# Microsoft June 2026 Patch Tuesday — 198+ CVEs Including CVE-2026-49160 (HTTP.sys 'HTTP/2 Bomb' DoS), CVE-2026-50507 (BitLocker 'YellowKey' Bypass) and CVE-2026-45586 (Collaborative Translation Framework EoP)

> Microsoft's June 2026 Patch Tuesday is the largest on record, addressing roughly 198-200 CVEs (32-33 Critical). Three vulnerabilities were publicly disclosed before a patch was available: CVE-2026-49160, an HTTP.sys HTTP/2 denial-of-service flaw (CVSS 7.5) known as 'HTTP/2 Bomb'; CVE-2026-50507, a physical-access BitLocker security feature bypass (CVSS 6.8) tracked as 'YellowKey'; and CVE-2026-45586, a Collaborative Translation Framework (CTFMON) elevation-of-privilege flaw (CVSS 7.8). All three are rated 'Exploitation More Likely.' The release also includes 11 Remote Desktop Client RCEs (CVSS up to 8.8).

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0732
- **ID:** TL-2026-0732
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-49160, CVE-2026-50507, CVE-2026-45586, CVE-2026-42909, CVE-2026-42913, CVE-2026-42985, CVE-2026-42992, CVE-2026-42993, CVE-2026-44799, CVE-2026-44801, CVE-2026-47289, CVE-2026-47653, CVE-2026-47654, CVE-2026-48563

## Description

On 9 June 2026 Microsoft shipped its largest Patch Tuesday to date, remediating approximately 198-200 CVEs (sources vary between 198 and 200 depending on counting of Edge/Chromium and republished advisories), of which 32-33 are rated Critical and the remainder Important. The headline items are three vulnerabilities that were publicly disclosed prior to patch availability, each flagged by Microsoft as 'Exploitation More Likely.'

CVE-2026-49160 (HTTP.sys Denial of Service, CVSS 7.5, CWE-400 Uncontrolled Resource Consumption) was disclosed by researchers at the offensive-security firm Calif.io as 'HTTP/2 Bomb.' The technique abuses HTTP/2 header compression (HPACK) and flow-control management: an unauthenticated remote attacker sends a very small volume of crafted data that forces the kernel-mode HTTP.sys driver to allocate disproportionately large amounts of memory, and manipulates flow-control window settings so allocated resources are never released, exhausting memory and taking internet-facing services offline. Because HTTP.sys sits beneath IIS, WinRM, WSL networking and many other Windows services, any HTTP/2- or HTTP/3-exposed endpoint is at risk. Microsoft's fix introduces a new MaxHeadersCount registry value that caps the number of headers accepted in HTTP/2 and HTTP/3 requests (delivered in update KB5102602). No in-the-wild exploitation was confirmed at release.

CVE-2026-50507 (Windows BitLocker Security Feature Bypass, CVSS 6.8, CWE-288/CWE-1299) was disclosed by researcher 'Nightmare Eclipse' as 'YellowKey,' with a proof-of-concept previously released. An attacker with physical access stages specially crafted files on a USB drive or the EFI system partition, boots the device into the Windows Recovery Environment (WinRE), and holds the CTRL key to spawn an unrestricted command shell that grants access to data on BitLocker-protected, TPM-only volumes — defeating the encryption control organizations rely on for lost or stolen devices. Affected configurations include TPM-only BitLocker protection on Windows 11 and Windows Server 2022/2025.

CVE-2026-45586 (Windows Collaborative Translation Framework / CTFMON Elevation of Privilege, CVSS 7.8, CWE-59 Improper Link Resolution Before File Access) lets a local low-privileged attacker abuse a link-following ('link following') weakness in the CTFMON voice/handwriting recognition subsystem to elevate to SYSTEM. It was reported by an anonymous researcher and was known to attackers before patch.

Beyond the zero-days, the release contains a cluster of 11 Remote Desktop Client RCEs (CVE-2026-42909, -42913, -42985, -42992, -42993, -44799, -44801, -47289, -47653, -47654, -48563), 7 of which are Critical, exploiting heap-based buffer overflows triggered when a victim RDP client connects to an attacker-controlled server (CVSS 7.5-8.8; CVE-2026-42985 rated 'Exploitation More Likely'). The overall category breakdown is approximately 54-65 Elevation of Privilege, 54-55 Remote Code Execution, 27 Spoofing, 26-30 Information Disclosure, 18-19 Security Feature Bypass, and 7 Denial of Service across 98+ affected product families including the Windows kernel, Office, Exchange, Teams, Azure, Defender, Hyper-V, RDP, DNS, plus third-party components.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1200 Hardware Additions
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1574 Hijack Execution Flow
- T1211 Exploitation for Stealth
- T1542 Pre-OS Boot
- T1006 Direct Volume Access
- T1548 Abuse Elevation Control Mechanism
- T1187 Forced Authentication
- T1499 Endpoint Denial of Service
- T1498 Network Denial of Service

## Sources

- [Microsoft's June 2026 Patch Tuesday Addresses 198 CVEs (CVE-2026-49160, CVE-2026-50507)](https://www.tenable.com/blog/microsofts-june-2026-patch-tuesday-addresses-198-cves-cve-2026-49160-cve-2026-50507)
- [Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws](https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws/)
- [Microsoft Patch Tuesday June 2026 – 198 Vulnerabilities Fixed, Including 3 Zero-days](https://cybersecuritynews.com/microsoft-patch-tuesday-june-2026/)
- [June 2026 Patch Tuesday forecast: Where are the CVEs?](https://www.helpnetsecurity.com/2026/06/05/june-2026-patch-tuesday-forecast/)
- [Microsoft Patch Tuesday Jun 2026 — Vulnerability Roundup (PatchaPalooza)](https://patchapalooza.com/2026-Jun)
- [Microsoft Security Response Center — Security Update Guide](https://msrc.microsoft.com/update-guide)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0732