Microsoft Fixes BitLocker Bypass and Other Zero-Days in June Security Updates
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jun 16, 2026
Microsoft released security updates for 203 vulnerabilities across its product portfolio, including 33 rated critical, and patched six zero-day flaws. One of the zero-days, CVE-2026-42897, was reported as actively exploited in the wild; it affects Microsoft Exchange Server and allows spoofing through an input-sanitization weakness that can trigger JavaScript execution in the Outlook on the web context when a crafted email is opened.
The update set also addressed multiple Windows zero-days, including the Windows BitLocker Security Feature Bypass Vulnerability tracked as CVE-2026-45585. According to public reporting, the Windows flaws span components such as CTFMON, HTTP.sys, BitLocker, and the Cloud Files Mini Filter Driver, with impacts including privilege escalation, denial of service, security feature bypass, and potential access to encrypted data. Microsoft urged organizations to deploy the patches promptly to reduce exposure.
