# Microsoft patches 204 flaws, three pre-disclosed

Published: 2026-06-09 · Severity: critical · Sectors: technology
Canonical: https://vorant.io/reports/44923bc0-0a72-4426-b534-7b87a3f6ff29/microsoft-patches-204-flaws-three-pre-disclosed

> Microsoft's June 2026 Patch Tuesday addresses 204 vulnerabilities including 38 critical flaws, with three pre-disclosed issues and hundreds of Chromium/Edge fixes.

Microsoft released an unusually large Patch Tuesday update addressing 204 vulnerabilities, of which 38 are rated critical. Three vulnerabilities were publicly disclosed prior to the patch release. The update incorporates 360 Chromium-related vulnerabilities into the Edge browser, reflecting increased vulnerability discovery driven by AI tooling. Six cloud-solution vulnerabilities require no user action.

Notable critical vulnerabilities include CVE-2026-49160, a publicly known HPACK compression algorithm flaw in HTTP/2 and HTTP/3 that can cause resource exhaustion attacks. CVE-2026-47291 affects the http.sys web server engine and enables remote code execution via an integer overflow triggered by oversized requests. CVE-2026-45648 is a stack-based buffer overflow in Active Directory Domain Services requiring authentication, though Microsoft assesses exploit development as unlikely.

Microsoft also patched three BitLocker security feature bypass vulnerabilities, one of which was already public and potentially related to the Nightmare Eclipse research. Multiple critical vulnerabilities affect Microsoft Office products including Outlook and Word. Microsoft recommends interim mitigations including registry settings to limit resource allocation until patches can be deployed.

## Mentioned in this report

- Vulnerabilities: CVE-2026-45648, CVE-2026-47291, CVE-2026-49160

## Detection guidance (public sample)

### Possible http.sys Exploitation via Application Crash (CVE-2026-47291)

ATT&CK: T1499.004

Detects Windows Error Reporting crash events referencing http.sys, potentially indicating exploitation of the integer overflow RCE via oversized HTTP/2 or HTTP/3 requests. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible http.sys Exploitation via Application Crash
id: 013514f0-3751-5c0a-96fc-00a827f47fdf
status: experimental
description: 'Detects an application crash (Windows Error Reporting Event ID 1000)
  where the faulting module is http.sys.

  This can indicate exploitation attempts of CVE-2026-47291, an integer overflow in
  the HTTP.sys web server

  engine triggered by oversized requests, leading to remote code execution or denial
  of service.

  '
references:
- https://msrc.microsoft.com
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    FaultingModuleName|contains: http.sys
  condition: selection
falsepositives:
- Faulty third-party filter drivers or misconfigured IIS extensions causing unrelated
  http.sys crashes
- Legitimate driver bugs unrelated to exploitation, especially after untested Windows
  updates
level: medium
tags:
- attack.t1499.004
- attack.t1190
- cve.2026.47291
author: Vorant
```

### Active Directory Domain Services Crash Indicative of Exploitation Attempt (CVE-2026-45648)

ATT&CK: T1499.004

Detects LSASS/NTDS process crashes referencing Active Directory Domain Services modules, which may indicate exploitation of the authenticated stack-based buffer overflow in AD DS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LSASS Crash Referencing NTDS Module (Possible AD DS Exploitation)
id: c2e9a255-ef37-50ed-8071-0c31afa1ebfd
status: experimental
description: 'Detects Windows Error Reporting crash events where the faulting process
  is lsass.exe and the faulting

  module belongs to the Active Directory Domain Services stack (e.g. ntdsai.dll, ntdsa.dll).
  This pattern

  is consistent with exploitation attempts of CVE-2026-45648, a stack-based buffer
  overflow in AD DS

  requiring prior authentication.

  '
references:
- https://msrc.microsoft.com
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    FaultingProcessName|contains: lsass.exe
    FaultingModuleName|contains:
    - ntdsai.dll
    - ntdsa.dll
  condition: selection
falsepositives:
- Rare legitimate AD replication bugs or corrupted database issues unrelated to exploitation
- Domain controller instability following untested third-party AD-integrated software
level: high
tags:
- attack.t1499.004
- attack.t1190
- cve.2026.45648
author: Vorant
```

### BitLocker Security Feature Bypass via Policy Registry Modification

ATT&CK: T1499.004

Detects registry modifications disabling or weakening BitLocker enforcement policies, which may correspond to exploitation or bypass of BitLocker security feature vulnerabilities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: BitLocker Policy Weakening via Registry Modification
id: c875cb53-45f5-5144-94f1-8ff1121d5ae1
status: experimental
description: 'Detects registry changes to BitLocker policy keys that disable pre-boot
  authentication requirements or

  reduce enforcement, which is a precondition abused by BitLocker security feature
  bypass vulnerabilities

  such as those patched in this update (potentially related to Nightmare Eclipse research).

  '
references:
- https://msrc.microsoft.com
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: SYSTEM\CurrentControlSet\Policies\Microsoft\FVE
    Details|contains:
    - '0'
    - disabled
  condition: selection
falsepositives:
- Legitimate administrative changes to BitLocker group policy during provisioning
  or troubleshooting
- Endpoint management tools reconfiguring encryption policy during imaging
level: medium
tags:
- attack.t1499.004
- attack.t1190
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://isc.sans.edu/diary/rss/33064

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/44923bc0-0a72-4426-b534-7b87a3f6ff29/microsoft-patches-204-flaws-three-pre-disclosed.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup