CVE-2026-45586Patch(microsoft / windows_10_1607)

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 9 mentions and remains active

Immediate actions

Patch microsoft windows_10_1607 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally.

microsoft CVEs Back to dashboard

6.3/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45586

Weakness type (CWE)

CWE-59

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
23 mentions across 8 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 9 signals
Technical details provided in 20 signals
Disclosure: 7 classified signals
General: 5 classified signals
Peaked 6d ago at 9 mentions (2026-06-10); latest day: 1
23 total mentions across 8 days

Affected systems

Vendors

microsoft

Products

windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016

2 versions affected across 13 products

Deep dive

Activity timeline23 mentions / 8d

Signal classification4 categories

Patch

939.1%

Disclosure

730.4%

General

521.7%

Active Exploitation

28.7%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	3	General1Patch2
2026-06-10	9	Active Exploitation1Disclosure4General1Patch3
2026-06-11	5	Disclosure1General1Patch3
2026-06-12	1	Disclosure1
2026-06-13	2	Disclosure1General1
2026-06-16	1	Active Exploitation1
2026-07-03	1	General1
2026-08-11	1	Patch1

Full discourse20 posts

Horizon Secured@horizon_secured136d
General
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
A Horizon Alert summarizing several new zero‑day CVEs disclosed, each with designations and high CVSS scores, but lacking details about PoCs, exploits, or mitigation steps.
2201761.9K
2.6K followersView on X
0patch@0patch74d
Patch
Micropatches released for "GreenPlasma" Windows Collaborative Translation Framework Elevation of Privilege (CVE-2026-45586) https://0patch.com/blog/micropatches-released-for-greenplasma-windows-collaborative-translation-framework https://t.co/MnvSq4r2h9
Post summary
Micropatches have been issued for CVE‑2026‑45586, an elevation‑of‑privilege flaw in GreenPlasma’s Windows Collaborative Translation Framework. The announcement does not provide exploit details or indicate active use in the wild.
02050583
8.4K followersView on X
Crypto Master💎 Arichain@Vijaykiran0987133d
Disclosure
CVE-2026-45586: Windows CTFMON Elevation of Privilege Flaw https://thecybrdef.com/cve-2026-45586-windows-ctfmon-elevation-of-privilege-flaw/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post introduces CVE-2026-45586, identifying it as a Windows CTFMON Elevation of Privilege vulnerability and links to additional details.
01010122
64 followersView on X
ホーリーデイ@holy519136d
Patch
【2026年6月 Patch Tuesday 要注意CVE】 🔴 CVE-2026-45657 CVSS9.8：Windowsカーネル未認証RCE（ワーム化可能） 🟠 CVE-2026-45586：入力メソッドCTFMONの権限昇格（公開済みゼロデイ） 🟡 CVE-2026-49160 CVSS7.5：HTTP/2 Bomb（DoS） 🟡 CVE-2026-50507 CVSS6.8：BitLocker物理突破史上最大！Microsoftが2026年6月Patch Tuesdayで200件超の脆弱性を修正。うちゼロデイ3件。特にCVE-2026-45657はCVSS 9.8、認証不要のWindows Kernel RCE——ワーム化可能な最凶クラス。今すぐパッチを　→ https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws/ #セキュリティ #PatchTuesday #CVE
Post summary
The post announces the June 2026 Patch Tuesday, noting over 200 fixes including 3 zero‑day CVEs, highlights the critical CVE‑2026‑45657 Windows kernel RCE, and urges users to apply the patch via the provided link.
00020289
997 followersView on X
Elusive@ElusivePrivacy136d
Patch
Microsoft June 2026 Patch Tuesday (record-breaker) Microsoft’s June 2026 Patch Tuesday is the largest on record 200 CVEs (~33 critical), beating the prior high of 167. Three publicly disclosed zero-days, none reported exploited in the wild yet: •CVE-2026-45586 — Windows CTFMON EoP to SYSTEM (“GreenPlasma”); flagged Exploitation More Likely •CVE-2026-50507 — BitLocker security feature bypass •CVE-2026-49160 — HTTP.sys (HTTP/2) DoS Updates: Win11 KB5094126 / KB5093998, Win10 KB5094127 (ESU). The Win10 update also tracks the Secure Boot certificate rollover — certs start expiring this month. Test, then deploy. Prioritize the zero-days and critical RCEs. Source: BleepingComputer, KrebsOnSecurity, SecurityWeek @VulnerabilityNw
