CVE-2026-50507Patch(microsoft / windows_10_1607)

HIGHCVSS 6.8 · MEDIUM

Exploitation observed; activity peaked at 17 mentions and remains active

Immediate actions

Patch microsoft windows_10_1607 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

microsoft CVEs Back to dashboard

6.3/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50507

Weakness type (CWE)

CWE-306

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2

Threat summary

Active exploitation appears in 3 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
37 mentions across 9 observed days

What's happening

Active exploitation reported across 3 signals
PoC mentioned or linked in 5 signals
Patch or workaround mentioned in 23 signals
Technical details provided in 22 signals
Disclosure: 9 classified signals
General: 5 classified signals
Peaked 7d ago at 17 mentions (2026-06-10); latest day: 1
37 total mentions across 9 days

Affected systems

Vendors

microsoft

Products

windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_23h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016

1 version affected across 13 products

Deep dive

Activity timeline37 mentions / 9d

Signal classification5 categories

Patch

1951.4%

Disclosure

924.3%

General

513.5%

Active Exploitation

38.1%

PoC

12.7%

Referenced assets22 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	2	General1Patch1
2026-06-10	17	Active Exploitation1Disclosure7General1Patch7PoC1
2026-06-11	7	Active Exploitation1Disclosure2Patch4
2026-06-12	3	General1Patch2
2026-06-13	3	Patch3
2026-06-16	2	Active Exploitation1General1
2026-06-19	1	General1
2026-06-21	1	Patch1
2026-06-23	1	Patch1

