Patch Tuesday June 2026: what Microsoft shipped

Microsoft published its security updates on Tuesday, 9 June 2026.

On the day, the briefing reads Microsoft's advisories and this page lists what carried a flag. It stays here afterwards as the record.

Which flaws were flagged?

4 flagged by Microsoft as publicly disclosed.

• CVE-2026-45586 Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability Publicly disclosed
• CVE-2026-50656 Microsoft Defender Elevation of Privilege Vulnerability Publicly disclosed
• CVE-2026-49160 HTTP.sys Denial of Service Vulnerability Publicly disclosed
• CVE-2026-50507 Windows BitLocker Security Feature Bypass Vulnerability Publicly disclosed

What PlainSec published

• Blank Entra Logs Can Hide Credential Checks (2026-07-13)
• Exposed AiTM Toolkit Lowers the Bar for MFA Bypass (2026-07-13)
• Signed Driver Lets Ransomware Blind Defenses (2026-07-11)
• AI Scripts Fracture Signature-Based AD Detection (2026-07-10)
• SharePoint Data Theft Moves Through Identity Controls (2026-07-10)
• Encrypted Phishing Hides Until Microsoft Login Loads (2026-07-09)
• Microsoft Device-Code Phishing Becomes Turnkey (2026-07-08)
• Help-Desk Resets Became the Entry Point (2026-07-08)
• Microsoft 365 Phishing Now Leaves Long-Lived Control (2026-07-04)
• MFA Fails on the Legacy OAuth Path (2026-07-02)
• Paste-to-Run Attacks Break Endpoint Assumptions (2026-07-02)
• Defender Flaw Becomes Ransomware’s Privilege Shortcut (2026-07-01)

What the last cycles held

May 2026: 5 flagged.

April 2026: 3 flagged.

March 2026: 2 flagged.

We hold 10 CVEs from Microsoft's 2026-Jun document. That is what our records reach, not the size of the release: it grows for weeks after the day.