Microsoft June 2026 Patch Tuesday — 198+ CVEs Including CVE-2026-49160 (HTTP.sys 'HTTP/2 Bomb' DoS), CVE-2026-50507 (BitLocker 'YellowKey' Bypass) and CVE-2026-45586 (Collaborative Translation Framework EoP)

Microsoft June 2026 Patch Tuesday (TL-2026-0732), also tracked as HTTP/2 Bomb, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-06-09. It has no confirmed attribution, affects Microsoft Windows HTTP.sys (HTTP/2 stack), references 14 CVEs (CVE-2026-49160, CVE-2026-50507, CVE-2026-45586), maps to 17 MITRE ATT&CK techniques (T1006, T1059, T1068), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0732

Threat ID
TL-2026-0732
Also known as
HTTP/2 Bomb, YellowKey, June 2026 Patch Tuesday
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-09
Last reviewed
2026-06-09
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, technology, hosting, education, energy
Target regions
Global, North America, Europe, Asia
Detection rules
9
Indicators of compromise
18

Microsoft's June 2026 Patch Tuesday is the largest on record, addressing roughly 198-200 CVEs (32-33 Critical). Three vulnerabilities were publicly disclosed before a patch was available: CVE-2026-49160, an HTTP.sys HTTP/2 denial-of-service flaw (CVSS 7.5) known as 'HTTP/2 Bomb'; CVE-2026-50507, a physical-access BitLocker security feature bypass (CVSS 6.8) tracked as 'YellowKey'; and CVE-2026-45586, a Collaborative Translation Framework (CTFMON) elevation-of-privilege flaw (CVSS 7.8). All three are rated 'Exploitation More Likely.' The release also includes 11 Remote Desktop Client RCEs (CVSS up to 8.8).

How Microsoft June 2026 Patch Tuesday works

On 9 June 2026 Microsoft shipped its largest Patch Tuesday to date, remediating approximately 198-200 CVEs (sources vary between 198 and 200 depending on counting of Edge/Chromium and republished advisories), of which 32-33 are rated Critical and the remainder Important. The headline items are three vulnerabilities that were publicly disclosed prior to patch availability, each flagged by Microsoft as 'Exploitation More Likely.'

CVE-2026-49160 (HTTP.sys Denial of Service, CVSS 7.5, CWE-400 Uncontrolled Resource Consumption) was disclosed by researchers at the offensive-security firm Calif.io as 'HTTP/2 Bomb.' The technique abuses HTTP/2 header compression (HPACK) and flow-control management: an unauthenticated remote attacker sends a very small volume of crafted data that forces the kernel-mode HTTP.sys driver to allocate disproportionately large amounts of memory, and manipulates flow-control window settings so allocated resources are never released, exhausting memory and taking internet-facing services offline. Because HTTP.sys sits beneath IIS, WinRM, WSL networking and many other Windows services, any HTTP/2- or HTTP/3-exposed endpoint is at risk. Microsoft's fix introduces a new MaxHeadersCount registry value that caps the number of headers accepted in HTTP/2 and HTTP/3 requests (delivered in update KB5102602). No in-the-wild exploitation was confirmed at release.

CVE-2026-50507 (Windows BitLocker Security Feature Bypass, CVSS 6.8, CWE-288/CWE-1299) was disclosed by researcher 'Nightmare Eclipse' as 'YellowKey,' with a proof-of-concept previously released. An attacker with physical access stages specially crafted files on a USB drive or the EFI system partition, boots the device into the Windows Recovery Environment (WinRE), and holds the CTRL key to spawn an unrestricted command shell that grants access to data on BitLocker-protected, TPM-only volumes — defeating the encryption control organizations rely on for lost or stolen devices. Affected configurations include TPM-only BitLocker protection on Windows 11 and Windows Server 2022/2025.

CVE-2026-45586 (Windows Collaborative Translation Framework / CTFMON Elevation of Privilege, CVSS 7.8, CWE-59 Improper Link Resolution Before File Access) lets a local low-privileged attacker abuse a link-following ('link following') weakness in the CTFMON voice/handwriting recognition subsystem to elevate to SYSTEM. It was reported by an anonymous researcher and was known to attackers before patch.

Beyond the zero-days, the release contains a cluster of 11 Remote Desktop Client RCEs (CVE-2026-42909, -42913, -42985, -42992, -42993, -44799, -44801, -47289, -47653, -47654, -48563), 7 of which are Critical, exploiting heap-based buffer overflows triggered when a victim RDP client connects to an attacker-controlled server (CVSS 7.5-8.8; CVE-2026-42985 rated 'Exploitation More Likely'). The overall category breakdown is approximately 54-65 Elevation of Privilege, 54-55 Remote Code Execution, 27 Spoofing, 26-30 Information Disclosure, 18-19 Security Feature Bypass, and 7 Denial of Service across 98+ affected product families including the Windows kernel, Office, Exchange, Teams, Azure, Defender, Hyper-V, RDP, DNS, plus third-party components.

