Microsoft’s June 2026 Patch Tuesday Fixes 200 Flaws, Including Three Publicly Disclosed Zero-Days
Summary
Microsoft’s June 2026 Patch Tuesday fixes 200 flaws, including three publicly disclosed zero-days with no known in-the-wild exploitation; updates include an HTTP/2 DoS mitigation and a BitLocker bypass fix.
Key points
- Microsoft says the June release fixes 200 flaws, including 33 rated critical.
- The article identifies CVE-2026-45586, CVE-2026-49160 and CVE-2026-50507 as publicly disclosed zero-days; none are known to have been exploited in attacks.
- CVE-2026-49160 addresses the HTTP/2 “HTTP/2 Bomb” denial-of-service issue, which the article says can drive disproportionate server memory use.
- Microsoft added a MaxHeadersCount registry setting to limit headers accepted in HTTP/2 and HTTP/3 requests as a mitigation.
- CVE-2026-50507 fixes the YellowKey BitLocker bypass, which the article describes as requiring specially crafted files and booting into Windows Recovery Environment.
- The article says the BitLocker issue primarily affects systems using TPM-only protection and notes TPM+PIN as a previously shared temporary mitigation.
Article Details
- Event Type
- Microsoft June 2026 Patch Tuesday security update release
- Impact
- Microsoft patched 200 flaws, including 33 rated critical, and three publicly disclosed zero-days: CVE-2026-45586, CVE-2026-49160, and CVE-2026-50507. The article reports no confirmed in-the-wild exploitation. The flaws include local privilege escalation, HTTP/2 denial of service that could cause server performance issues or outages, and a physical-attack BitLocker security feature bypass that could expose encrypted drives.
CVE
People
CodexCredited alongside Quang Luong with the disclosure of CVE-2026-49160, the HTTP.sys HTTP/2 denial-of-service vulnerability.Nightmare EclipseThe article identifies Nightmare Eclipse as the cybersecurity researcher who publicly disclosed the YellowKey vulnerability, addressed by CVE-2026-50507.Quang LuongCredited with the disclosure of CVE-2026-49160, the HTTP.sys HTTP/2 denial-of-service vulnerability.
Vendors
Products
BitLockerMicrosoft’s June 2026 Patch Tuesday fixes 200 flaws, including three publicly disclosed zero-day vulnerabilities in Windows Collaborative Translation Framework, HTTP.sys, and BitLocker.Microsoft Hyper-VThe update set spans critical issues across Office, SharePoint, Hyper-V, Remote Desktop Client, and Windows components, with mitigations added for the HTTP/2 “HTTP/2 Bomb” attack.Microsoft SharePointThe update set spans critical issues across Office, SharePoint, Hyper-V, Remote Desktop Client, and Windows components, with mitigations added for the HTTP/2 “HTTP/2 Bomb” attack.Microsoft WindowsMicrosoft’s June 2026 Patch Tuesday fixes 200 flaws, including three publicly disclosed zero-day vulnerabilities in Windows Collaborative Translation Framework, HTTP.sys, and BitLocker.OfficeThe update set spans critical issues across Office, SharePoint, Hyper-V, Remote Desktop Client, and Windows components, with mitigations added for the HTTP/2 “HTTP/2 Bomb” attack.Remote Desktop ClientThe update set spans critical issues across Office, SharePoint, Hyper-V, Remote Desktop Client, and Windows components, with mitigations added for the HTTP/2 “HTTP/2 Bomb” attack.Windows 11To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5094126 & KB5093998 cumulative updates and the Windows 10 KB5094127 extended security update.Windows Server 2022The flaw primarily affects systems that used TPM-only BitLocker protection on Windows 11 and Windows Server 2022/2025 devices.