--- title: Microsoft Patch Tuesday June 2026 Fixes Prominent Vulnerabilities With Snort Rules - Capstone Technologies Group description: Microsoft's June 2026 security update covers 206 vulnerabilities , 32 of which the company marked critical. canonical_url: https://captechgroup.com/threat-intelligence-center/microsoft-patch-tuesday-june-2026-fixes-prominent-300765 language: en-GB date: 2026-08-29T18:11:08Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/microsoft-patch-tuesday-june-2026-fixes-prominent-300765. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 5280 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/microsoft-patch-tuesday-june-2026-fixes-prominent-300765. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Microsoft's June 2026 security update covers **206 vulnerabilities**, 32 of which the company marked critical. **Key Insight:** Of those 32 critical entries, 28 are remote code execution flaws, meaning an attacker who reaches the affected component can run their own code on the machine. > 206 total vulnerabilities, 32 rated critical, and 28 of those critical entries are remote code execution in Windows services and applications. The affected product list is broad enough that most Windows environments will be touched somewhere. It includes Windows Active Directory, the Kerberos Key Distribution Center, the Windows Graphics component, Remote Desktop client, Windows Deployment Services, the DHCP Client service, Hyper-V, Windows Kernel and Media, Azure Kubernetes Service, Microsoft Office, Outlook, Word, Microsoft SQL Server, and the Windows HTTP Protocol Stack. Cloud and platform services appear too, with entries in Exchange Online, Microsoft Graph, M365 Copilot, and Azure HorizonDB. What separates this month from a routine one is not the raw count but where Microsoft placed its exploitability ratings. Four critical bugs carry a **"more likely" exploitation assessment**: [CVE-2026-42985](https://nvd.nist.gov/vuln/detail/CVE-2026-42985 "NVD: CVE-2026-42985") in the Remote Desktop Client, [CVE-2026-47291](https://nvd.nist.gov/vuln/detail/CVE-2026-47291 "NVD: CVE-2026-47291") in `http.sys`, and [CVE-2026-44803](https://nvd.nist.gov/vuln/detail/CVE-2026-44803 "NVD: CVE-2026-44803") and [CVE-2026-44812](https://nvd.nist.gov/vuln/detail/CVE-2026-44812 "NVD: CVE-2026-44812") in the Win32K graphics subsystem. Twenty-three more critical flaws sit in the "less likely" bucket, six are rated unlikely, and a handful of cloud service issues have no exploitation assessment at all. Talos also called out a set of "important" rated bugs with "more likely" ratings, including elevation of privilege in the DWM Core Library, NT OS Kernel, Winlogon, and CTFMON, two SharePoint Server spoofing flaws, and two BitLocker security feature bypasses. If your patch process only chases the critical label, several of those will slip past. Cisco Talos published Snort coverage alongside the release. Snort 2 rules 66572-66577, 66581, 66589, 66590, 66594, 66595, and 66601-66604 apply, along with Snort 3 rules 301523-301525, 301527-301529, 301531, and 301532. Talos notes additional rules may follow and that current rules are subject to change. ## The Critical CVEs: Exploitation Mechanics and Attack Paths ### Pre-authentication, network-reachable flaws **CVE-2026-47291** is the one to read first. An integer overflow in the Windows HTTP Protocol Stack (`http.sys`) lets an unauthenticated attacker send a specially crafted packet to any server that uses http.sys to process requests. No credentials, no user interaction, and http.sys sits underneath IIS, WinRM, and a long list of Windows services that quietly listen on 80 and 443. **[CVE-2026-45657](https://nvd.nist.gov/vuln/detail/CVE-2026-45657 "NVD: CVE-2026-45657")**, a use-after-free in the Windows Kernel, follows the same pattern at a lower layer. Crafted network traffic triggers a flaw in how the kernel handles certain TCP/IP data, and Microsoft states the attacker can run code with system-level privileges