindows Network Controller (NC) Host AgentWindows Performance MonitorWindows Program Compatibility Assistant ServiceWindows Projected File System Filter DriverWindows Push NotificationsWindows RDPWindows SDKWindows Secure BootWindows ShellWindows StorageWindows TCP/IPWindows Telephony ServiceWindows UEFIWindows Universal Disk Format File System Driver (UDFS)Windows Win32K - GRFXWinlogonElevation of Privilege (EoP) vulnerabilities accounted for 31.8% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.3%.ImportantCVE-2026-50507 | Windows BitLocker Security Feature Bypass VulnerabilityCVE-2026-50507 is a security feature bypass vulnerability affecting Windows BitLocker. It received a CVSSv3 score of 6.8 and is rated as important. It was publicly disclosed prior to a patch being available and assessed as “Exploitation More Likely” according to Microsoft's Exploitability Index.According to Microsoft, an attacker with physical access to the system could bypass the BitLocker Device Encryption feature in order to gain access to the device's encrypted data. This vulnerability appears to be the flaw known as Bitskrieg and a collaboration between Chaotic Eclipse (Nightmare Eclipse) and Jonas L.ImportantCVE-2026-49160 | HTTP.sys Denial of Service VulnerabilityCVE-2026-49160 is a denial of service (DoS) vulnerability affecting HTTP.sys. It received a CVSSv3 score of 7.5 and is rated as important. It was assessed as “Exploitation More Likely” and publicly disclosed prior to a patch being available. According to the advisory, this DoS affects HTTP/2. The advisory notes that this update adds a MaxHeadersCount registry setting which can be used to limit the number of headers included in HTTP/2 and HTTP/3 requests.Dubbed HTTP/2 Bomb by researchers at Calif, which is credited by Microsoft for reporting the DoS, their blog describes the technical details and provides a proof-of-concept which can be used to test web servers against this vulnerability. As noted in the blog post, at the time it was released, Microsoft had not yet released patches.ImportantCVE-2026-45586 | Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege VulnerabilityCVE-2026-45586 is an EoP vulnerability affecting Windows Collaborative Translation Framework (CTFMON), a process that supports voice and handwriting recognition. It was assigned a CVSSv3 score of 7.8 and rated as important. This EoP flaw was one of three zero-days disclosed prior to patches being made available. Successful exploitation would grant an attacker SYSTEM privileges and Microsoft has assessed this vulnerability as “Exploitation More Likely.”CriticalCVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799, CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-47654 and CVE-2026-48563 | Remote Desktop Client Remote Code Execution VulnerabilityCVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799, CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-47654 and CVE-2026-48563 are RCE vulnerabilities affecting Remote Desktop Client. CVSSv3 scores ranged from 8.8 (CVE-2026-42985, CVE-2026-47289 and CVE-2026-47653) to 7.5 and seven were rated as critical while CVE-2026-42993, CVE-2026-42909, CVE-2026-47653 and CVE-2026-42913 were rated as important. Successful exploitation would require a victim to connect to an attacker controlled server using an affected version of the Remote Desktop Client. This action could trigger a heap-based buffer overflow, resulting in remote code execution.While no public details have been released about these vulnerabilities as of June 9, Microsoft has assessed CVE-2026-42985 as “Exploitation More Likely” while the other CVEs were classified as either “Exploitation Unlikely” or “Exploitation Less Likely.” Patches are available for supported versions of Windows and Windows Server.Out Of Band UpdatesWhile these updates were released prior to the Patch Tuesday release on June 9, they were outside the window for the May release and are noted here as they are significant.ImportantCVE-2026-41091 | Microsoft Defender Elevation of Privilege VulnerabilityCVE-2026-41091 is an EoP vulnerability in Microsoft Defender. It received a CVSSv3 score of 7.8 and is rated important. An unprivileged attacker could exploit this vulnerability by writing a specially crafted file to a privileged location. Successful exploitation would result in Microsoft Defender writing the file back to the privileged location, gaining privileges as SYSTEM.According to reports, CVE-2026-41091 is RedSun, a zero-day vulnerability disclosed by a researcher named Chaotic Eclipse or Nightmare Eclipse on April 15, 2026. This researcher has also published several additional zero-days recently, including BlueHammer (CVE-2026-33825), GreenPlasma, MiniPlasma and collaborated on Bitskrieg (CVE-2026-50507). It has since been exploited in the wild and added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (CISA KEV) catalog on May 20.ImportantCVE-2026-45585 | Windows BitLocker Security Feature Bypass VulnerabilityCVE-2026-45585 is a security feature bypass vulnerability affecting Windows BitLocker. It received a CVSSv3 score of 6.8 and is rated as important. This vulnerability is known as YellowKey, named by the researcher known as Chaotic Eclipse or Nightmare Eclipse.A proof-of-concept (PoC) was made public on May 13, prompting Microsoft to publish the original advisory and CVE identifier on May 19th, offering mitigation guidance.Exploitation does require physical access to the device, however Microsoft has assessed this vulnerability as “Exploitation More Likely.”Tenable SolutionsA list of all the plugins released for Microsoft’s June 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.Get more informationMicrosoft's June 2026 Security UpdatesTenable plugins for Microsoft June 2026 Patch Tuesday Security UpdatesJoin Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.
