# Microsoft patches 200 flaws including 3 zero-days

Published: 2026-06-09 · Severity: critical
Canonical: https://vorant.io/reports/aecb87df-a0db-4aac-89d6-00eb837a39ba/microsoft-patches-200-flaws-including-3-zero-days

> Microsoft's June 2026 Patch Tuesday addresses 200 vulnerabilities including three publicly disclosed zero-days: a CTFMON privilege escalation, HTTP/2 Bomb DoS, and BitLocker bypass.

Microsoft released its June 2026 Patch Tuesday updates fixing 200 security vulnerabilities, including 33 critical flaws. Three publicly disclosed zero-day vulnerabilities were patched, though none are known to have been actively exploited. The update addresses 28 remote code execution bugs, along with elevation of privilege, information disclosure, and denial of service flaws across Windows components, Office products, and enterprise services.

The three zero-days include CVE-2026-45586, a Windows CTFMON flaw allowing SYSTEM privilege escalation; CVE-2026-49160, the HTTP/2 Bomb denial-of-service vulnerability disclosed by Calif researchers that exploits HTTP/2 header compression to exhaust server memory; and CVE-2026-50507, the YellowKey BitLocker bypass disclosed by researcher Nightmare Eclipse. The BitLocker flaw allows local attackers with physical access to bypass encryption on TPM-only protected systems by booting into Windows Recovery Environment and accessing a command shell.

Critical patches include fixes for Windows Kerberos KDC remote code execution, Active Directory remote code execution, multiple Remote Desktop Client RCE flaws, and numerous Office product vulnerabilities. Microsoft introduced a new MaxHeadersCount registry setting to mitigate the HTTP/2 Bomb attack. The update excludes 360 Edge/Chromium flaws fixed earlier by Google and various Microsoft cloud service patches deployed throughout the month.

## Mentioned in this report

- Vulnerabilities: CVE-2026-42985, CVE-2026-42992, CVE-2026-44799, CVE-2026-44801, CVE-2026-45586, CVE-2026-45607, CVE-2026-45641, CVE-2026-45648, CVE-2026-47288, CVE-2026-47289, CVE-2026-47291, CVE-2026-47652, CVE-2026-47654, CVE-2026-48563, CVE-2026-49160, CVE-2026-50507

## Detection guidance (public sample)

### Suspicious Child Process Spawned by CTFMON.EXE

ATT&CK: T1068

Detects ctfmon.exe (Windows CTF subsystem) spawning command interpreters or scripting hosts, consistent with exploitation of the CVE-2026-45586 CTF privilege-escalation flaw to reach SYSTEM. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned by CTFMON.EXE
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ctfmon.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \rundll32.exe
    - \mshta.exe
  filter:
    User|contains: SYSTEM
  condition: selection and not filter
falsepositives:
- Rare legitimate automation or accessibility tooling that hooks into the CTF input
  subsystem
level: high
tags:
- attack.t1068
- attack.privilege_escalation
id: cef209bd-355f-5cb5-bbd7-dcbb0696f033
status: experimental
author: Vorant
```

### BitLocker Disabled or Removed via Manage-bde or Bcdedit

ATT&CK: T1006

Detects use of manage-bde or bcdedit to disable/decrypt BitLocker or alter boot configuration, consistent with local attackers exploiting the YellowKey WinRE command-shell bypass to access TPM-only protected volumes without a recovery key. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: BitLocker Disabled or Removed via Manage-bde or Bcdedit
logsource:
  category: process_creation
  product: windows
detection:
  selection_managebde:
    Image|endswith: \manage-bde.exe
    CommandLine|contains:
    - -off
    - -disable
    - -forcerecovery
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - recoveryenabled
    - testsigning
    - nointegritychecks
  condition: 1 of selection_*
falsepositives:
- IT staff legitimately decommissioning or re-provisioning encrypted drives
- Authorized BitLocker recovery/troubleshooting performed by help desk with a valid
  recovery key
level: high
tags:
- attack.t1006
- attack.defense_evasion
id: c36e36e3-3c2f-575a-a94a-14af36925d42
status: experimental
author: Vorant
```

### HTTP/2 MaxHeadersCount Mitigation Value Tampered or Disabled

ATT&CK: T1499

Detects modification of the MaxHeadersCount registry value introduced to mitigate the HTTP/2 Bomb (CVE-2026-49160) header-compression denial-of-service, where the value is set to 0 or an unusually high limit, effectively disabling the protection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: HTTP/2 MaxHeadersCount Mitigation Value Tampered or Disabled
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: MaxHeadersCount
  suspicious_value:
    Details:
    - '0'
    - '0x00000000'
  condition: selection and suspicious_value
falsepositives:
- Administrator intentionally raising the header count limit for legitimate high-header-volume
  applications
level: medium
tags:
- attack.t1499
- attack.impact
id: e5251e26-9625-51af-a293-6394820454a1
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/aecb87df-a0db-4aac-89d6-00eb837a39ba/microsoft-patches-200-flaws-including-3-zero-days.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup