Microsoft’s June 2026 Patch Tuesday Fixes About 200 Vulnerabilities
Summary
Microsoft’s June 2026 updates fix about 200 vulnerabilities, including three publicly disclosed flaws. None appears exploited in the wild; nearly 40 issues are rated critical.
Key points
- Microsoft fixed about 200 vulnerabilities in its products; none of this month’s flaws appears to have been exploited in the wild.
- Three patched issues were publicly disclosed: CVE-2026-49160, a Windows denial-of-service flaw; CVE-2026-50507, a BitLocker bypass requiring physical access; and CVE-2026-45586, a Windows privilege-escalation flaw.
- Microsoft rated all three publicly disclosed issues as more likely to be exploited.
- The article says CVE-2026-50507 may be related to YellowKey, and CVE-2026-45586 may be related to GreenPlasma, exploits reportedly leaked by researcher Chaotic Eclipse.
- Nearly 40 vulnerabilities were rated critical and affect products including Windows, Azure, Office, Outlook, Exchange, and AI tools.
- Microsoft also issued advisories for 360 vulnerabilities in third-party components used by its software; Adobe separately fixed more than 120 vulnerabilities.
Article Details
- Event Type
- Microsoft Patch Tuesday security update
- Impact
- Microsoft fixed roughly 200 vulnerabilities, including three disclosed before patching. Microsoft assessed all three as more likely to be exploited, but the article says none of the flaws addressed that month appeared to have been exploited in the wild. The disclosed issues include a Windows denial-of-service vulnerability, a BitLocker security bypass that could expose encrypted data to an attacker with physical access, and a Windows privilege-escalation flaw. Nearly 40 vulnerabilities were rated critical and could enable remote code execution, privilege escalation, or information disclosure.
MITRE ATT&CK
CVE
CVE-2026-45586The third publicly disclosed vulnerability patched by Microsoft this month is CVE-2026-45586, a Windows Collaborative Translation Framework bug that can be exploited to elevate privileges to System. An anonymousCVE-2026-49160One of them is CVE-2026-49160, described as a denial-of-service (DoS) issue affecting Windows.CVE-2026-50507Another disclosed vulnerability is CVE-2026-50507, a Windows BitLocker security bypass that can allow an attacker with physical access to the targeted system to access encrypted data.
People
Vendors
Products
AzureThey affect Windows, Azure, Office, Outlook, Exchange, and AI tools, and their exploitation can lead to remote code execution, privilege escalation, and information disclosure.BitLockerAnother disclosed vulnerability is CVE-2026-50507, a Windows BitLocker security bypass that can allow an attacker with physical access to the targeted system to access encrypted data.Microsoft Exchange ServerThey affect Windows, Azure, Office, Outlook, Exchange, and AI tools, and their exploitation can lead to remote code execution, privilege escalation, and information disclosure.Microsoft WindowsOne of them is CVE-2026-49160, described as a denial-of-service (DoS) issue affecting Windows.OfficeThey affect Windows, Azure, Office, Outlook, Exchange, and AI tools, and their exploitation can lead to remote code execution, privilege escalation, and information disclosure.OutlookThey affect Windows, Azure, Office, Outlook, Exchange, and AI tools, and their exploitation can lead to remote code execution, privilege escalation, and information disclosure.