Skip to main content
QUIETLYTIC

Results appear below as you type. Use the up and down arrow keys to review them, Enter to open, Escape to dismiss.

Advisory

Microsoft Patch Tuesday July 2026: 2005 Vulnerabilities Fixed

Microsoft's July 14, 2026 Patch Tuesday fixed 2005 vulnerabilities (106 critical, 752 important) — 6 of them are confirmed under active exploitation, per…

Reported by 3 min read
Microsoft Patch Tuesday July 2026: 2005 Vulnerabilities Fixed — Advisory research covering CVE-2026-56163, CVE-2026-56191, CVE-2026-57106, CVE-2026-58275, CVE-2026-58630, CVE-2026-62825, CVE-2026-66803, CVE-2026-45499, CVE-2026-50517, CVE-2026-54120, CVE-2026-57092, CVE-2026-57100, CVE-2026-15043, CVE-2026-38968, CVE-2026-53374, CVE-2026-53376, CVE-2026-53384, CVE-2026-53403, CVE-2026-57433, CVE-2026-63800, CVE-2026-63824, CVE-2026-63827, CVE-2026-63828, CVE-2026-63833, CVE-2026-63881, CVE-2026-63882, CVE-2026-63959, CVE-2026-63974, CVE-2026-63979, CVE-2026-63983, CVE-2026-63999, CVE-2026-64017, CVE-2026-64070, CVE-2026-64076, CVE-2026-64078, CVE-2026-64079, CVE-2026-64138, CVE-2026-50518, CVE-2026-50522, CVE-2026-54117, CVE-2026-54118, CVE-2026-55010, CVE-2026-55944, CVE-2026-56159, CVE-2026-56165, CVE-2026-56188, CVE-2026-58644, CVE-2026-50380, CVE-2026-55008, CVE-2026-41106, CVE-2026-62835, CVE-2026-11564, CVE-2026-48144, CVE-2026-60082, CVE-2026-55040, CVE-2026-48564, CVE-2026-50370, CVE-2026-50382, CVE-2026-50444, CVE-2026-50474, CVE-2026-54121, CVE-2026-54982, CVE-2026-54998, CVE-2026-54999, CVE-2026-57087, CVE-2026-57090, CVE-2026-57094, CVE-2026-58608, CVE-2026-56167, CVE-2026-54128, CVE-2026-54992, CVE-2026-55045, CVE-2026-50680, CVE-2026-42533, CVE-2026-49164, CVE-2026-50694, CVE-2026-54995, CVE-2026-35425, CVE-2026-42982, CVE-2026-49796, CVE-2026-50314, CVE-2026-50327, CVE-2026-50467, CVE-2026-50655, CVE-2026-55011, CVE-2026-55012, CVE-2026-55018, CVE-2026-55022, CVE-2026-55033, CVE-2026-55043, CVE-2026-55049, CVE-2026-55056, CVE-2026-55120, CVE-2026-55123, CVE-2026-55127, CVE-2026-55129, CVE-2026-55132, CVE-2026-55140, CVE-2026-56189, CVE-2026-58542, CVE-2026-54127, CVE-2026-50392, CVE-2026-49159, CVE-2026-26145, CVE-2026-48561, CVE-2026-56160, CVE-2026-17543, CVE-2026-55971, CVE-2026-42990, CVE-2026-49172, CVE-2026-50447, CVE-2026-54990, CVE-2026-56190, CVE-2026-49798, CVE-2026-14740, CVE-2026-58662, CVE-2026-8924, CVE-2026-58289, CVE-2026-14380, CVE-2026-58253, CVE-2026-63807, CVE-2026-64475, CVE-2026-66032, CVE-2026-41109, CVE-2026-47295, CVE-2026-47300, CVE-2026-47301, CVE-2026-47303, CVE-2026-47632, CVE-2026-49178, CVE-2026-49795, CVE-2026-50342, CVE-2026-50360, CVE-2026-50369, CVE-2026-50385, CVE-2026-50398, CVE-2026-50413, CVE-2026-50438, CVE-2026-50477, CVE-2026-50489, CVE-2026-50663, CVE-2026-50666, CVE-2026-50670, CVE-2026-50687, CVE-2026-50692, CVE-2026-54107, CVE-2026-55002, CVE-2026-55005, CVE-2026-55052, CVE-2026-56194
Severity
Critical
Confidence
High
Status
Active

Full CVE Roster

All 150 CVEs from this release, ready to paste into a tracker, ticket, or SIEM search — 3 flagged as actively exploited (KEV).

