CVE-2026-47291 — HTTP.sys RCE (CVSS 9.8, Most Dangerous)

The most dangerous flaw in this release is an integer overflow in the Windows HTTP Protocol Stack (HTTP.sys). An unauthenticated attacker can trigger remote code execution with a single crafted packet, putting every internet-facing service built on HTTP.sys at risk — including IIS. No authentication, no user interaction required. Rated "more likely" to be exploited; treat as emergency-priority for all internet-facing servers.

CVE-2026-49160 — HTTP/2 Bomb DoS (Publicly Disclosed Zero-Day)

The first of three publicly disclosed zero-days, CVE-2026-49160 maps to the "HTTP/2 Bomb" technique: a trivial amount of data forces a server to reserve enormous memory blocks via flow-control manipulation. Testing reportedly drained 64 GB of RAM from an IIS server in ~45 seconds. Microsoft's fix adds a MaxHeadersCount registry setting to cap HTTP/2 and HTTP/3 request headers as an interim mitigation where immediate patching is not possible.

CVE-2026-44803 & CVE-2026-44812 — Win32K GRFX RCE (Critical, "More Likely")

Both flaws stem from an integer overflow in the Windows Win32K GRFX subsystem (graphics). Microsoft rates both "more likely" to be exploited. CVE-2026-42985 completes the graphics/RDP RCE cluster — a network-exploitable heap-based buffer overflow (CWE-122) in the Windows Remote Desktop Client, allowing a malicious RDP server to run code on any victim who connects.

CVE-2026-45586 — CTFMON EoP "GreenPlasma" (Publicly Disclosed Zero-Day)

The second publicly disclosed zero-day escalates privileges in the Windows Collaborative Translation Framework (CTFMON) via link following. It matches the public "GreenPlasma" exploit, which can spawn a SYSTEM shell from a standard user account. Four additional EoP flaws rated "more likely" give attackers with any foothold a clean path to SYSTEM: CVE-2026-42980 (NT OS Kernel), CVE-2026-42986 (Graphics), CVE-2026-42989 (Winlogon), and CVE-2026-42905 (DWM Core Library).

CVE-2026-50507 — BitLocker Bypass "YellowKey" (Publicly Disclosed Zero-Day, CVSS 6.8)

The third publicly disclosed zero-day is a protection-mechanism failure allowing an attacker with physical access to defeat BitLocker using the "YellowKey" exploit — crafted files on USB/EFI media plus the Recovery Environment to open a shell over encrypted drives. Primarily affects TPM-only setups on Windows 11 and Server 2022/2025; TPM+PIN was Microsoft's earlier interim mitigation. CVE-2026-45658 is a second BitLocker bypass in the same release.

SharePoint, NTLM & Exchange Spoofing Cluster

Three spoofing flaws carry elevated risk: CVE-2026-45481 and CVE-2026-47634 in SharePoint Server (both "more likely"), and CVE-2026-50508 in Windows NTLM. These typically enable content forgery, credential relay, or social-engineering attacks. Exchange Server carries additional spoofing, information disclosure, EoP, and one RCE (CVE-2026-45583). As of the release date, none of the three publicly disclosed zero-days are known to be actively exploited.

Apply June 2026 Security Updates Immediately

Deploy the June 9, 2026 Microsoft security updates across all affected Windows clients, servers, Remote Desktop clients, and SharePoint Server instances without delay. These updates remediate all fifteen exploitable vulnerabilities including the three publicly disclosed zero-days and the CVSS 9.8 HTTP.sys RCE flaw. Functional proof-of-concept code is already public for several issues — patching is the single most effective control.

Prioritise Internet-Facing HTTP.sys Systems

Treat servers running IIS or any service built on the Windows HTTP Protocol Stack as top-priority patch targets for CVE-2026-47291 and CVE-2026-49160 — both reachable over the network with no authentication. Where immediate patching is not possible for the HTTP/2 DoS issue, apply the new MaxHeadersCount registry setting to limit headers in HTTP/2 and HTTP/3 requests as an interim mitigation.

Harden BitLocker-Protected Endpoints

For devices relying on TPM-only BitLocker — particularly Windows 11 and Server 2022/2025 — apply fixes for CVE-2026-50507 and CVE-2026-45658, and enable TPM+PIN authentication to raise the bar against physical-access attacks such as the "YellowKey" technique. Enforce boot-environment and recovery-environment controls to prevent untrusted USB or EFI media from subverting encryption.

Constrain Privilege-Escalation Exposure

CVE-2026-42980, CVE-2026-42985, CVE-2026-42986, CVE-2026-42989, CVE-2026-45586, and CVE-2026-42905 all enable an attacker with any foothold to elevate to SYSTEM. Enforce least privilege, restrict local admin rights, and monitor for anomalous process creation, unexpected SYSTEM-level shells, and RDP connections to untrusted servers until patching is complete.