without signing in or interacting with a user. That combination (network vector, no auth, SYSTEM result) is the profile that historically gets turned into self-spreading exploitation across flat internal networks. Microsoft rated exploitation of 45657 "less likely," but the ranking reflects exploit difficulty rather than what happens if someone succeeds. ### Reverse-RDP: the client is the target **CVE-2026-42985** is a heap-based buffer overflow in the Remote Desktop Client that Microsoft flags as more likely to be exploited. **[CVE-2026-42992](https://nvd.nist.gov/vuln/detail/CVE-2026-42992 "NVD: CVE-2026-42992")**, **[CVE-2026-44799](https://nvd.nist.gov/vuln/detail/CVE-2026-44799 "NVD: CVE-2026-44799")**, **CVE-2026-44801**, **CVE-2026-47289**, **CVE-2026-48563**, and **CVE-2026-47654** cover the same class. The attack runs backwards from what most people expect: an attacker who controls a Remote Desktop *server* gets code execution on the machine that connects to it. Realistic chain: phishing or a poisoned `.rdp` file points an administrator at attacker infrastructure, and the jump box your team uses to reach production becomes the beachhead. Microsoft notes exploitation requires the attacker to prepare the target environment first. ### Flaws that need a foothold first - **[CVE-2026-45607](https://nvd.nist.gov/vuln/detail/CVE-2026-45607 "NVD: CVE-2026-45607"), [CVE-2026-45641](https://nvd.nist.gov/vuln/detail/CVE-2026-45641 "NVD: CVE-2026-45641"), [CVE-2026-47652](https://nvd.nist.gov/vuln/detail/CVE-2026-47652 "NVD: CVE-2026-47652")** (Hyper-V, out-of-bounds read): an authenticated attacker inside a guest VM sends crafted file operation requests to virtualized hardware resources and executes code on the host. One rented or compromised tenant VM reaches every other VM on that host. - **[CVE-2026-32193](https://nvd.nist.gov/vuln/detail/CVE-2026-32193 "NVD: CVE-2026-32193")** (Azure Kubernetes Service, path traversal): an untrusted container configured with host networking sends crafted requests to a host-level service never meant for unauthenticated access, breaking out of the container and taking the AKS worker node. - **[CVE-2026-44810](https://nvd.nist.gov/vuln/detail/CVE-2026-44810 "NVD: CVE-2026-44810")** (Windows Cryptographic Services, improper authentication): the attacker must log on first, then run a crafted application or convince a local user to open a malicious file, ending with SYSTEM privileges. - **[CVE-2026-45476](https://nvd.nist.gov/vuln/detail/CVE-2026-45476 "NVD: CVE-2026-45476")** (Linux MANA driver, use-after-free): control of the host environment lets an attacker read sensitive data out of the guest and escalate inside it. ### Document and identity paths **[CVE-2026-45456](https://nvd.nist.gov/vuln/detail/CVE-2026-45456 "NVD: CVE-2026-45456")**, **[CVE-2026-45458](https://nvd.nist.gov/vuln/detail/CVE-2026-45458 "NVD: CVE-2026-45458")**, and **CVE-2026-47635** are type confusion bugs reachable through the Outlook (classic) preview pane, because Outlook renders mail using Word functionality. Reading is enough. Add the four Office use-after-free entries (**CVE-2026-45461**, **45463**, **45472**, **45474**) and phishing gets a code execution primitive that does not depend on macros. On the identity side, **[CVE-2026-45648](https://nvd.nist.gov/vuln/detail/CVE-2026-45648 "NVD: CVE-2026-45648")** is a stack-based buffer overflow in Active Directory Domain Services and **[CVE-2026-47288](https://nvd.nist.gov/vuln/detail/CVE-2026-47288 "NVD: CVE-2026-47288")** an integer overflow in the Kerberos KDC, exploitable over an adjacent network. Both require an authorized attacker, which means any compromised domain account becomes a path toward the directory itself. ### Detection coverage published with the release Talos shipped Snort 2 rules `66572-66577, 66581, 66589, 66590, 66594, 66595, 66601-66604` and Snort 3 rules `301523-301525, 301527-301529, 301531, 301532`. The set covers exploitation attempts against some, not all, of the month's vulnerabilities, and Talos states the rules are subject to change as more information becomes available. Reverse-RDP: how the client becomes the target 1 The attacker stands up Remote Desktop infrastructure they control and prepares the target environment first. 