MITRE ATT&CK techniques used in TL-2026-0732

Defense Evasion

T1006 Direct Volume Access; T1211 Exploitation for Stealth; T1542 Pre-OS Boot

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Credential Access

T1187 Forced Authentication

Initial Access

T1190 Exploit Public-Facing Application; T1200 Hardware Additions

Impact

T1498 Network Denial of Service; T1499 Endpoint Denial of Service

privilege-escalation

T1548 Abuse Elevation Control Mechanism

stealth

T1574 Hijack Execution Flow

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in Microsoft June 2026 Patch Tuesday

  • Microsoft — Windows HTTP.sys (HTTP/2 stack)
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022; Windows Server 2025
    Fixed in: June 2026 cumulative update / KB5102602
  • Microsoft — Windows BitLocker (TPM-only)
    Vulnerable versions: Windows 11; Windows Server 2022; Windows Server 2025
    Fixed in: June 2026 cumulative update
  • Microsoft — Windows Collaborative Translation Framework (CTFMON)
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022; Windows Server 2025
    Fixed in: June 2026 cumulative update
  • Microsoft — Windows Remote Desktop Client
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2019/2022/2025; Remote Desktop client for Windows
    Fixed in: June 2026 cumulative update / updated RDP client

Remediation for Microsoft June 2026 Patch Tuesday

Patches

  • Microsoft June 2026 Patch Tuesday cumulative updates
  • KB5102602 (introduces MaxHeadersCount for CVE-2026-49160)

Immediate actions

  • Apply the June 2026 cumulative security updates (including KB5102602) to all affected Windows clients and servers immediately, prioritizing internet-facing and HTTP/2-exposed hosts.
  • For internet-facing servers that cannot patch immediately, configure the new MaxHeadersCount registry value to limit HTTP/2 and HTTP/3 request headers as a mitigation for CVE-2026-49160.
  • Re-enable BitLocker pre-boot authentication (PIN or startup key) instead of TPM-only protection on at-risk devices to mitigate CVE-2026-50507 / YellowKey.
  • Restrict and monitor Windows Recovery Environment (WinRE) access on portable and high-value endpoints.

Workarounds

  • Set the MaxHeadersCount registry value to cap HTTP/2 and HTTP/3 headers.
  • Switch BitLocker from TPM-only to TPM+PIN / TPM+startup key.
  • Disable HTTP/2 (DisableHttp2) on non-essential HTTP.sys listeners.

Longer-term hardening

  • Adopt pre-boot authentication (TPM+PIN) as standard BitLocker policy for all mobile devices.
  • Deploy EDR with behavioral detection for link-following / symbolic-link abuse and abnormal SYSTEM-token acquisition.
  • Place HTTP/2-terminating reverse proxies or WAFs with header-count and flow-control limits in front of exposed IIS/HTTP.sys services.
  • Disable HTTP/2 on endpoints that do not require it where feasible.

CVEs associated with Microsoft June 2026 Patch Tuesday

Weaknesses (CWE) in Microsoft June 2026 Patch Tuesday

CWE-400, CWE-59, CWE-288, CWE-1299, CWE-122

Timeline of Microsoft June 2026 Patch Tuesday

  • Help Net Security publishes its June 2026 Patch Tuesday forecast anticipating the upcoming Microsoft security release.
  • Defenders advised to prioritize internet-facing HTTP.sys/IIS hosts for CVE-2026-49160 and to switch BitLocker from TPM-only to TPM+PIN to mitigate the YellowKey bypass (CVE-2026-50507).
  • Vulnerability breakdown reported: ~54-65 Elevation of Privilege, 54-55 Remote Code Execution, 27 Spoofing, 26-30 Information Disclosure, 18-19 Security Feature Bypass, and 7 Denial of Service across 98+ affected product families.
  • Tenable, BleepingComputer and CybersecurityNews publish analyses of the June 2026 release and its three zero-days.
  • Eleven Remote Desktop Client RCE CVEs (7 Critical, CVSS up to 8.8) patched, including CVE-2026-42985 rated 'Exploitation More Likely.'
  • Microsoft introduces the MaxHeadersCount registry setting (KB5102602) to cap HTTP/2 and HTTP/3 request headers, mitigating CVE-2026-49160.
  • Microsoft ships the June 2026 Patch Tuesday — the largest on record — addressing ~198-200 CVEs (32-33 Critical) across 98+ product families.
  • Researcher 'Nightmare Eclipse' previously released a proof-of-concept for the BitLocker 'YellowKey' bypass (CVE-2026-50507); Calif.io disclosed the HTTP/2 Bomb technique (CVE-2026-49160).
  • Three vulnerabilities (CVE-2026-49160, CVE-2026-50507, CVE-2026-45586) confirmed publicly disclosed prior to patch availability and rated 'Exploitation More Likely.'

Sources cited for Microsoft June 2026 Patch Tuesday

Threats related to Microsoft June 2026 Patch Tuesday

Detection coverage for TL-2026-0732

As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0732 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats