Exploitation observed; activity peaked at 14 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-09 | 3 | Disclosure1Patch2 |
| 2026-06-10 | 14 | Active Exploitation3Disclosure3General1Patch7 |
| 2026-06-11 | 2 | Patch2 |
| 2026-06-12 | 2 | Disclosure1Patch1 |
| 2026-06-13 | 1 | Patch1 |
| 2026-06-15 | 2 | Patch2 |
| 2026-06-16 | 2 | Active Exploitation1PoC1 |
| 2026-06-18 | 1 | Patch1 |
| 2026-06-19 | 1 | Patch1 |
| 2026-06-21 | 1 | Patch1 |
| 2026-06-23 | 2 | Patch2 |
| 2026-06-24 | 1 | Disclosure1 |
| 2026-07-02 | 1 | General1 |
| 2026-07-03 | 1 | General1 |
| 2026-07-09 | 1 | Disclosure1 |
Microsoft issues emergency fix for HTTP/2 Bomb affecting IIS: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-49160
Post summary
Microsoft released an emergency patch to address the CVE-2026-49160 "HTTP/2 Bomb" vulnerability in IIS.
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
The alert announces newly disclosed zero-day CVEs and high‑severity vulnerabilities impacting Microsoft software, providing technical details and severity scores without evidence of exploitation, PoCs, or patch availability.
CVE-2026-49160 & CVE-2026-47291 PoC https://github.com/dhmosfunk/CVE-2026-49160-CVE-2026-47291-HTTP.sys #CVE_2026_47291_poc #CVE_2026_49160_poc #rce #dos #overflow #microsoft #cve
Post summary
The author shares a proof‑of‑concept for CVE‑2026‑49160 and CVE‑2026‑47291, linking to GitHub code that demonstrates RCE and DoS via an HTTP.sys overflow.
【2026年6月 Patch Tuesday 要注意CVE】 🔴 CVE-2026-45657 CVSS9.8：Windowsカーネル未認証RCE（ワーム化可能） 🟠 CVE-2026-45586：入力メソッドCTFMONの権限昇格（公開済みゼロデイ） 🟡 CVE-2026-49160 CVSS7.5：HTTP/2 Bomb（DoS） 🟡 CVE-2026-50507 CVSS6.8：BitLocker物理突破 史上最大！Microsoftが2026年6月Patch Tuesdayで200件超の脆弱性を修正。うちゼロデイ3件。 特にCVE-2026-45657はCVSS 9.8、認証不要のWindows Kernel RCE——ワーム化可能な最凶クラス。今すぐパッチを → https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws/ #セキュリティ #PatchTuesday #CVE
Post summary
The tweet announces Microsoft’s June 2026 Patch Tuesday, highlights several high‑severity CVEs—including a Windows kernel RCE—and urges users to apply the released patches.
Microsoft June 2026 Patch Tuesday (record-breaker) Microsoft’s June 2026 Patch Tuesday is the largest on record 200 CVEs (~33 critical), beating the prior high of 167. Three publicly disclosed zero-days, none reported exploited in the wild yet: •CVE-2026-45586 — Windows CTFMON EoP to SYSTEM (“GreenPlasma”); flagged Exploitation More Likely •CVE-2026-50507 — BitLocker security feature bypass •CVE-2026-49160 — HTTP.sys (HTTP/2) DoS Updates: Win11 KB5094126 / KB5093998, Win10 KB5094127 (ESU). The Win10 update also tracks the Secure Boot certificate rollover — certs start expiring this month. Test, then deploy. Prioritize the zero-days and critical RCEs. Source: BleepingComputer, KrebsOnSecurity, SecurityWeek @VulnerabilityNw
Post summary
A record-breaking June 2026 Patch Tuesday releases patches for 200 CVEs, including three zero‑day exploits that have not yet been seen in the wild.
Microsoft’s June patch cycle hit a record 206 CVEs. The biggest threat? CVE-2026-49160 (HTTP/2 Bomb)—a DoS flaw draining server RAM in seconds. #HoustonTech sysadmins: Have you pushed your registry fixes yet? 🛠️
Post summary
The tweet highlights a high‑impact DoS vulnerability (CVE‑2026‑49160) in Microsoft’s June patch cycle and urges sysadmins to apply the available registry fix to mitigate the issue.
#Microsoft recently patched a massive batch of vulnerabilities, including two exploited zero-days. One flaw (CVE-2026-49160) impacts IIS servers and was identified via AI, while an elevation of privilege flaw nicknamed "GreenPlasma" was also resolved. Additionally, Microsoft Defender has an unpatched privilege escalation zero-day codenamed "RoguePlanet".
Post summary
Microsoft patched a set of vulnerabilities, including two zero-days that were actively exploited, with troubleshooting or removal of the flaws described.
2.🧵 The 3 actively exploited zero-days: 🔴 CVE-2026-45586 — Windows CTFMON Elevation of Privilege 🔴 CVE-2026-49160 — HTTP/2 Denial of Service 🔴 CVE-2026-50507 — BitLocker Security Feature Bypass All three confirmed exploited before the patch dropped.
Post summary
Three zero-day CVEs—CVE-2026-45586, CVE-2026-49160, and CVE-2026-50507—were actively exploited in the wild before the respective vendor patches were released.
أصدرت مايكروسوفت أكبر حزمة تحديثات أمنية شهرية في تاريخها وتشمل ثغرة حجب خدمة خطيرة في مكدس بروتوكول الويب عدد الثغرات : 198 CVEs - 32 Critical الأبرز : CVE-2026-49160 (HTTP.sys DoS) الحل : Install June 2026 updates #PatchTuesday #Microsoft #CyberSecurity
Post summary
Microsoft has released its most extensive Patch Tuesday bundle, addressing 198 CVEs including the critical HTTP.sys DoS (CVE-2026-49160); users should install the June 2026 updates to mitigate these vulnerabilities.
CVE-2026-49160: HTTP.sys Denial-of-Service Vulnerability Puts Windows Servers at Risk https://hacklido.com/news/cve-2026-49160-http-sys-denial-of-service-vulnerability-puts-windows-servers-at-risk
Post summary
The text announces a new Denial-of-Service vulnerability in Windows HTTP.sys (CVE‑2026‑49160) but does not provide PoC, exploit code, or patch information.
June 2026 Patch Tuesday: 206 Vulnerabilities, Three Zero-Days Including HTTP/2 Bomb Flaw (CVE-2026-49160) https://ift.tt/IlujHSm June 2026 Patch Tuesday: 206 Vulnerabilities, Three Zero-Days Including HTTP/2 Bomb Flaw (CVE-2026-49160) Introduction to Malware Binary Triage (I…
Post summary
The text announces a new zero‑day (CVE‑2026‑49160) as part of June 2026 Patch Tuesday, but it does not provide exploitation, mitigation, or technical details.
#windowsupdate #microsoft つづき ・CVE-2026-45585 Windows BitLocker セキュリティ機能バイパスの脆弱性 ・CVE-2026-45586 Windows Collaborative Translation Framework (CTFMON) の特権昇格の脆弱性 ・CVE-2026-49160 HTTP.sys のサービス拒否の脆弱性 つづく…
Post summary
The tweet announces several newly disclosed Microsoft Windows CVEs (BitLocker bypass, privilege escalation, HTTP.sys DoS) without offering PoC, exploit, or patch details.
#windowsupdate #microsoft つづき ・CVE-2026-47298 8 Microsoft Office SharePoint ・CVE-2026-47634 7.3 Microsoft Office SharePoint ・CVE-2026-49160 7.5 HTTP/2 －対象外：5 件 ・CVE-2026-42824 6.5 M365 Copilot ・CVE-2026-45497 7.7 Microsoft Copilot つづく…
Post summary
The tweet lists several CVE identifiers with associated CVSS scores for a Microsoft Windows update, noting which CVEs are excluded, but does not provide evidence of exploits, patches, or misattribution.
Yikes 🫣 _____ CVE of the Week CVE-2026-49160: High-Severity Denial of Service (DoS) Vulnerability in Windows HTTP.sys This zero-day flaw exposes vulnerable systems to an "HTTP/2 Bomb" attack, where an unauthorized, remote attacker can send a tiny, specially crafted HTTP/2 request that expands rapidly in memory, triggering uncontrolled resource consumption. Why it matters: - Instantaneous crashing of critical, adjacent services sharing the driver. - Complete infrastructure disruption with zero user interaction required. Recommended actions: 1. Install the latest security updates released by Microsoft. 2. If patching must be delayed, consider adjusting web server configurations (such as reducing MaxRequestBytes) to mitigate memory amplification risks. Use this mitigation script to implement the workaround: https://www.vicarius.io/vsociety/posts/cve-2026-49160-mitigation-script-http2-bomb-denial-of-service-vulnerability Let us know if you need help securing your systems or understanding these steps further!
Post summary
The post announces the zero‑day CVE‑2026‑49160, describing a high‑severity DoS via an HTTP/2 Bomb, and advises immediate patching and configuration mitigations.
CVE-2026-49160: HTTP.sys Denial of Service Vulnerability - What It Means for Your Business and How to Respond https://hubs.ly/Q04nvl_T0
Post summary
A brief article title and link point to CVE-2026-49160, noting it is an HTTP.sys DoS vulnerability, but no PoC, exploit details, patch information, or active exploitation evidence are provided.
If you’re looking to reduce your attack surface without the weekend emergency maintenance, start by simplifying your configurations. Here's how we're mitigating CVE-2026-46333, CVE-2026-49160, and CVE-2026-53435. https://www.linkedin.com/pulse/issue-20-complexity-new-vulnerability-vicarius-nedbc/
Post summary
The post mentions three CVEs and states that mitigation efforts are underway, but provides no specifics on PoC, exploits, patches, or technical details.
nu11secur1ty: CVE-2026-49160 https://www.nu11secur1ty.com/2026/06/cve-2026-49160.html?spref=tw
Post summary
The post simply links to a security advisory for CVE-2026-49160, containing no further detail or claims.
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs ( CVE-2026-49160, CVE-2026-50507) http://ow.ly/VFPG106zXRs https://t.co/mBNiIHGjkQ
Post summary
The tweet announces Microsoft's June 2026 Patch Tuesday that addresses 198 CVEs, including CVE-2026-49160 and CVE-2026-50507, and provides a link to the full patch list.
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs ( CVE-2026-49160, CVE-2026-50507) http://ow.ly/rkmL106zU15 https://t.co/5pULCKwJA8
Post summary
Microsoft released Patch Tuesday updates for 198 CVEs, including CVE‑2026‑49160 and CVE‑2026‑50507, providing vendor‑issued fixes.
🚨 June Microsoft Patch Tuesday: 202 vulns fixed 🛠 — 💥 public exploits: HTTP.sys RCE (CVE-2026-47291) + DoS (CVE-2026-49160); notable: BitLocker SFB, Secure Boot SFB, Kernel RCE, DHCP RCE. #PatchTuesday #Microsoft #Windows #Vulristics ➡️ https://avleonov.com/2026/06/17/i077-june-microsoft-patch-tuesday/ https://t.co/knJ4vYpVRe
Post summary
The tweet announces Microsoft’s June Patch Tuesday, noting 202 vulnerabilities fixed and referencing public exploits for CVE-2026-47291 (RCE) and CVE-2026-49160 (DoS).
22 of 22 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | x64 |