June 2026 Patch Tuesday briefing

Executive briefing

Executive Summary

No active exploitation is reported this month, but June is an elevated-risk release due to volume and multiple network-reachable critical flaws. Microsoft shipped 204 CVEs in the 2026-Jun release—up sharply from 119 last month—with 9 Critical issues concentrated in Windows networking and core services. While none are currently in CISA KEV and none are listed as exploited, the combination of remote code execution and privilege escalation fixes creates a strong “patch gap” opportunity for attackers once details and proof-of-concepts circulate.

Risk is further elevated by 3 publicly disclosed vulnerabilities (including HTTP.sys and BitLocker-related issues). Public disclosure shortens defenders’ response window because attackers can move faster from awareness to weaponization, especially in widely deployed Windows components.

Bottom line: Treat June as an elevated-risk month—prioritize Windows network-facing services (HTTP.sys, DHCP, TCP/IP) and rapidly deploy fixes for publicly disclosed issues.

Key Risks

CVE-2026-47291 — HTTP.sys Remote Code Execution (network-reachable)

An attacker could send specially crafted web traffic to a Windows system running the built-in HTTP.sys stack and potentially run code on that server. In real terms, this is the kind of bug that can turn an internet-facing or intranet web service into an initial foothold, enabling data theft, ransomware staging, or pivoting deeper into the environment.

What the attacker needs: Remote access to the service over the network; no user interaction required. If the target exposes HTTP.sys-based services (directly or via an application that relies on it), exploitation can be attempted at scale through scanning and automated requests. Why it matters: compromises here are high-leverage—attackers can go from “reachable host” to “owned host,” then use that access for lateral movement and credential theft.

CVE-2026-44815 — DHCP Client Service Remote Code Execution (network-reachable)

This vulnerability can allow an attacker to take over a Windows machine by abusing how it processes DHCP-related network traffic. A realistic scenario is an attacker on the same network segment (or with the ability to influence DHCP responses) triggering the flaw to execute code on endpoints and servers as they obtain or renew network configuration.

What the attacker needs: Network position—for example, presence on the same local network, a compromised device on the segment, or the ability to spoof/relay DHCP-related traffic. No user click is required. Why it matters: DHCP touches large numbers of devices; a single network foothold can become a force multiplier for rapid spread, accelerating ransomware propagation and broad endpoint compromise.

CVE-2026-42904 — Windows TCP/IP Elevation of Privilege (network-triggered path to full compromise)

This issue affects Windows TCP/IP handling in a way that can enable an attacker to gain higher privileges under certain conditions. In practice, this is most dangerous when paired with another foothold: an attacker who can already execute limited code or interact with the host over the network may be able to convert that access into system-level control, disabling security tools and taking over the machine.

What the attacker needs: No user interaction, but typically some form of network reachability and a viable path to trigger the vulnerable behavior. Why it matters: privilege escalation is how intrusions become incidents—turning a contained compromise into domain-wide impact through credential dumping, persistence, and lateral movement.

CVE-2026-45586 — Windows CTFMON Elevation of Privilege (publicly disclosed)

This publicly disclosed Windows elevation-of-privilege flaw can help an attacker move from a basic user-level foothold to higher privileges on a machine. A common real-world pattern is: phishing or initial malware execution lands as a standard user, then the attacker uses a local privilege escalation like this to disable defenses, access sensitive data, and establish durable persistence.

What the attacker needs: Existing code execution on the target (e.g., the attacker already got a user to run something, or already compromised a low-privilege account). No additional user interaction is typically required once the attacker is on the box. Why it matters: publicly disclosed privilege escalation bugs are frequently used to “finish the job” after initial access, increasing the likelihood of ransomware deployment and broader compromise.

CVE-2026-50507 — Windows BitLocker Security Feature Bypass (publicly disclosed)

This publicly disclosed issue can allow an attacker to bypass BitLocker protections under certain physical-access conditions, undermining a key control used to protect data on lost or stolen devices. The real-world scenario is a stolen laptop or a device accessed by an insider/contractor where the attacker attempts to access protected data without authorized authentication.

