June 2026 Patch Tuesday: RCE Flaws in RDP & HTTP Stack Threaten SMBs

June 2026 Patch Tuesday: RCE Flaws in RDP and HTTP Stack Threaten SMBs

For full details, see the Talos analysis.

Microsoft’s June 2026 Patch Tuesday addresses 206 vulnerabilities, including 32 rated critical, most enabling remote code execution (RCE). Among the most concerning are flaws in the Windows Remote Desktop Client (RDP) and HTTP Protocol Stack (http.sys), which could allow attackers to execute malicious code over the network without authentication. For SMBs, these vulnerabilities pose a significant risk, as unpatched systems may expose critical infrastructure to lateral movement or initial access by threat actors.

Key Threats and MITRE ATT&CK Techniques

1. Remote Desktop Client (RDP) RCE (CVE-2026-42985, CVE-2026-42992, and others)

   • Technique: T1210 - Exploitation of Remote Services
   • Why it matters: RDP is a common attack vector for SMBs, often exposed to the internet for remote work. Exploitation could grant attackers a foothold in the network, leading to data theft or ransomware deployment. SMBs frequently lack multi-factor authentication (MFA) for RDP, increasing risk.

2. HTTP Protocol Stack (http.sys) RCE (CVE-2026-47291)

   • Technique: T1190 - Exploit Public-Facing Application
   • Why it matters: HTTP.sys is a core Windows component handling web traffic. A crafted packet could trigger RCE on unpatched servers, making this a high-priority patch for SMBs running web-facing services or internal applications.

3. Windows Hyper-V RCE (CVE-2026-45607, CVE-2026-45641, CVE-2026-47652)

   • Technique: T1565 - Data Manipulation (via out-of-bounds reads)
   • Why it matters: SMBs using virtualization for cost efficiency may overlook Hyper-V patching. Exploitation could allow attackers to escape guest VMs and compromise the host, leading to full network compromise.

Detection and Response for SMBs

SMBs often lack dedicated security teams, but these steps can mitigate risk:

• Patch Management: Prioritize critical RCE flaws in RDP, HTTP.sys, and Hyper-V. Use Microsoft’s Update Guide to identify affected systems. Automate patching where possible to reduce exposure windows.

• Network Segmentation: Isolate RDP and web-facing services from internal networks. Use firewalls to restrict RDP access to trusted IPs or require VPN connections.

• Endpoint Detection: Monitor for unusual process execution or network traffic spikes, particularly on systems running RDP or web services. Look for:

  • T1210 (Exploitation of Remote Services): Unusual RDP connections or failed authentication attempts.
  • T1190 (Exploit Public-Facing Application): Unexpected HTTP.sys crashes or anomalous web traffic patterns.

• Logging and Alerts: Enable Windows Event Logs for RDP (Event ID 4624/4625) and HTTP.sys errors. Forward logs to a SIEM or managed detection service for correlation.

ThreatClaw Coverage

ThreatClaw detects and alerts on techniques tied to these vulnerabilities, including:

• T1210 - Exploitation of Remote Services: Monitors for suspicious RDP activity, including brute-force attempts and unusual connection sources.
• T1190 - Exploit Public-Facing Application: Detects anomalous HTTP.sys behavior, such as crashes or unexpected process execution.
• T1565 - Data Manipulation: Identifies out-of-bounds read attempts in Hyper-V environments.

Next Steps

SMBs should:

1. Patch immediately: Focus on critical RCE flaws in RDP, HTTP.sys, and Hyper-V.
2. Review RDP exposure: Disable internet-facing RDP or enforce MFA and IP restrictions.
3. Monitor for exploitation: Use ThreatClaw or similar tools to detect post-exploitation activity.

For more on securing SMB infrastructure against RCE threats, explore ThreatClaw’s detection strategies.