Multiple vulnerabilities affecting Microsoft products

As part of its Patch Tuesday in June 2026, Microsoft corrected more than 200 vulnerabilities, including around thirty classified as critical, as well as three (03) zero-day vulnerabilities. The most critical vulnerabilities are: CVE-2026-45657 (CVSS 9.8): Remote code execution via Windows kernel; CVE-2026-47291 (CVSS 9.8): Remote code execution via HTTP.sys driver; CVE-2026-44815 (CVSS 9.8): Remote code execution via Windows DHCP client; CVE-2026-49160 (CVSS 7.5): Remote denial of service via HTTP.sys (HTTP/2 “Bomb”). ZERO-DAY Vulnerabilities CVE-2026-41091 (CVSS 7.8): Privilege escalation via Microsoft Defender; CVE-2026-50507 (CVSS 6.8): Security feature bypass via Windows BitLocker; CVE-2026-45586 (CVSS 7.8): Privilege escalation via the CTFMON component leading to SYSTEM privileges being obtained. Given the criticality of these vulnerabilities, their active exploitation as well as the public disclosure of some of them, it is strongly recommended to apply the security updates published by Microsoft to all affected products without delay.

• Windows products not having the 06/09/2026 security update;

RECOMMENDED ACTIONS:

• Update all Microsoft products to their latest stable version;