What the attacker needs: Physical access to the device (hands-on). No user click is required. Why it matters: this is a direct data exposure and compliance risk (regulated data on endpoints), and it weakens confidence in endpoint loss/theft scenarios—especially for executives, developers, and administrators with high-value credentials or sensitive data locally cached.

Threat Landscape

June’s release shows a significant jump in volume (204 vs. 119 last month) with pressure concentrated in Windows and ESU, and a heavy mix of Elevation of Privilege (66) and Remote Code Execution (54). That combination is operationally important: attackers commonly chain an initial remote entry point (or phishing foothold) with privilege escalation to reach full control and spread.

Although no in-the-wild exploitation is reported, public disclosure of three vulnerabilities compresses patch timelines—especially for HTTP.sys and Windows security controls. The presence of multiple critical, network-reachable Windows issues (HTTP.sys, DHCP, TCP/IP) suggests defenders should assume rapid attacker interest once patch diffing and tooling catches up.

Recommended Actions

1. Patch immediately: Windows network-facing components — prioritize CVE-2026-47291 (HTTP.sys RCE) and CVE-2026-44815 (DHCP Client RCE). Owner: Windows Server/Endpoint Engineering. Focus first: internet-facing servers, DMZ assets, and high-value internal service tiers.

2. Fast-track fixes for publicly disclosed issues — deploy updates for CVE-2026-45586 (CTFMON EoP) and CVE-2026-49160 (HTTP.sys DoS) to reduce the window for copycat exploitation and operational disruption. Owner: Endpoint Engineering + Server Ops.

3. Harden exposure while patching rolls out — reduce attack surface by limiting inbound access to Windows web services to required sources only, and ensure segmentation between user networks and server subnets to blunt DHCP/TCP/IP abuse paths. Owner: Network/Security Engineering.

4. Assume chaining and hunt for post-compromise behaviors — increase monitoring for privilege escalation and lateral movement on Windows endpoints/servers while patches propagate (e.g., unusual service creation, credential access attempts, and unexpected admin token use). Owner: SOC/Detection Engineering.

5. Validate BitLocker posture for high-risk fleets — for laptops and privileged-user devices, confirm BitLocker configuration and recovery key handling align with policy, and prioritize patching for CVE-2026-50507 where physical-loss risk is highest. Owner: Endpoint Security + IT Asset Management.

Technical briefing

Technical Summary

Microsoft’s June 2026 Patch Tuesday delivers 204 CVEs (9 Critical, 137 High, 52 Medium, 5 Low, 1 unrated), a sharp increase from May 2026’s 119 CVEs (with 8 Critical). There are 0 actively exploited vulnerabilities reported this month and 0 entries mapped to CISA KEV. However, 3 CVEs are publicly disclosed, which materially increases near-term weaponization risk even without confirmed in-the-wild exploitation.

The dominant themes are Elevation of Privilege (66) and Remote Code Execution (54), together accounting for the bulk of the release and reflecting a familiar attacker playbook: gain initial execution (phishing, web app foothold, or lateral movement), then escalate privileges and expand control. What makes this month notable is the concentration of network-reachable, unauthenticated Critical RCEs in core Windows components and adjacent enterprise surfaces (notably HTTP.sys and DHCP), plus a publicly disclosed BitLocker security feature bypass that can directly undermine endpoint data protection in physical-access scenarios.

Key finding: Multiple unauthenticated, network-reachable Critical RCEs in Windows networking surfaces (notably HTTP.sys and DHCP) create high-impact exposure for internet-facing or broadly reachable enterprise services even without confirmed active exploitation.

Critical & Exploited Vulnerabilities

CVE-2026-47291 — HTTP.sys Remote Code Execution Vulnerability

With a Critical 9.8 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWEs pointing to integer overflow/wraparound and heap-based buffer overflow, this is the archetypal “send a packet, get code execution” risk profile. The prerequisites implied by the vector are straightforward: the target must be network-reachable on an HTTP.sys-backed listener (common in Windows server roles and some application stacks), with no authentication and no user interaction required. In real-world attack chains, this is the kind of bug that enables initial access (internet-facing service compromise) or rapid lateral movement inside flat networks where Windows HTTP services are exposed.