Full discourse20 posts

Cyber Security News@The_Cyber_News136d
Disclosure
🚨 Windows BitLocker 0-Day Vulnerability Allows Attackers to Bypass Security Feature Source: https://cybersecuritynews.com/windows-bitlocker-0-day-bypass-vulnerability/ Microsoft disclosed a new Windows BitLocker Security Feature Bypass vulnerability, tracked as CVE-2026-50507, on June 9, 2026, as part of its June Patch Tuesday security release. The flaw, rooted in a protection mechanism failure, allows an unauthorized attacker with physical access to bypass BitLocker Device Encryption and access sensitive data on the system's storage device. While there is no evidence of active exploitation at the time of release, proof‑of‑concept code exists, which typically accelerates the adoption of attacks. #cybersecuritynews
Post summary
Microsoft disclosed CVE‑2026‑50507, a BitLocker bypass vulnerability, and noted that proof‑of‑concept code exists though no active exploitation has been observed; a patch was released as part of the June Patch Tuesday update.
38473158216.3K
69.7K followersView on X
elhacker.NET@elhackernet136d
Disclosure
Nueva Vulnerabilidad 0-day de Windows BitLocker permite saltar la seguridad Microsoft reveló el 9 de junio de 2026 una vulnerabilidad de omisión de la función de seguridad de Windows BitLocker , identificada como CVE-2026-50507 https://blog.elhacker.net/2026/06/vulnerabilidad-0-day-de-windows.html
Post summary
A new 0‑day vulnerability in Windows BitLocker (CVE‑2026‑50507) has been disclosed by Microsoft and elaborated on in a blog article, but no PoC, exploit, or patch details are shared.
122158152.8K
141.0K followersView on X
Horizon Secured@horizon_secured136d
General
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 After just one month without zero-days, we’re back to 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and multiple nasty 9+ vulnerabilities. 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 🔸 CVE-2026-50507 – BitLocker Security Feature Bypass (YellowKey?) 🔸 CVE-2026-49160 – HTTP.sys Denial of Service 🔸 CVE-2026-45586 – CTFMON Elevation of Privilege 𝟵.𝟬+ 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 🔹 CVE-2026-45602 – Windows DHCP Server Tampering (9.1) 🔹 CVE-2026-42904 – Windows TCP/IP Elevation of Privilege (9.6) 🔹 CVE-2026-44815 – Windows DHCP Client Remote Code Execution (9.8) 🔹 CVE-2026-45657 – Windows Kernel Remote Code Execution (9.8) 🔹 CVE-2026-47291 – HTTP.sys Remote Code Execution (9.8) Full breakdown in this month’s Horizon Alert. #PatchTuesday #CyberSecurity #ZeroDay #Vulnerability #Microsoft
Post summary
The alert enumerates several high‑severity CVEs with brief type and score information, but provides no proof of concept, exploit code, or evidence of active attacks.
2201761.9K
2.6K followersView on X
Jaden Johnson@JadenJohnsNews134d
Disclosure
🚨 Microsoft disclosed a new Windows BitLocker 0-day vulnerability (CVE-2026-50507) that allows security protections to be bypassed. #CyberSecurity #InfoSec #Windows #BitLocker https://t.co/ELMkCLUTJE
Post summary
The tweet announces that Microsoft has disclosed a new 0‑day vulnerability (CVE-2026-50507) in Windows BitLocker that enables bypass of security protections. No PoC, exploit, patch, or active exploitation details are provided.
00011385
229 followersView on X
ホーリーデイ@holy519136d
Patch
【2026年6月 Patch Tuesday 要注意CVE】 🔴 CVE-2026-45657 CVSS9.8：Windowsカーネル未認証RCE（ワーム化可能） 🟠 CVE-2026-45586：入力メソッドCTFMONの権限昇格（公開済みゼロデイ） 🟡 CVE-2026-49160 CVSS7.5：HTTP/2 Bomb（DoS） 🟡 CVE-2026-50507 CVSS6.8：BitLocker物理突破史上最大！Microsoftが2026年6月Patch Tuesdayで200件超の脆弱性を修正。うちゼロデイ3件。特にCVE-2026-45657はCVSS 9.8、認証不要のWindows Kernel RCE——ワーム化可能な最凶クラス。今すぐパッチを　→ https://www.bleepingcomputer.com/news/microsoft/microsoft-june-2026-patch-tuesday-fixes-3-zero-day-200-flaws/ #セキュリティ #PatchTuesday #CVE
Post summary
The tweet announces Microsoft’s June 2026 Patch Tuesday, listing several high‑severity CVEs, including a Windows kernel RCE, and urges users to apply the 200+ patches, among which three are zero‑day flaws.
00020289
997 followersView on X
Elusive@ElusivePrivacy136d
Disclosure
Microsoft June 2026 Patch Tuesday (record-breaker) Microsoft’s June 2026 Patch Tuesday is the largest on record 200 CVEs (~33 critical), beating the prior high of 167. Three publicly disclosed zero-days, none reported exploited in the wild yet: •CVE-2026-45586 — Windows CTFMON EoP to SYSTEM (“GreenPlasma”); flagged Exploitation More Likely •CVE-2026-50507 — BitLocker security feature bypass •CVE-2026-49160 — HTTP.sys (HTTP/2) DoS Updates: Win11 KB5094126 / KB5093998, Win10 KB5094127 (ESU). The Win10 update also tracks the Secure Boot certificate rollover — certs start expiring this month. Test, then deploy. Prioritize the zero-days and critical RCEs. Source: BleepingComputer, KrebsOnSecurity, SecurityWeek @VulnerabilityNw
Post summary
Microsoft’s June 2026 Patch Tuesday announced the largest patch batch to date, revealing 200 CVEs including three newly disclosed zero‑day vulnerabilities that are not yet known to be exploited, with corresponding patches now available.
01010116
184 followersView on X
TheNu11Sector@Nu11Sector130d
Active Exploitation
2.🧵 The 3 actively exploited zero-days: 🔴 CVE-2026-45586 — Windows CTFMON Elevation of Privilege 🔴 CVE-2026-49160 — HTTP/2 Denial of Service 🔴 CVE-2026-50507 — BitLocker Security Feature Bypass All three confirmed exploited before the patch dropped.
Post summary
The tweet reports that three zero‑day CVEs were actively exploited before their patches were released.
1000087
493 followersView on X
Crypto Master💎 Arichain@Vijaykiran0987133d
Patch
Windows BitLocker Bypass CVE-2026-50507: New Security Alert & Patch Fix https://thecybrdef.com/windows-bitlocker-bypass-cve-2026-50507-new-security-alert-patch-fix/ #Cybertrending #Cybernewsdaily #Cybersecurity
Post summary
The message announces a new security alert for CVE‑2026‑50507 and a corresponding patch, but provides no technical exploitation details or evidence of active attacks.
0001048
64 followersView on X
pp4mnk ⚙️ Developer. Hacker. Optimizer. ⚡DEV@pp4mnk_style135d
Disclosure
🚨 Nueva 0-day de Windows rompe BitLocker. Microsoft confirmó el 9 de junio de 2026 la vulnerabilidad CVE-2026-50507, que permite saltarse la protección de BitLocker y acceder a datos cifrados sin la seguridad esperada. 🔐⚠️ #Windows #BitLocker #CyberSecurity #0day #Hacking #Inf
Post summary
Microsoft confirmed a new zero‑day CVE-2026-50507 that bypasses BitLocker and allows attackers to access encrypted data.