2 Phishing or a planted connection file points an administrator at that attacker infrastructure..rdp 3 The malicious server triggers a heap-based buffer overflow in the Remote Desktop Client, giving code execution on the connecting machine.CVE-2026-42985 4 The administrative jump box used to reach production becomes the foothold for movement into the internal network.High ## Which Systems Are Exposed and What Breaks If They Are Not Patched The vulnerable components in this release map cleanly onto the machines most businesses cannot afford to lose. **CVE-2026-45648**, a stack-based buffer overflow in Active Directory Domain Services, and **CVE-2026-47288**, an integer overflow in the Kerberos Key Distribution Center reachable from an adjacent network, both sit on your domain controllers. Those are the servers that authorize every login in your environment, and code execution there gives an attacker the position ransomware operators use to push payloads to every joined workstation at once. Your user endpoints carry a different problem. **CVE-2026-45456**, **CVE-2026-45458** and **[CVE-2026-47635](https://nvd.nist.gov/vuln/detail/CVE-2026-47635 "NVD: CVE-2026-47635")** are type confusion flaws in Microsoft Office that Microsoft says are reachable through the Outlook (classic) preview pane, because Outlook renders mail using Word functionality. If your staff read mail in the preview pane, a message that arrives in an inbox is enough to put attacker code on a finance or executive workstation, and four additional use-after-free flaws in Office ([CVE-2026-45461](https://nvd.nist.gov/vuln/detail/CVE-2026-45461 "NVD: CVE-2026-45461"), [CVE-2026-45463](https://nvd.nist.gov/vuln/detail/CVE-2026-45463 "NVD: CVE-2026-45463"), [CVE-2026-45472](https://nvd.nist.gov/vuln/detail/CVE-2026-45472 "NVD: CVE-2026-45472") and [CVE-2026-45474](https://nvd.nist.gov/vuln/detail/CVE-2026-45474 "NVD: CVE-2026-45474")) reach the same target through opened documents. Virtualization and cloud hosts break the boundaries you rely on for separation: - **Hyper-V** (CVE-2026-45607, CVE-2026-45641, CVE-2026-47652): an authenticated attacker inside one guest VM sends crafted file operation requests to hardware resources and executes code on the host. Anything you run on that host, including workloads for other clients or departments, sits below the compromised layer. - **Azure Kubernetes Service** (CVE-2026-32193): an untrusted container configured with host networking reaches a host-level service and breaks out to take control of the AKS worker node. - **Azure Network Adapter** (CVE-2026-45476): a use-after-free in the Linux MANA driver lets an attacker who already controls the host read sensitive data from the guest and raise privileges inside it. Infrastructure servers you rarely touch are also in scope. **[CVE-2026-42987](https://nvd.nist.gov/vuln/detail/CVE-2026-42987 "NVD: CVE-2026-42987")** in Windows Deployment Services and **[CVE-2026-44815](https://nvd.nist.gov/vuln/detail/CVE-2026-44815 "NVD: CVE-2026-44815")** in the DHCP Client both allow code execution over the network, and imaging and DHCP roles tend to live on long-uptime servers that nobody wants to reboot mid-week. The two BitLocker security feature bypass entries, [CVE-2026-45658](https://nvd.nist.gov/vuln/detail/CVE-2026-45658 "NVD: CVE-2026-45658") and [CVE-2026-50507](https://nvd.nist.gov/vuln/detail/CVE-2026-50507 "NVD: CVE-2026-50507"), matter differently: full-disk encryption is the control you point to when a laptop goes missing and you decide whether the loss is reportable. Healthcare providers should check **[CVE-2026-26142](https://nvd.nist.gov/vuln/detail/CVE-2026-26142 "NVD: CVE-2026-26142")** separately. It is a deserialization flaw in Nuance