Operationally, defenders should treat this as an “exposure-driven” emergency: if HTTP.sys is reachable from untrusted networks, exploitation can plausibly yield remote code execution in the context of the service, followed by credential theft, persistence (service installation, scheduled tasks), and domain escalation. While not marked exploited, the combination of low complexity, no auth, and a widely deployed component makes it a prime candidate for fast PoC-to-exploit conversion.

CVE-2026-44815 — DHCP Client Service Remote Code Execution Vulnerability

CVE-2026-45602 — Windows DHCP Tampering Vulnerability

These two Critical DHCP issues form a coherent network-layer attack pattern: compromise or manipulate DHCP behavior to gain execution or influence host configuration at scale. CVE-2026-44815 is Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with CWE-121 stack-based buffer overflow, indicating a memory corruption path that can plausibly be triggered by malicious DHCP responses. The practical prerequisite is network positioning: an attacker typically needs to be on the same broadcast domain (or otherwise able to inject/relay DHCP traffic), which aligns with post-compromise scenarios (rogue device on a floor network, compromised Wi-Fi segment, or attacker-controlled VM in a shared VLAN).

CVE-2026-45602 is Critical 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and maps to CWE-349 (acceptance of extraneous untrusted data with trusted data)—a strong signal for configuration manipulation rather than pure code execution. In practice, DHCP tampering can be weaponized to push malicious DNS servers, rogue gateways, or other network parameters that enable traffic interception, credential capture, and transparent redirection to internal phishing or malware staging infrastructure.

Together, these vulnerabilities matter because DHCP is a high-leverage enterprise control plane: a single attacker with the right network vantage can target many endpoints quickly. A realistic chain is: gain a foothold on a workstation → pivot to a local segment → inject malicious DHCP responses → achieve RCE on clients (CVE-2026-44815) or redirect traffic for credential theft and further compromise (CVE-2026-45602).

CVE-2026-45657 — Windows Kernel Remote Code Execution Vulnerability

This is a Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) kernel RCE with memory safety CWEs (CWE-416 use-after-free, CWE-122 heap-based buffer overflow). The vector suggests network-based triggering without authentication or user interaction, which is atypical for many kernel bugs and therefore especially concerning: it implies a remotely reachable kernel attack surface (often via a network-exposed driver/protocol path). In real-world terms, successful exploitation would likely yield SYSTEM-level code execution, immediately enabling credential dumping, EDR tampering attempts, and rapid lateral movement.

From an attacker’s perspective, kernel RCE is a “break glass” capability: it can bypass many user-mode controls and can be used to deploy stealthier payloads. Even without confirmed exploitation, organizations with exposed Windows network services should prioritize patching because kernel-level compromise tends to be high-impact and high-confidence once a working exploit exists.

CVE-2026-42904 — Windows TCP/IP Elevation of Privilege Vulnerability

This Critical 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) issue is notable for two reasons: it targets TCP/IP, and it has Adjacent Network (AV:A) scope—meaning exploitation typically requires the attacker to be on the same network segment or otherwise able to interact at L2/L3 proximity. The CWE (heap-based buffer overflow) and Scope: Changed (S:C) indicate the potential to cross a security boundary, consistent with privilege escalation or escaping a constrained context.

In practical attack scenarios, this is a strong fit for post-compromise escalation and lateral movement hardening bypass: once an attacker has any presence on a local network (compromised endpoint, rogue device, or foothold in a branch office), they can target nearby Windows hosts to elevate privileges and expand control. Because it’s in the networking stack, exploitation may be possible without relying on higher-level services being enabled—making it relevant even in environments that believe they have minimized exposed services.

CVE-2025-10263 — ARM TLBI Completion / Memory Access Ordering Issue (Windows/ESU)

This Critical 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is a local attack surface issue affecting ARM behavior around TLBI (Translation Lookaside Buffer Invalidate) completion and memory access ordering. The vector indicates no privileges required but local access is required, which maps cleanly to scenarios where an attacker already has code execution as an unprivileged user (or can run code locally via a sandbox escape, malicious app install, or supply-chain compromise).

The real-world risk is primarily privilege escalation and boundary crossing on ARM-based Windows devices (including modern enterprise endpoints and specialized deployments). In a chain, this kind of bug is often used after initial access to move from user context to a more privileged context, enabling credential access and persistence. While not a typical “wormable” vector, it is high impact for endpoint compromise where local execution is already achieved.