1000072
692 followersView on X
Gabrielle Vaucan@GabrielleVaucan136d
Disclosure
🇫🇷/ Vérifiez votre version Windows ❗️ Microsoft a révélé une nouvelle vulnérabilité de contournement de la fonctionnalité de sécurité BitLocker de Windows, référencée CVE-2026-50507, le 9 juin 2026, dans le cadre de sa mise à jour de sécurité du Patch Tuesday de juin. Cette faille, due à une défaillance d'un mécanisme de protection, permet à un attaquant non autorisé disposant d'un accès physique de contourner le chiffrement BitLocker et d'accéder à des données sensibles sur le périphérique de stockage du système. Cette vulnérabilité correspond à CWE 306 (Authentification manquante pour une fonction critique), ce qui indique qu'une fonction critique de BitLocker peut être déclenchée sans contrôles d'authentification appropriés. Cette faille présente un score de base CVSS v3.1 de 6,8 (Important), avec un vecteur d'attaque physique, une faible complexité, aucun privilège requis et aucune interaction de l'utilisateur nécessaire. Vulnérabilité zéro-day de BitLocker sous Windows En pratique, cela signifie que toute personne ayant un accès direct à un appareil vulnérable pourrait contourner le chiffrement BitLocker et accéder aux données sous-jacentes. La vulnérabilité affecte un large éventail de versions client et serveur Windows prises en charge, notamment Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) et Windows Server 2012 R2 à Windows Server 2025. Source : 👇 https://thehackernews.com/2026/06/microsoft-patches-record-206-flaws.html
Post summary
The post announces the disclosure of CVE‑2026‑50507, a BitLocker bypass vulnerability, detailing its impact and technical characteristics without providing exploit code, PoC, or patch guidance.
0001088
694 followersView on X
Daniel Sant'Anna@dansantanna123d
Patch
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs ( CVE-2026-49160, CVE-2026-50507) http://ow.ly/VFPG106zXRs https://t.co/mBNiIHGjkQ
Post summary
Microsoft released its June 2026 Patch Tuesday, addressing 198 CVEs—including CVE‑2026‑49160 and CVE‑2026‑50507—with additional details available via the provided links.
0000046
511 followersView on X
Erick Ramos@EAlexStark125d
Patch
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs ( CVE-2026-49160, CVE-2026-50507) http://ow.ly/rkmL106zU15 https://t.co/5pULCKwJA8
Post summary
Microsoft announced its June 2026 Patch Tuesday, which included patches for 198 CVEs such as CVE-2026-49160 and CVE-2026-50507, but no PoC, exploit, or technical details were provided.
0000072
22.1K followersView on X
Stuart 🇨🇷@stooee_126d
General
After analyzing 42% of vulnerabilities from past week, CVE-2026-50507 has 32 articles published from different internet sources, no other cve has these many articles. More information here: https://cves.st00ee.com/ #vulnerability #CyberSecurity #ThreatIntel #CVE #SecurityAlert
Post summary
The post only highlights the number of articles about CVE-2026-50507 and provides a link to more information, with no details on exploitation, patches, or technical aspects.
0000040
74 followersView on X
TheNu11Sector@Nu11Sector130d
General
5.🧵 Prioritization order: 1️⃣ CVE-2026-50507 — BitLocker bypass (weaponized) 2️⃣ CVE-2026-45657 — Kernel RCE, CVSS 9.8, no auth 3️⃣ CVE-2026-47291 — HTTP.sys RCE, internet-facing 4️⃣ Hyper-V RCEs — VM guest escape Apply. Reboot. Verify.
Post summary
The text lists several high-impact CVEs with brief technical descriptors but lacks evidence of PoC, exploit code, active exploitation, or mitigation details.
00000159
493 followersView on X
cybersecuritypath@cybrsecpath133d
Patch
Windows BitLocker Bypass CVE-2026-50507: New Security Alert & Patch Fix https://thecybrdef.com/windows-bitlocker-bypass-cve-2026-50507-new-security-alert-patch-fix/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The text announces CVE-2026-50507 as a Windows BitLocker bypass flaw and indicates that a patch has been released to mitigate the issue.
0000046
9 followersView on X
cybersecuritypath@cybrsecpath133d
Patch
Windows BitLocker Bypass CVE-2026-50507: New Security Alert & Patch Fix https://thecybrdef.com/windows-bitlocker-bypass-cve-2026-50507-new-security-alert-patch-fix/ #Cybertrending #Cybernewsdaily #Cybersecurity
Post summary
An alert announces CVE-2026-50507, a Windows BitLocker bypass vulnerability, and highlights that a patch fix is available.
0000037
9 followersView on X
Marie Miller ッ@TechMash365133d
Patch
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs ( CVE-2026-49160, CVE-2026-50507) http://ow.ly/6kI6106zE0O https://t.co/QsZTwrH4Ri
Post summary
Microsoft released updates for 198 CVEs on June 2026, including CVE-2026-49160 and CVE-2026-50507, but the text provides no exploit or technical detail.
0000034
3.3K followersView on X
Marie Miller ッ@TechMash365133d
Patch
Microsoft’s June 2026 Patch Tuesday Addresses 198 CVEs ( CVE-2026-49160, CVE-2026-50507) http://ow.ly/pXCE106zCbB https://t.co/4JIN3hhotI
Post summary
Microsoft released a June 2026 Patch Tuesday update that addresses 198 CVEs, including CVE-2026-49160 and CVE-2026-50507, with links for additional information.
0000042
3.3K followersView on X
HACKLIDO@hacklido134d
General
CVE-2026-50507: Critical BitLocker Bypass Vulnerability Exposes Encrypted Windows Devices https://hacklido.com/news/cve-2026-50507-critical-bitlocker-bypass-vulnerability-exposes-encrypted-windows-devices
Post summary
The post announces CVE-2026-50507 as a critical BitLocker bypass but provides no deeper technical, exploitation, or mitigation details.
00000166
11.1K followersView on X
Aviatrix Threat Research Center@aviatrixtrc134d
Active Exploitation
TRC analysis shows attackers exploiting GreatXML (CVE-2026-50507) can bypass BitLocker by placing malicious XML files in recovery partitions, then rebooting to gain SYSTEM-level access. The technique leverages artifacts from Microsoft Defender offline scans to escalate privileges and move laterally within encrypted systems. #ZeroDay #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/greatxml-exploit-bypasses-bitlocker-2026
Post summary
The analysis reports active exploitation of CVE-2026-50507 by attackers, who bypass BitLocker by dropping malicious XML into recovery partitions and rebooting for SYSTEM-level access, using Defender artifacts for privilege escalation. No patch or mitigation is mentioned.
0000075
1.9K followersView on X

