Microsoft patches 200 flaws as BitLocker zero-day and Defender RoguePlanet emerge

Microsoft released its largest Patch Tuesday update on record, fixing 200 vulnerabilities across Windows, Office, Azure, Exchange Server, .NET Framework, Hyper-V, Remote Desktop Services, and HTTP.sys, including 33 critical flaws and three publicly disclosed zero-days. The disclosed issues include CVE-2026-50507, a BitLocker security feature bypass that can let an attacker with physical access recover data from affected Windows devices; CVE-2026-49160, an HTTP/2 denial-of-service flaw affecting IIS and services built on HTTP.sys; and CVE-2026-45586, a Windows CTFMON privilege-escalation bug that can give a logged-in attacker SYSTEM privileges. Researchers also highlighted CVE-2026-45657, a wormable Windows kernel use-after-free vulnerability rated CVSS 9.8 that could enable remote, unauthenticated code execution as SYSTEM.

At the same time, security researcher Nightmare Eclipse publicly released RoguePlanet, a separate unpatched Microsoft Defender zero-day exploit that reportedly works on fully updated Windows 10 and Windows 11 systems by abusing a race condition to spawn a SYSTEM-level shell, though reports say it is unreliable and does not currently work on Windows Server in its present form. The BitLocker flaw was disclosed before patches were available and is considered more likely to be exploited, with particular concern for TPM-only deployments because possession of a device may be enough to access protected data. Defenders were urged to rapidly deploy the June cumulative updates, prioritize internet-facing Windows and IIS systems, verify patch compliance, review BitLocker configurations, consider TPM+PIN, and monitor endpoint telemetry for suspicious privilege escalation and activity tied to mounted ISO images.