CVE ID Title CVSS Severity KEV
CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability 10.0 critical
CVE-2026-56191 Microsoft Exchange Online Tampering Vulnerability 10.0 critical
CVE-2026-57106 Data Quality Elevation of Privilege Vulnerability 10.0 critical
CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability 10.0 critical
CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability 10.0 critical
CVE-2026-62825 Azure Key Vault Elevation of Privilege Vulnerability 10.0 critical
CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability 10.0 critical
CVE-2026-45499 Azure OpenAI Elevation of Privilege Vulnerability 9.9 critical
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability 9.9 critical
CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability 9.9 critical
CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability 9.9 critical
CVE-2026-57100 Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability 9.9 critical
CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text 9.8 critical
CVE-2026-38968 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing. 9.8 critical
CVE-2026-53374 drm/amdgpu: zero-initialize GART table on allocation 9.8 critical
CVE-2026-53376 drm/amdkfd: Add upper bound check for num_of_nodes 9.8 critical
CVE-2026-53384 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails 9.8 critical
CVE-2026-53403 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var 9.8 critical
CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record 9.8 critical
CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout() 9.8 critical
CVE-2026-63824 KEYS: fix overflow in keyctl_pkey_params_get_2() 9.8 critical
CVE-2026-63827 apparmor: fix use-after-free in rawdata dedup loop 9.8 critical
CVE-2026-63828 apparmor: mediate the implicit connect of TCP fast open sendmsg 9.8 critical
CVE-2026-63833 ntfs3: reject direct userspace writes to reserved $LX* xattrs 9.8 critical
CVE-2026-63881 drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger 9.8 critical
CVE-2026-63882 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr 9.8 critical
CVE-2026-63959 usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT 9.8 critical
CVE-2026-63974 Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close 9.8 critical
CVE-2026-63979 net/handshake: hand off the pinned file reference to accept_doit 9.8 critical
CVE-2026-63983 net/sched: fix packet loop on netem when duplicate is on 9.8 critical
CVE-2026-63999 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure 9.8 critical
CVE-2026-64017 blk-mq: pop cached request if it is usable 9.8 critical
CVE-2026-64070 powerpc/hv-gpci: fix preempt count leak in sysfs show paths 9.8 critical
CVE-2026-64076 netfilter: bridge: eb_tables: close module init race 9.8 critical
CVE-2026-64078 netfilter: x_tables: add and use xtables_unregister_table_exit 9.8 critical
CVE-2026-64079 netfilter: x_tables: allocate hook ops while under mutex 9.8 critical
CVE-2026-64138 ksmbd: validate SID in parent security descriptor during ACL inheritance 9.8 critical
CVE-2026-50518 Windows DHCP Server Remote Code Execution Vulnerability 9.8 critical
CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability 9.8 critical Yes
CVE-2026-54117 Microsoft SQL Server Remote Code Execution Vulnerability 9.8 critical
CVE-2026-54118 Microsoft SQL Server Remote Code Execution Vulnerability 9.8 critical
CVE-2026-55010 Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability 9.8 critical
CVE-2026-55944 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability 9.8 critical
CVE-2026-56159 DHCP Server Service Remote Code Execution Vulnerability 9.8 critical
CVE-2026-56165 Microsoft Account Remote Code Execution Vulnerability 9.8 critical
CVE-2026-56188 Windows Server Network driver Remote Code Execution Vulnerability 9.8 critical
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability 9.8 critical Yes
CVE-2026-50380 Windows GDI+ Remote Code Execution Vulnerability 9.6 critical
CVE-2026-55008 Microsoft Exchange Server Spoofing Vulnerability 9.6 critical
CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability 9.3 critical
CVE-2026-62835 Azure Portal Information Disclosure Vulnerability 9.3 critical
CVE-2026-11564 Native CA trust persist 9.1 critical
CVE-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification 9.1 critical
CVE-2026-60082 DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row 9.1 critical
CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability 9.1 critical Yes
CVE-2026-48564 DHCP Server Service Remote Code Execution Vulnerability 8.8 critical
CVE-2026-50370 DHCP Server Service Remote Code Execution Vulnerability 8.8 critical
CVE-2026-50382 DirectX Graphics Kernel Remote Code Execution Vulnerability 8.8 critical
CVE-2026-50444 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability 8.8 critical
CVE-2026-50474 Remote Desktop Client Remote Code Execution Vulnerability 8.8 critical
CVE-2026-54121 Active Directory Certificate Services Elevation of Privilege Vulnerability 8.8 critical
CVE-2026-54982 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability 8.8 critical
CVE-2026-54998 Microsoft Exchange Online Elevation of Privilege Vulnerability 8.8 critical
CVE-2026-54999 Windows TCP/IP Remote Code Execution Vulnerability 8.8 critical
CVE-2026-57087 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 8.8 critical
CVE-2026-57090 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 8.8 critical
CVE-2026-57094 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 8.8 critical
CVE-2026-58608 Windows Print Spooler Remote Code Execution Vulnerability 8.8 critical
CVE-2026-56167 Azure AI Search Elevation of Privilege Vulnerability 8.5 critical
CVE-2026-54128 Windows DHCP Client Remote Code Execution Vulnerability 8.4 critical
CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability 8.4 critical
CVE-2026-55045 Microsoft Office Remote Code Execution Vulnerability 8.4 critical
CVE-2026-50680 Windows Hyper-V Elevation of Privilege Vulnerability 8.2 critical