Post summary
The post announces Microsoft’s record‐breaking Patch Tuesday, detailing recent zero‑day CVEs and the KB patches that mitigate them, with no evidence of active exploitation or PoC availability.
01010116
184 followersView on X
TheNu11Sector@Nu11Sector130d
Active Exploitation
2.🧵 The 3 actively exploited zero-days: 🔴 CVE-2026-45586 — Windows CTFMON Elevation of Privilege 🔴 CVE-2026-49160 — HTTP/2 Denial of Service 🔴 CVE-2026-50507 — BitLocker Security Feature Bypass All three confirmed exploited before the patch dropped.
Post summary
Three zero-days—CVE‑2026‑45586, CVE‑2026‑49160, and CVE‑2026‑50507—have been confirmed actively exploited in the wild before their patches were released, involving privilege escalation, HTTP/2 DoS, and a BitLocker bypass.
1000087
493 followersView on X
Breachrr@Breachrr135d
General
@Malwarebytes CVE-2026-45586; elevation of privilege to SYSTEM on its own is serious. Combined with any other foothold in the environment it gives an attacker access to credential stores, LSASS, and everything that follows.
Post summary
The tweet notes CVE-2026-45586 as a privilege‑escalation flaw that grants SYSTEM access and credential theft potential, but contains no PoC, exploit code, patch, or evidence of active exploitation.
00010229
23 followersView on X
Erwin Mike Schuster ITAT@Erwin_Mike_S136d
Patch
🚨 Microsoft June 2026 Patch Tuesday just dropped — RECORD 206 CVEs (39 Critical). • CVE-2026-45657 (CVSS 9.8) • CVE-2026-47291 (CVSS 9.8) • CVE-2026-45586 (CVSS 9.8) Plus 3 zero-days (BitLocker bypass + HTTP/2 Bomb). #PatchTuesday #CyberSecurity #CISO https://t.co/vhm88v63VJ
Post summary
Microsoft has released its June 2026 Patch Tuesday updates covering 206 CVEs, including several critical high‑severity and zero‑day vulnerabilities, signaling that patches are now available for these issues.
00010132
38 followersView on X
kawn@kawn2020136d
General
#windowsupdate #microsoft つづき・CVE-2026-45585　Windows BitLocker セキュリティ機能バイパスの脆弱性・CVE-2026-45586　Windows Collaborative Translation Framework (CTFMON) の特権昇格の脆弱性・CVE-2026-49160　HTTP.sys のサービス拒否の脆弱性つづく…
Post summary
The tweet lists three new CVEs with short technical descriptors but lacks any PoC, exploit code, active exploitation evidence, or mitigation details.
10000102
85 followersView on X
kawn@kawn2020136d
Disclosure
#windowsupdate #microsoft つづき・CVE-2026-45481　7.3　Microsoft Office SharePoint ・CVE-2026-45586　7.8　Windows Collaborative Translation Framework ・CVE-2026-45658　7.8　Windows BitLocker ・CVE-2026-47291　9.8　Windows HTTP.sys つづく…
Post summary
The tweet enumerates newly disclosed Microsoft CVEs with their CVSS scores, providing minimal technical data but no information about exploitation or mitigation.
10000108
85 followersView on X
IntegSec@integ_sec113d
General
CVE-2026-45586: Windows Collaborative Translation Framework Privilege Escalation - What It Means for Your Business and How to Respond https://hubs.li/Q04nvVBV0
Post summary
The post announces the Windows Collaborative Translation Framework privilege‑escalation CVE‑2026‑45586, offering contextual information but no PoC, exploitation evidence, patch details, or false‑positive assertions.
0000048
32 followersView on X
cybersecuritypath@cybrsecpath133d
Disclosure
CVE-2026-45586: Windows CTFMON Elevation of Privilege Flaw https://thecybrdef.com/cve-2026-45586-windows-ctfmon-elevation-of-privilege-flaw/ #Cybertrending #Cybernewsdaily #Cybersecurity
Post summary
The post announces CVE‑2026‑45586, an elevation‑of‑privilege flaw in Windows CTFMON, and links to an external article providing further details.
0000028
9 followersView on X
cybersecuritypath@cybrsecpath133d
General
CVE-2026-45586: Windows CTFMON Elevation of Privilege Flaw https://thecybrdef.com/cve-2026-45586-windows-ctfmon-elevation-of-privilege-flaw/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post merely announces the CVE with a link, offering no additional technical or operational details.
