Loading story…
Microsoft released its June Patch Tuesday updates to address more than 200 vulnerabilities across Windows, .NET, Office, Teams, Exchange Server, Azure, Visual Studio Code, and other products, including three publicly disclosed zero-days: CVE-2026-45586 in the Windows Collaborative Translation Framework (CTFMON), CVE-2026-49160 in HTTP.sys, and CVE-2026-50507 in Windows BitLocker. The update covered a broad range of impact types, including elevation of privilege, spoofing, denial of service, security feature bypass, information disclosure, and remote code execution, with notable high-severity issues such as CVE-2026-44815, a DHCP Client Service RCE flaw rated CVSS 9.8, and CVE-2026-47281, a Visual Studio Code elevation-of-privilege bug rated CVSS 9.6.
Researchers described the release as part of a wider 2026 "patch tsunami," estimating roughly 198 to 208 Microsoft CVEs in the June cycle and about 571 CVEs overall when Chromium and other third-party issues were included, with 38 rated critical. One of the zero-days, CVE-2026-49160, was detailed as an HTTP/2 and HTTP/3 header compression flaw that can trigger resource exhaustion through a "compression bomb," and Microsoft added a MaxHeadersCount registry mitigation; the bug was reportedly credited to OpenAI Codex, underscoring claims that AI-assisted discovery is accelerating vulnerability reporting and increasing patch-management pressure on enterprises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
HiSolutions reported that Microsoft credited OpenAI Codex with reporting CVE-2026-49160, highlighting AI-assisted vulnerability discovery as part of the June 2026 disclosure wave.
In connection with the June 2026 Patch Tuesday coverage, HiSolutions said Microsoft introduced a MaxHeadersCount registry mitigation for the publicly disclosed zero-day CVE-2026-49160 affecting HTTP/2 and HTTP/3 header compression handling.
On 2026-06-10, Microsoft released its June 2026 Patch Tuesday security updates, addressing 206 vulnerabilities across products including Windows, .NET, Office, Teams, Exchange Server, Azure, and Visual Studio Code. The release included three publicly disclosed zero-days: CVE-2026-45586, CVE-2026-49160, and CVE-2026-50507.
HiSolutions reported that Cisco PSIRT knew of limited exploitation of the critical Cisco Catalyst SD-WAN Controller authentication flaw CVE-2026-20182 in May 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its largest Patch Tuesday update to date, fixing **206 vulnerabilities** across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included **three publicly disclosed zero-days**, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw `CVE-2026-41091`. Publicly disclosed issues in the June bundle included `CVE-2026-50507`, a **BitLocker** security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and `CVE-2026-45586`, a **Windows CTFMON** elevation-of-privilege flaw that could let a low-privileged local attacker gain **SYSTEM** access. JPCERT/CC also warned that Microsoft disclosed active exploitation of `CVE-2026-42897`, a spoofing flaw in **Microsoft Exchange Server**.
Jul 3, 2026
Microsoft’s March 2026 Patch Tuesday shipped fixes for **79 vulnerabilities**, including **two zero-day flaws**. Public reporting and third-party patch reviews highlight a mix of *Important* and *Critical* issues across Microsoft’s ecosystem, including **.NET** (`CVE-2026-26127` DoS; `CVE-2026-26131` EoP), **Active Directory Domain Services** (`CVE-2026-25177` EoP), **ASP.NET Core** (`CVE-2026-26130` DoS), and multiple Azure components such as **ACI Confidential Containers** (`CVE-2026-23651`, `CVE-2026-26124` EoP; `CVE-2026-26122` information disclosure) and **Azure IoT Explorer** (`CVE-2026-26121` spoofing; `CVE-2026-23661/23662/23664` information disclosure). Independent analysis (ZDI and SANS ISC) corroborated the breadth of affected products and provided additional scoring/metadata, including CVSS ratings and exploitability flags. ZDI’s review also called out additional *Critical* items in the release such as **Microsoft Office RCE** (`CVE-2026-26110`, `CVE-2026-26113`) and other high-impact vulnerabilities, while SANS ISC’s Patch Tuesday coverage additionally noted bundled **Chromium**-tracked fixes (multiple `CVE-2026-3536` through `CVE-2026-3544` entries) that commonly map to Microsoft’s browser/embedded Chromium components. Organizations should prioritize patching systems exposed to untrusted content or authentication boundaries (e.g., Office, AD DS, Azure agents/extensions) and validate deployment coverage across both Windows and cloud-connected workloads.
Jun 29, 2026
Microsoft’s June 2026 Patch Tuesday delivered a record-setting security release, with reports citing **206 to 208 CVEs** addressed across Windows, Office, Azure, SQL Server, and other products, including **32 critical** issues. Among the most urgent were multiple **Remote Desktop Client** remote code execution flaws—`CVE-2026-42985`, `CVE-2026-47289`, `CVE-2026-44801`, `CVE-2026-44799`, and `CVE-2026-48563`—that could let an attacker run code on a victim system if the user connected to a malicious Remote Desktop Server or accepted a specially crafted RDP certificate. Microsoft rated `CVE-2026-42985` as **more likely** to be exploited, while the others were assessed as less likely at publication; several of the bugs were credited to Kyeongmin Kim of KAIST Hacking Lab. Microsoft also disclosed **`CVE-2026-47291`**, a critical **HTTP.sys** remote code execution vulnerability with a **CVSS 9.8** score that can be exploited remotely without authentication or user interaction by sending a specially crafted packet to a server using the Windows HTTP Protocol Stack. Microsoft said systems using the default `MaxRequestBytes` setting are not affected, but warned that servers with higher values may be vulnerable and advised administrators to set the registry value to a safe level and restart the HTTP service or host until patches are applied. Cisco Talos published Snort coverage for many of the newly disclosed flaws, while separate reporting also highlighted one actively exploited zero-day in Microsoft Defender and additional high-risk issues in Hyper-V, DHCP Client, Secure Boot, and UEFI components.
Jul 1, 2026