CVE-2026-42533 NGINX Map directive and Regex matching vulnerability 8.1 critical
CVE-2026-49164 Windows Active Directory Domain Services Remote Code Execution Vulnerability 8.1 critical
CVE-2026-50694 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability 8.1 critical
CVE-2026-54995 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability 8.1 critical
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability 8.0 critical
CVE-2026-42982 Windows Secure Kernel Mode Elevation of Privilege Vulnerability 7.8 critical
CVE-2026-49796 Windows GDI+ Remote Code Execution Vulnerability 7.8 critical
CVE-2026-50314 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-50327 Windows Media Remote Code Execution Vulnerability 7.8 critical
CVE-2026-50467 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55011 Microsoft Defender Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55012 Microsoft Defender Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55018 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55022 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55033 Microsoft Word Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55043 Microsoft PowerPoint Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55049 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55056 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55120 Microsoft PowerPoint Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55123 Microsoft PowerPoint Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55127 Microsoft Word Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55129 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55132 Microsoft Word Remote Code Execution Vulnerability 7.8 critical
CVE-2026-55140 Microsoft Office Remote Code Execution Vulnerability 7.8 critical
CVE-2026-56189 Microsoft Windows Media Foundation Remote Code Execution Vulnerability 7.8 critical
CVE-2026-58542 Windows Media Remote Code Execution Vulnerability 7.8 critical
CVE-2026-54127 Windows Hyper-V Elevation of Privilege Vulnerability 7.4 critical
CVE-2026-50392 Windows Secure Kernel Mode Elevation of Privilege Vulnerability 7.0 critical
CVE-2026-49159 Microsoft Graph Information Disclosure Vulnerability 6.5 critical
CVE-2026-26145 Microsoft Azure Synapse Elevation of Privilege Vulnerability 4.8 critical
CVE-2026-48561 Microsoft Edge Copilot Remote Code Execution Vulnerability — critical
CVE-2026-56160 Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability — critical
CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout 9.8 high
CVE-2026-55971 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() 9.8 high
CVE-2026-42990 SQL Server ODBC driver Elevation of Privilege Vulnerability 9.8 high
CVE-2026-49172 Windows FTP Service Remote Code Execution Vulnerability 9.8 high
CVE-2026-50447 Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability 9.8 high
CVE-2026-54990 Remote Desktop Client Remote Code Execution Vulnerability 9.8 high
CVE-2026-56190 Remote Desktop Protocol Remote Code Execution Vulnerability 9.8 high
CVE-2026-49798 Windows Kernel Elevation of Privilege Vulnerability 9.3 high
CVE-2026-14740 DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment 9.1 high
CVE-2026-58662 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass 9.1 high
CVE-2026-8924 trailing dot domain super cookie 9.1 high
CVE-2026-58289 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 9.0 high
CVE-2026-14380 DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile 8.8 high
CVE-2026-58253 NATS Server: Route API Auth Bypass 8.8 high
CVE-2026-63807 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level 8.8 high
CVE-2026-64475 vfio/pci: Release the VGA arbiter client on register_device() failure 8.8 high
CVE-2026-66032 libssh2 Double-Free Heap Corruption via sftp_open() 8.8 high
CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability 8.8 high
CVE-2026-47295 Microsoft SQL Server Elevation of Privilege Vulnerability 8.8 high
CVE-2026-47300 ASP.NET Core Elevation of Privilege Vulnerability 8.8 high
CVE-2026-47301 Configuration Manager Elevation of Privilege Vulnerability 8.8 high
CVE-2026-47303 ASP.NET Core Elevation of Privilege Vulnerability 8.8 high
CVE-2026-47632 Azure Connected Machine Agent Elevation of Privilege Vulnerability 8.8 high
CVE-2026-49178 Windows Active Directory Domain Services Remote Code Execution Vulnerability 8.8 high
CVE-2026-49795 Windows Kernel Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50342 Windows MIDI Service Module Elevation of Privileges Vulnerability 8.8 high
CVE-2026-50360 Windows SMB Server Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50369 Windows Remote Desktop Services Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50385 Windows Runtime Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50398 Windows Media Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50413 Windows Runtime Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50438 Microsoft PC Manager Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50477 Windows Kernel Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50489 Win32k Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50663 Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability 8.8 high
CVE-2026-50666 Windows Remote Access Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50670 Windows Win32k Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50687 Windows Win32k Elevation of Privilege Vulnerability 8.8 high
CVE-2026-50692 Desktop Window Manager Elevation of Privilege Vulnerability 8.8 high
CVE-2026-54107 Windows Win32k Elevation of Privilege Vulnerability 8.8 high
CVE-2026-55002 Microsoft SQL Server Elevation of Privilege Vulnerability 8.8 high
CVE-2026-55005 Microsoft Exchange Server Remote Code Execution Vulnerability 8.8 high
CVE-2026-55052 Microsoft SharePoint Elevation of Privilege Vulnerability 8.8 high
CVE-2026-56194 Windows NFS Server Elevation of Privilege Vulnerability 8.8 high