CVE-2026-47281 — Visual Studio Code Elevation of Privilege Vulnerability

This Critical 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) targets Visual Studio Code and is mapped to missing authorization and missing authentication for a critical function (CWE-862, CWE-306). The vector is telling: it’s network-reachable and requires user interaction. In practical terms, this often translates to a developer being induced to open a crafted workspace/repository, connect to a malicious extension/service, or interact with a feature that triggers a privileged action without proper checks.

The real-world risk is concentrated in developer-heavy environments where VS Code is ubiquitous and often integrated with credentials, source code, and remote development workflows. A plausible chain is: attacker delivers a lure repo or extension → user interaction triggers the vulnerable path → attacker gains elevated capabilities within the editor context and potentially crosses boundaries (S:C) into the host environment, enabling credential theft (cloud tokens, SSH keys), source code exfiltration, and lateral movement into CI/CD systems.

CVE-2026-47643 — Azure Stack Edge Remote Code Execution Vulnerability

This Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affects Azure Stack Edge and maps to CWE-73 (external control of file name or path), consistent with path traversal or unsafe file path handling leading to code execution. The prerequisites are minimal: network access, no authentication, no user interaction. For edge appliances that bridge on-prem and cloud workflows, this is a high-value target—compromise can provide a durable foothold with visibility into data movement and potentially privileged connectivity into internal networks.

In real-world operations, attackers prize edge infrastructure because it often has high uptime, broad trust, and less monitoring than endpoints. Successful exploitation could enable persistence on the appliance, interception or manipulation of data flows, and pivoting into internal segments that treat the appliance as trusted infrastructure.

CVE-2026-26142 — Nuance PowerScribe Remote Code Execution Vulnerability

This Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is a classic deserialization of untrusted data flaw (CWE-502) in Nuance PowerScribe, a product commonly found in healthcare environments. The vector indicates unauthenticated network RCE with no user interaction—exactly the profile that enables rapid compromise of specialized application servers that may be less frequently patched and heavily relied upon.

The real-world risk is amplified by typical deployment realities: PowerScribe systems may sit in segmented but reachable clinical networks, and downtime sensitivity can delay patching. Attackers can weaponize this for initial access, then move laterally to EHR systems, file shares, and identity infrastructure. Given the prevalence of ransomware targeting healthcare, this is a high-consequence vulnerability even absent confirmed exploitation.

CVE-2026-49160 — HTTP.sys Denial of Service Vulnerability (Publicly disclosed)

This High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) DoS in HTTP.sys is publicly disclosed, which increases the likelihood of opportunistic disruption. The prerequisites are minimal—network-reachable, no auth, no user interaction—making it attractive for nuisance actors and for attackers seeking to degrade availability as a diversion during intrusion activity.

While it “only” impacts availability, the operational impact can be severe for internet-facing services (IIS/HTTP.sys-backed endpoints) and internal line-of-business apps. DoS can also be used to force failovers, trigger incident response fatigue, or mask exploitation attempts against other services.

Detection coverage: 1 GitHub PoC available.

CVE-2026-50507 — Windows BitLocker Security Feature Bypass (Publicly disclosed)

This Medium 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is publicly disclosed and targets BitLocker with CWE-306 (missing authentication for critical function). The physical (AV:P) vector is the key constraint: exploitation requires hands-on access to the device (lost/stolen laptop, malicious insider, or brief access during travel). In those scenarios, a BitLocker bypass can directly undermine a core enterprise control—data-at-rest protection—leading to credential recovery (cached tokens, browser artifacts), sensitive file access, and potential reuse of secrets to access corporate resources.

This is particularly relevant for organizations relying on BitLocker as the primary mitigation for endpoint loss. Public disclosure increases the risk of “commodity” misuse by non-advanced actors who can follow published steps.

Detection coverage: 1 GitHub PoC available.

CVE-2026-45586 — Windows CTFMON Elevation of Privilege (Publicly disclosed)

This High 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) EoP is publicly disclosed and maps to CWE-59 (link following), a common class for local privilege escalation via symlink/hardlink abuse or path redirection. The prerequisites are typical for workstation post-compromise: the attacker needs local access and low privileges, with no user interaction required.

