This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Microsoft fixes over 200 vulnerabilities in its Patch Tuesday
As part of the June “Patch Tuesday”, Microsoft released fixes for more than 200 vulnerabilities [1][2]. The most severe ones are described below; a complete overview of all vulnerabilities, including the available fixes, is provided at [1] in the details of the individual entries.
An unauthenticated remote attacker can execute arbitrary code on the vulnerable system via a specially crafted network packet due to an integer overflow/wraparound vulnerability in the Windows HTTP.sys component [3].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-47291 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated remote attacker can execute arbitrary code via specially crafted network traffic, potentially with system privileges, due to a use after free vulnerability in the Windows kernel [4].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-45657 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated remote attacker can execute arbitrary code on the vulnerable system in Windows DHCP Client Service via specially crafted DHCP traffic [5].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-44815 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated remote attacker can execute arbitrary code on the client system after a user connects to a malicious RDP server due to improper memory management in Remote Desktop Client [6].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-42985 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated remote attacker can perform a DoS attack due to uncontrolled resource consumption when processing HTTP/2 requests in HTTP.sys [7].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-49160 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An authenticated local attacker can escalate their privileges and gain SYSTEM privileges due to a link-following vulnerability in Windows Collaborative Translation Framework [8].
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-45586 at cve.org, NVD
- CWE-59: Improper Link Resolution Before File Access ('Link Following') at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated local attacker with physical access to the device can exploit a vulnerability in BitLocker protection to bypass disk encryption, especially on systems relying solely on TPM-only protection, and gain access to encrypted data on the system storage [9].
CVSS: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
More information:
- CVE-2026-50507 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An authenticated remote attacker can execute arbitrary code via specially crafted input due to a stack-based buffer overflow vulnerability in Windows Active Directory Domain Services [10].
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-45648 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An unauthenticated local attacker can execute arbitrary code via specially crafted content processed by the Outlook/Word applications due to a type confusion vulnerability in Microsoft Office [11].
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-45456 at cve.org, NVD
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
An authenticated local attacker can exploit a path traversal vulnerability in Azure Kubernetes Service to send specially crafted requests to a host-level service through an untrusted container with a host network configuration and execute malicious code locally [12].
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-32193 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 9. 6. 2026.
Links
- [1] https://msrc.microsoft.com/update-guide/releaseNote/2026-Jun
- [2] https://blog.talosintelligence.com/microsoft-patch-tuesday-for-june-2026-snort-rules-and-prominent-vulnerabilities/
- [3] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-47291
- [4] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45657
- [5] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-44815
- [6] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42985
- [7] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-49160
- [8] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45586
- [9] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50507
- [10] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45648
- [11] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45456
- [12] https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32193
By CESNET, z.s.p.o. Michaela Jarošová on 10. 6. 2026.