0000026
9 followersView on X
Divinmentis@Divinmentis134d
Patch
🔒 33 Critical CVEs patched today. Key: CVE-2026-45586 (CTFMON privilege escalation via improper link resolution) and CVE-2026-50507 (BitLocker bypass, requires physical access). RoguePlanet is hit-or-miss but functional — race to patch vs. exploit is now open.
Post summary
The post announces that 33 critical CVEs have been patched today, highlighting two specific vulnerabilities—CTFMON privilege escalation and a BitLocker bypass—without providing any Proof of Concept or evidence of active exploitation.
0000082
20 followersView on X
Jim Nitterauer 🇺🇸@JNitterauer135d
Patch
🚨 PATCH NOW: Microsoft June Patch Tuesday = 200 flaws, 6 zero-days — 1 actively exploited (CTFMON EoP, CVE-2026-45586). Largest PT in history. AI tools driving the surge. https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-6-zero-days-200-flaws/ #PatchTuesday #ZeroDay #cybersecurity
Post summary
The post urges immediate patching for Microsoft’s June 2026 Patch Tuesday, noting one zero‑day (CVE‑2026‑45586) is already being exploited in the wild.
0000040
8.5K followersView on X
cybersecuritypath@cybrsecpath135d
Disclosure
CVE-2026-45586: Windows CTFMON Elevation of Privilege Flaw https://thecybrdef.com/cve-2026-45586-windows-ctfmon-elevation-of-privilege-flaw/ #Cybertrending #Cybernewsdaily #Cybersecurity
Post summary
The post announces CVE-2026-45586, an elevation‑of‑privilege flaw in Windows CTFMON, providing minimal technical detail without any mention of PoC, exploit, active use, or patch.
0000041
9 followersView on X
セキュリティ対策Lab@securityLab_jp135d
Patch
Microsoft、2026年6月定例パッチで史上最多206件の脆弱性を修正-3件のゼロデイや危険な脆弱性含む(CVE-2026-50507,CVE-2026-45586,CVE-2026-47291,CVE-2026-49160) https://rocket-boys.co.jp/security-measures-lab/microsoft-june-2026-patch-tuesday-record-206-flaws/ #セキュリティ対策Lab #security #securitynews
Post summary
Microsoft released its June‑2026 patch, fixing 206 vulnerabilities—including three zero‑days—without any reporting of active exploitation or availability of PoC or exploit code.
00000165
425 followersView on X
Crypto Master💎 Arichain@Vijaykiran0987135d
Disclosure
CVE-2026-45586: Windows CTFMON Elevation of Privilege Flaw https://thecybrdef.com/cve-2026-45586-windows-ctfmon-elevation-of-privilege-flaw/ #Cybertrending #Cybernewsdaily #Cybersecurity
Post summary
The post announces the discovery of CVE‑2026‑45586, a Windows CTFMON elevation‑of‑privilege flaw, and links to a source for further details, but provides no evidence of exploitation, PoC, or mitigations.
0000030
64 followersView on X
ThreatCluster@threatcluster135d
Disclosure
Microsoft disclosed CVE-2026-45586 in the Windows Collaborative Translation Framework, allowing local users to escalate privileges to SYSTEM, with a CVSS score of 7.8, Cybersecuritynews reported. https://threatcluster.io/cluster/critical-zero-day-vulnerability-in-windows-ctfmon-disclosed-c5142108
Post summary
Microsoft disclosed CVE‑2026‑45586, a privilege‑escalation flaw in Windows Collaborative Translation Framework with a CVSS score of 7.8; no PoC, exploit, or patch details are included.
0000047
318 followersView on X
Aviatrix Threat Research Center@aviatrixtrc135d
Active Exploitation
Attackers chained CVE-2026-49160 (HTTP.sys DoS) with CVE-2026-45586 (privilege escalation) to achieve SYSTEM access and move laterally across networks. Runtime segmentation helps contain such multi-stage attack chains after initial compromise. #ZeroDay 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/microsoft-patch-tuesday-june-2026-zero-day-vulnerabilities
Post summary
Attackers successfully chained a DoS CVE‑2026‑49160 and a privilege‑escalation CVE‑2026‑45586 to gain SYSTEM access and pivot across networks, with analysis provided but no patch or PoC details.
0000058
1.9K followersView on X