In real-world chains, this is the kind of bug used after initial foothold (phishing, drive-by, malicious installer) to jump to higher privileges, disable security tooling, dump credentials, and establish persistence. Public disclosure makes it especially relevant for commodity malware operators who routinely incorporate well-documented LPE techniques.

Threat Category Analysis

Elevation of Privilege (66 — ~32% of total)

EoP remains the largest category, consistent with attacker reality: initial access is often achievable, but privilege escalation is required to disable defenses, access credentials, and move laterally. This month’s standout EoP risks include the Critical Windows TCP/IP EoP (CVE-2026-42904)—notable for its adjacent-network prerequisite—and the publicly disclosed CTFMON LPE (CVE-2026-45586), which fits common post-phish escalation playbooks.

Remote Code Execution (54 — ~26% of total)

RCE volume remains high, with several Critical, unauthenticated, network-reachable entries that are operationally urgent due to exposure risk: HTTP.sys RCE (CVE-2026-47291), DHCP Client RCE (CVE-2026-44815), Windows Kernel RCE (CVE-2026-45657), and third-party/adjacent enterprise surfaces like Nuance PowerScribe (CVE-2026-26142) and Azure Stack Edge (CVE-2026-47643). The pattern signals continued attacker interest in service-side compromise that bypasses phishing and user interaction entirely.

Security Feature Bypass (19 — ~9% of total)

Security feature bypasses are fewer but strategically important because they erode trust in baseline controls. The publicly disclosed BitLocker bypass (CVE-2026-50507) is the key example: it doesn’t need network access, but it directly threatens data-at-rest assumptions in loss/theft and insider scenarios.

Spoofing + Information Disclosure (27 + 27 — ~26% combined)

The combined volume suggests steady pressure on identity and data exposure surfaces—often used to improve success rates of social engineering, credential capture, or lateral movement. Even when not headline-grabbing, these issues frequently become “force multipliers” when chained with EoP/RCE to reduce attacker friction.

Denial of Service (7 — ~3%)

DoS is a smaller slice but includes a publicly disclosed HTTP.sys issue (CVE-2026-49160) that is trivial to operationalize against exposed services. DoS also appears in real intrusions as a distraction or to induce operational chaos during ransomware staging.

Product Impact

Windows / ESU (Windows: 120; ESU: 103)

Windows remains the center of gravity, and the Critical set is heavily Windows networking and kernel-adjacent: HTTP.sys RCE (CVE-2026-47291), DHCP Client RCE (CVE-2026-44815), DHCP tampering (CVE-2026-45602), Windows Kernel RCE (CVE-2026-45657), and Windows TCP/IP EoP (CVE-2026-42904). Operationally, this means patching isn’t just “endpoint hygiene”—it’s directly tied to service exposure management (what’s listening where) and segmentation assumptions (adjacent-network attack paths).

The publicly disclosed Windows issues—CTFMON EoP (CVE-2026-45586), HTTP.sys DoS (CVE-2026-49160), and BitLocker bypass (CVE-2026-50507)—create immediate pressure on workstation fleets and exposed server roles even without KEV inclusion.

Microsoft Office (54)

Office is heavily represented in volume, which typically correlates with user-driven attack paths (documents, add-ins, preview handlers). Even though none of the listed Critical/Disclosed CVEs here are Office-specific, the footprint matters operationally: Office patch latency is a common gap, and Office endpoints often serve as the initial execution point that later chains into Windows EoP (e.g., CTFMON) for full compromise.

Developer Tools (11)

Developer Tools are a high-value target category because they sit at the intersection of credentials, source code, and deployment pipelines. The Critical VS Code issue (CVE-2026-47281) is the standout: even with user interaction required, developer workflows (opening repos, extensions, remote sessions) create frequent opportunities for attacker-controlled content to enter trusted environments.

Azure (3)

Azure’s smaller count belies the potential blast radius: Azure Stack Edge RCE (CVE-2026-47643) targets infrastructure that often has privileged network placement and long-lived credentials. These systems are also commonly under-monitored compared to endpoints, increasing dwell time risk if compromised.