Microsoft’s July 14, 2026 Patch Tuesday release covers 2005 CVEs: 106 rated critical, 752 rated important, and 250 rated moderate. Of these, 6 of them are confirmed under active exploitation.

Severity Breakdown

Severity Count
Critical 106
Important 752
Moderate 250
Actively exploited (CISA KEV) 6

Highest-Severity Vulnerabilities

Top 20 of 2005 total, by CVSS/severity:

CVE Title CVSS
CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability 10.0
CVE-2026-56191 Microsoft Exchange Online Tampering Vulnerability 10.0
CVE-2026-57106 Data Quality Elevation of Privilege Vulnerability 10.0
CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability 10.0
CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability 10.0
CVE-2026-62825 Azure Key Vault Elevation of Privilege Vulnerability 10.0
CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability 10.0
CVE-2026-45499 Azure OpenAI Elevation of Privilege Vulnerability 9.9
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability 9.9
CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability 9.9
CVE-2026-57092 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability 9.9
CVE-2026-57100 Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability 9.9
CVE-2026-15043 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text 9.8
CVE-2026-38968 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing. 9.8
CVE-2026-53374 drm/amdgpu: zero-initialize GART table on allocation 9.8
CVE-2026-53376 drm/amdkfd: Add upper bound check for num_of_nodes 9.8
CVE-2026-53384 serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails 9.8
CVE-2026-53403 fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var 9.8
CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record 9.8
CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout() 9.8

CVSS scores are sourced directly from Microsoft’s CVRF data as of July 14, 2026; exploitation status is cross-checked against CISA’s KEV catalog. Later re-scoring by NVD can shift a CVE’s score after this report was generated.

Why This Matters

With 6 vulnerabilities already under active exploitation, prioritizing this month’s patches isn’t optional for exposed systems — attackers are demonstrably already using at least one of these flaws. Organizations should prioritize the critical- and important-rated CVEs above, especially any with public proof-of-concept exploits.

Frequently Asked Questions

How many vulnerabilities did Microsoft patch in July 2026? 2005 CVEs, per Microsoft’s July 14, 2026 Patch Tuesday release.

Were any July 2026 Patch Tuesday vulnerabilities actively exploited? Yes — 6 of them are listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of July 14, 2026.

Data sourced from Microsoft Security Response Center (MSRC) CVRF v3.0 and CISA’s Known Exploited Vulnerabilities (KEV) catalog, aggregated July 14, 2026. See more vulnerability research.

Report an error

Found a factual error, an outdated figure, or a broken source link? Let us know and our editorial desk will review it.

Sources & evidence

01 Microsoft Security Response Center (MSRC)
02 CISA Known Exploited Vulnerabilities (KEV) Catalog

Related intelligence

advisory

Microsoft Patch Tuesday December 2025: 349 Vulnerabilities Fixed

 advisory

Microsoft Patch Tuesday November 2025: 184 Vulnerabilities Fixed

 advisory

Microsoft Patch Tuesday October 2025: 429 Vulnerabilities Fixed

Analyst tools

Analyst Tool

CVSS Calculator