CPE platform detail24 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

24 of 24 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2012	-	-	-
OS	microsoft	windows_server_2012	r2	-	-
OS	microsoft	windows_server_2016	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_1607 vulnerabilities

What researchers are saying

CVE-2026-45586

Horizon Secured[verified]@horizon_securedGeneral

A Horizon Alert summarizing several new zero‑day CVEs disclosed, each with designations and high CVSS scores, but lacking details about PoCs, exploits, or mitigation steps.

ホーリーデイ[verified]@holy519Patch

The post announces the June 2026 Patch Tuesday, noting over 200 fixes including 3 zero‑day CVEs, highlights the critical CVE‑2026‑45657 Windows kernel RCE, and urges users to apply the patch via the provided link.

Elusive[verified]@ElusivePrivacyPatch

The post announces Microsoft’s record‐breaking Patch Tuesday, detailing recent zero‑day CVEs and the KB patches that mitigate them, with no evidence of active exploitation or PoC availability.

TheNu11Sector[verified]@Nu11SectorActive Exploitation

Three zero-days—CVE‑2026‑45586, CVE‑2026‑49160, and CVE‑2026‑50507—have been confirmed actively exploited in the wild before their patches were released, involving privilege escalation, HTTP/2 DoS, and a BitLocker bypass.

Breachrr[verified]@BreachrrGeneral

The tweet notes CVE-2026-45586 as a privilege‑escalation flaw that grants SYSTEM access and credential theft potential, but contains no PoC, exploit code, patch, or evidence of active exploitation.

Erwin Mike Schuster ITAT[verified]@Erwin_Mike_SPatch

Microsoft has released its June 2026 Patch Tuesday updates covering 206 CVEs, including several critical high‑severity and zero‑day vulnerabilities, signaling that patches are now available for these issues.

IntegSec[verified]@integ_secGeneral

The post announces the Windows Collaborative Translation Framework privilege‑escalation CVE‑2026‑45586, offering contextual information but no PoC, exploitation evidence, patch details, or false‑positive assertions.

Divinmentis[verified]@DivinmentisPatch

The post announces that 33 critical CVEs have been patched today, highlighting two specific vulnerabilities—CTFMON privilege escalation and a BitLocker bypass—without providing any Proof of Concept or evidence of active exploitation.