CPE platform detail23 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

23 of 23 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	microsoft	windows_10_1607	-	-	x64
OS	microsoft	windows_10_1607	-	-	x86
OS	microsoft	windows_10_1809	-	-	x64
OS	microsoft	windows_10_1809	-	-	x86
OS	microsoft	windows_10_21h2	-	-	arm64
OS	microsoft	windows_10_21h2	-	-	x64
OS	microsoft	windows_10_21h2	-	-	x86
OS	microsoft	windows_10_22h2	-	-	arm64
OS	microsoft	windows_10_22h2	-	-	x64
OS	microsoft	windows_10_22h2	-	-	x86
OS	microsoft	windows_11_23h2	-	-	arm64
OS	microsoft	windows_11_23h2	-	-	x64
OS	microsoft	windows_11_24h2	-	-	arm64
OS	microsoft	windows_11_24h2	-	-	x64
OS	microsoft	windows_11_25h2	-	-	arm64
OS	microsoft	windows_11_25h2	-	-	x64
OS	microsoft	windows_11_26h1	-	-	arm64
OS	microsoft	windows_11_26h1	-	-	x64
OS	microsoft	windows_server_2012	r2	-	-
OS	microsoft	windows_server_2016	-	-	-
OS	microsoft	windows_server_2019	-	-	-
OS	microsoft	windows_server_2022	-	-	-
OS	microsoft	windows_server_2025	-	-	x64

Explore more

Back to dashboard microsoft CVEs windows_10_1607 vulnerabilities

What researchers are saying

CVE-2026-50507

Cyber Security News[verified]@The_Cyber_NewsDisclosure

Microsoft disclosed CVE‑2026‑50507, a BitLocker bypass vulnerability, and noted that proof‑of‑concept code exists though no active exploitation has been observed; a patch was released as part of the June Patch Tuesday update.

Horizon Secured[verified]@horizon_securedGeneral

The alert enumerates several high‑severity CVEs with brief type and score information, but provides no proof of concept, exploit code, or evidence of active attacks.

ホーリーデイ[verified]@holy519Patch

The tweet announces Microsoft’s June 2026 Patch Tuesday, listing several high‑severity CVEs, including a Windows kernel RCE, and urges users to apply the 200+ patches, among which three are zero‑day flaws.

Elusive[verified]@ElusivePrivacyDisclosure

Microsoft’s June 2026 Patch Tuesday announced the largest patch batch to date, revealing 200 CVEs including three newly disclosed zero‑day vulnerabilities that are not yet known to be exploited, with corresponding patches now available.

TheNu11Sector[verified]@Nu11SectorActive Exploitation

The tweet reports that three zero‑day CVEs were actively exploited before their patches were released.

Gabrielle Vaucan[verified]@GabrielleVaucanDisclosure

The post announces the disclosure of CVE‑2026‑50507, a BitLocker bypass vulnerability, detailing its impact and technical characteristics without providing exploit code, PoC, or patch guidance.

TheNu11Sector[verified]@Nu11SectorGeneral

The text lists several high-impact CVEs with brief technical descriptors but lacks evidence of PoC, exploit code, active exploitation, or mitigation details.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The analysis reports active exploitation of CVE-2026-50507 by attackers, who bypass BitLocker by dropping malicious XML into recovery partitions and rebooting for SYSTEM-level access, using Defender artifacts for privilege escalation. No patch or mitigation is mentioned.