PowerScribe allowing remote code execution, which puts clinical reporting infrastructure in scope alongside your general Windows estate. The friction is real. Kernel, Active Directory and Hyper-V fixes require reboots, and patching a hypervisor means scheduling downtime for every guest running on it. Domain controllers have to be staggered so authentication stays available, and Office updates carry compatibility risk for line-of-business documents and macros that your users depend on daily. Systems that cannot come offline during business hours push your remediation into weekend windows, and any product no longer receiving fixes has to be handled as an isolation problem instead of a patching one. If you operate in a regulated sector, an outstanding critical RCE past your documented remediation window becomes an audit finding on its own, independent of whether anyone exploited it. The same evidence shows up in cyber insurance renewals, where carriers ask how quickly you close critical vulnerabilities and expect records that match your stated policy. ## Patch Prioritisation and Snort Detection Deployment ### Immediate: the exploitation-likelihood list, then the rules Patch by Microsoft's exploitation assessment before you patch by severity rating. The four critical entries Microsoft marked "more likely" (CVE-2026-42985, CVE-2026-47291, CVE-2026-44803 and CVE-2026-44812) go first, and the "important" list carries ten more that Microsoft also flagged as more likely to be exploited. That second list is the one most patch schedules push to the back. It includes: - **[CVE-2026-42980](https://nvd.nist.gov/vuln/detail/CVE-2026-42980 "NVD: CVE-2026-42980")** (NT OS Kernel) and **[CVE-2026-42905](https://nvd.nist.gov/vuln/detail/CVE-2026-42905 "NVD: CVE-2026-42905")** (DWM Core Library) elevation of privilege - **[CVE-2026-42989](https://nvd.nist.gov/vuln/detail/CVE-2026-42989 "NVD: CVE-2026-42989")** (Winlogon) and **[CVE-2026-45586](https://nvd.nist.gov/vuln/detail/CVE-2026-45586 "NVD: CVE-2026-45586")** (CTFMON) elevation of privilege - **[CVE-2026-42986](https://nvd.nist.gov/vuln/detail/CVE-2026-42986 "NVD: CVE-2026-42986")**, an elevation of privilege flaw in the Microsoft Graphics Component - **CVE-2026-45658** and **CVE-2026-50507**, BitLocker security feature bypass issues that matter on any laptop that leaves your office - **[CVE-2026-45481](https://nvd.nist.gov/vuln/detail/CVE-2026-45481 "NVD: CVE-2026-45481")** and **[CVE-2026-47634](https://nvd.nist.gov/vuln/detail/CVE-2026-47634 "NVD: CVE-2026-47634")**, SharePoint Server spoofing - **[CVE-2026-49160](https://nvd.nist.gov/vuln/detail/CVE-2026-49160 "NVD: CVE-2026-49160")**, a denial of service condition in http.sys Privilege escalation on a workstation is what turns a phishing click into domain access, which is why an "important" rating with a "more likely" tag deserves the same week as a critical one. On the detection side, Talos has shipped coverage for this release. Cisco Secure Firewall customers pull it by updating the SRU. Snort Subscriber Ruleset users download the current rule pack from Snort.org. Enable Snort 2 SIDs `66572-66577, 66581, 66589, 66590, 66594, 66595, 66601-66604` and Snort 3 SIDs `301523-301525, 301527-301529, 301531, 301532` on perimeter sensors first, then on internal sensors covering server VLANs. Talos notes additional rules may follow and current rules are subject to change, so treat this pack as a starting point and re-pull it. ### Short term: finish the rollout and prove it Verify installation rather than trusting deployment status. Pull the Windows Update for Business report in Intune or the compliance summary in Configuration Manager, then spot-check hosts by comparing the reported OS build against the build listed in Microsoft's June 2026 update guide for that release. Machines that report "installed, pending restart" for days are unpatched machines. Several entries in this release are service-side. [CVE-2026-48579](https://nvd.nist.gov/vuln/detail/CVE-2026-48579 "NVD: CVE-2026-48579") in Exchange Online, [CVE-2026-48567](https://nvd.nist.gov/vuln/detail/CVE-2026-48567 "NVD: CVE-2026-48567") in Azure HorizonDB, [CVE-2026-47655](https://nvd.nist.gov/vuln/detail/CVE-2026-47655 "NVD: CVE-2026-47655") in Microsoft Graph, and the M365 Copilot command injection flaws [CVE-2026-45497](https://nvd.nist.gov/vuln/detail/CVE-2026-45497 "NVD: CVE-2026-45497") and [CVE-2026-42824](https://nvd.nist.gov/vuln/detail/CVE-2026-42824 "NVD: CVE-2026-42824") are fixed by Microsoft, so your action there is checking the Message Center for tenant guidance instead of scheduling a reboot. Do not skip the third party in the bulletin. CVE-2026-26142 is a deserialization of untrusted data flaw in Nuance PowerScribe permitting code execution over a network, which falls outside your Windows patch channel entirely and needs a vendor ticket. For hosts you cannot patch this cycle, restrict reachability. Block outbound RDP from user subnets so the Remote Desktop Client flaws cannot be triggered by a connection to an attacker-controlled server, and keep any http.sys listener off the public internet unless a business function requires it. In environments Capstone manages, SentinelOne flags the local privilege escalation behaviour these kernel and Winlogon bugs enable, giving cover on machines still waiting in a change window. ### Longer term Build an inventory of every product in the affected list that no longer receives updates, including Outlook (classic) installs and out-of-support server roles, and give each one a segmentation plan or a replacement date. Confirm your SRU and Snort rule pack updates are running on a schedule and alerting on failure, because a detection set that stopped updating three months ago provides no coverage for this release. ## Priorities for This Patch Cycle Two vulnerabilities in this release stand apart from the other 204: **CVE-2026-47291** in the Windows HTTP Protocol Stack and **CVE-2026-45657** in the Windows Kernel. Both are reachable across the network without credentials and without a user clicking anything, which puts them in a different risk class than the Office and Remote Desktop client flaws that need a victim to open a file or connect to an attacker-controlled server. If you have to sequence this month's work around limited maintenance windows, those two set the order. Everything else in the critical list depends on the attacker already having a foothold, a session, a guest VM, or a user willing to open something. The http.sys and kernel flaws do not. The practical difference for your business is where the patch lands first. Your externally reachable web servers, management interfaces, and anything else listening on 80 or 443 carry more exposure than an office workstation behind a firewall, so they should come off the vulnerable list before the general fleet does. One action closes this cycle: confirm that the June updates covering CVE-2026-47291 and CVE-2026-45657 are installed on every internet-facing Windows host, and verify that the corresponding Talos Snort coverage (Snort 2 rules 66572-66577, 66581, 66589, 66590, 66594, 66595, 66601-66604 and Snort 3 rules 301523-301525, 301527-301529, 301531, 301532) is loaded and in blocking mode on the sensors in front of those hosts. Talos notes the ruleset may be updated as more information becomes available, so check that your SRU is current when you validate. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-08-29T18:11:08Z", "datePublished": "2026-08-29T18:11:08Z", "description": "Microsoft's June 2026 security update covers 206 vulnerabilities , 32 of which the company marked critical.", "headline": "Microsoft Patch Tuesday June 2026 Fixes Prominent Vulnerabilities With Snort Rules", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/microsoft-patch-tuesday-june-2026-fixes-prominent-300765" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/microsoft-patch-tuesday-june-2026-fixes-prominent-300765" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```