Analysis Summary
# Vulnerability: Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege
## CVE Details
- **CVE ID:** CVE-2026-45586
- **CVSS Score:** 7.8 (Important)
- **CWE:** Not specified (Elevation of Privilege)
## Affected Systems
- **Products:** Windows OS components supporting voice and handwriting recognition.
- **Versions:** Supported versions of Windows and Windows Server.
- **Configurations:** Systems running the Collaborative Translation Framework (CTFMON) process.
## Vulnerability Description
This is a zero-day elevation of privilege (EoP) vulnerability in the Windows Collaborative Translation Framework (CTFMON). The flaw exists in the process responsible for handling voice and handwriting recognition input. An attacker who successfully exploits this vulnerability can elevate their privileges on the local system.
## Exploitation
- **Status:** Zero-day; publicly disclosed prior to a patch being available. Microsoft assesses this as "Exploitation More Likely."
- **Complexity:** Medium (assumed for EoP via specific framework).
- **Attack Vector:** Local (requires the attacker to have an initial foothold on the system).
## Impact
- **Confidentiality:** High (Full access to system data).
- **Integrity:** High (Ability to modify system files).
- **Availability:** High (Ability to disable security or system functions).
- **Note:** Successful exploitation grants the attacker **SYSTEM** privileges.
## Remediation
### Patches
- Apply the June 2026 Patch Tuesday security updates available via Microsoft Update or the MSRC Update Guide.
### Workarounds
- No specific workarounds provided; immediate patching is recommended as this was a zero-day.
---
# Vulnerability: HTTP.sys Denial of Service ("HTTP/2 Bomb")
## CVE Details
- **CVE ID:** CVE-2026-49160
- **CVSS Score:** 7.5 (Important)
- **CWE:** Not specified (Denial of Service)
## Affected Systems
- **Products:** Windows Server, Windows Desktop.
- **Versions:** Systems utilizing `HTTP.sys` for web services.
- **Configurations:** Specifically affects servers with HTTP/2 (and potentially HTTP/3) enabled.
## Vulnerability Description
Dubbed "HTTP/2 Bomb," this is a denial of service vulnerability in the Windows HTTP protocol stack (`HTTP.sys`). It allows an attacker to overwhelm a web server by sending specifically crafted HTTP/2 headers.
## Exploitation
- **Status:** Publicly disclosed prior to patch; Proof-of-Concept (PoC) available. Microsoft assesses as "Exploitation More Likely."
- **Complexity:** Low.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** None.
- **Integrity:** None.
- **Availability:** High (System/Service crash or unresponsiveness).
## Remediation
### Patches
- Apply the Microsoft June 2026 security updates.
### Workarounds
- **Registry Mitigation:** The update introduces a `MaxHeadersCount` registry setting. Administrators can manually configure this to limit the number of headers in HTTP/2 and HTTP/3 requests to mitigate header-based flood attacks.
---
# Vulnerability: Windows BitLocker Security Feature Bypass ("Bitskrieg" & "YellowKey")
## CVE Details
- **CVE ID:** CVE-2026-50507 (Bitskrieg), CVE-2026-45585 (YellowKey)
- **CVSS Score:** 6.8 (Important)
- **CWE:** Not specified (Security Feature Bypass)
## Affected Systems
- **Products:** Windows BitLocker.
- **Versions:** All supported Windows versions using BitLocker Device Encryption.
## Vulnerability Description
These vulnerabilities allow an attacker to bypass BitLocker Device Encryption. CVE-2026-50507 (Bitskrieg) was a collaboration between researchers "Chaotic Eclipse" and Jonas L. CVE-2026-45585 (YellowKey) was a separate flaw discovered by "Chaotic Eclipse."
## Exploitation
- **Status:** Publicly disclosed; PoC available for YellowKey (as of May 13). "Exploitation More Likely."
- **Complexity:** Medium.
- **Attack Vector:** Physical (Requires hands-on access to the device).
## Impact
- **Confidentiality:** High (Access to encrypted data on the disk).
- **Integrity:** None.
- **Availability:** None.
## Remediation
### Patches
- Apply the June 2026 security updates.
### Detection
- Monitor for unauthorized physical access to hardware and ensure "Secure Boot" and UEFI protections are strictly enforced.
## References
- Microsoft June 2026 Security Updates: hxxps://msrc[.]microsoft[.]com/update-guide/en-us/releaseNote/2026-Jun
- Tenable Blog: hxxps://www[.]tenable[.]com/blog/microsofts-june-2026-patch-tuesday-addresses-198-cves-cve-2026-49160-cve-2026-50507