Detection & Response

Immediate Detection Actions

• For CVE-2026-49160 (HTTP.sys DoS): validate whether the available GitHub PoC (1) matches traffic patterns seen at your perimeter. Prioritize WAF/reverse-proxy telemetry and server-side HTTP error spikes for services backed by HTTP.sys.
• For CVE-2026-50507 (BitLocker bypass): review the available GitHub PoC (1) to understand the attacker workflow, then align endpoint monitoring around boot/volume access anomalies and unexpected recovery key usage in enterprise management workflows.

Hunting Guidance

• Targeting HTTP.sys exposure and exploitation attempts (CVE-2026-47291, CVE-2026-49160): hunt for unusual inbound request bursts to Windows hosts providing HTTP services, especially patterns that precede service crashes, rapid worker restarts, or anomalous child processes spawned by service contexts. Correlate with new outbound connections from the same host immediately after suspicious inbound traffic (a common post-RCE beaconing pattern).
• DHCP manipulation and client-side compromise (CVE-2026-44815, CVE-2026-45602): hunt for endpoints that suddenly shift DNS servers/gateways outside expected ranges, repeated DHCP renewals, or multiple hosts adopting identical unexpected resolver settings. In segmented networks, look for rogue DHCP behavior (multiple DHCP servers responding) and endpoints receiving offers from non-authorized infrastructure.
• Local privilege escalation post-compromise (CVE-2026-45586): hunt for suspicious file/link activity in user-writable paths followed by privilege boundary changes (new high-integrity processes, service creation, or credential access). Link-following LPEs often show a pattern of rapid file operations and privileged writes to locations normally protected.

Priority Log Sources

• Windows Security Event Logs (process creation, privilege use, service installation) and Sysmon (if deployed) for correlating inbound service activity to process anomalies.
• Network telemetry: DHCP logs (server-side), switch/router DHCP snooping (where available), and DNS resolver logs to detect tampering outcomes.
• Web/service telemetry: IIS/HTTP service logs, reverse proxy/WAF logs, and load balancer metrics to spot HTTP.sys-adjacent scanning, exploit attempts, and DoS patterns.
• Device management / encryption management logs for BitLocker-related events, recovery key access workflows, and unexpected changes in encryption state.

Patching Priority

Tier 1 — Immediate (Actively Exploited / KEV)

No CVEs reported as actively exploited and no CISA KEV entries this month.

Tier 2 — High Priority

• CVE-2026-47291 — Critical unauthenticated network RCE in HTTP.sys; prioritize any internet-facing or broadly reachable Windows HTTP services.
• CVE-2026-44815 — Critical DHCP Client RCE; high risk in campus/branch networks where adjacent attackers can inject DHCP responses.
• CVE-2026-45602 — Critical DHCP tampering; enables large-scale traffic redirection and credential interception in flat networks.
• CVE-2026-45657 — Critical Windows Kernel RCE; treat as high-impact for any reachable attack surface implied by your environment.
• CVE-2026-42904 — Critical TCP/IP adjacent-network EoP; prioritize environments with shared VLANs, OT/IT overlap, or weak segmentation.
• CVE-2026-47643 — Critical Azure Stack Edge RCE; high-value infrastructure target with strong pivot potential.
• CVE-2026-26142 — Critical Nuance PowerScribe RCE (CWE-502); prioritize healthcare and other specialized app environments where patch lag is common.
• CVE-2026-47281 — Critical VS Code EoP requiring user interaction; prioritize developer workstations and build environments.
• CVE-2026-45586 — Publicly disclosed Windows CTFMON EoP; prioritize endpoints where initial access risk is high (email-heavy roles, contractors, shared workstations).
• CVE-2026-49160 — Publicly disclosed HTTP.sys DoS; prioritize externally exposed services to reduce disruption risk.

Tier 3 — Standard

Proceed with standard SLAs for the remaining High/Medium CVEs, prioritizing by exposure and role: Windows/ESU fleets (broadest footprint), then Office endpoints (common initial access surface), followed by Developer Tools and Azure components based on where privileged credentials and control-plane access concentrate. Include CVE-2026-50507 (publicly disclosed BitLocker bypass) in baseline endpoint patching and validate operational controls for lost/stolen device response, especially for traveling users and high-risk roles.