Microsoft's security release of 14 July 2026
Patch Tuesday, July 2026
As of , CISA lists five of the 570 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-55040, Microsoft SharePoint Server Security Feature Bypass.
On CISA's list of exploited vulnerabilities
- CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass. Listed by CISA on 18 August 2026, 35 days after the release
- CVE-2026-58644Microsoft SharePoint Remote Code Execution. Listed by CISA on 16 July 2026, 2 days after the release
- CVE-2026-50522Microsoft SharePoint Remote Code Execution. Listed by CISA on 22 July 2026, 8 days after the release
- CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege. Listed by CISA on 14 July 2026, release day
- CVE-2026-56155Active Directory Federation Services Elevation of Privilege. Listed by CISA on 14 July 2026, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 570 CVEs |
| On CISA's list of exploited vulnerabilities | 5 CVEs |
| CISA's SSVC exploitation: active | 5 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 565 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 20 CVEs |
| EPSS 0.10 or more | 2 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass | Active | Patch nowListed | 9.1 Critical | 0.70 |
| 2 | CVE-2026-58644Microsoft SharePoint Remote Code Execution | Active | Patch nowListed | 9.8 Critical | 0.16 |
| 3 | CVE-2026-50522Microsoft SharePoint Remote Code Execution | Active | Patch nowListed | 9.8 Critical | 0.03 |
| 4 | CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege | Active | Patch nowListed | 5.3 Medium | 0.01 |
| 5 | CVE-2026-56155Active Directory Federation Services Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.00 |
| 6 | CVE-2026-50509Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.04 |
| 7 | CVE-2026-50646.NET Framework Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.04 |
| 8 | CVE-2026-50649.NET Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.04 |
| 9 | CVE-2026-55009Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 10 | CVE-2026-54117Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 11 | CVE-2026-54118Microsoft SQL Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 12 | CVE-2026-55944Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 13 | CVE-2026-50652Azure Active Directory Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 14 | CVE-2026-57092Microsoft Windows VMSwitch Elevation of Privilege | None | Not on CISA's list | 9.9 Critical | 0.01 |
| 15 | CVE-2026-42990SQL Server ODBC driver Elevation of Privilege | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 16 | CVE-2026-49172Windows FTP Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 17 | CVE-2026-50447Windows Message Queuing Service (MSMQ) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 18 | CVE-2026-50518Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 19 | CVE-2026-54990Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 20 | CVE-2026-55010Minecraft Bedrock Dedicated Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 21 | CVE-2026-56159DHCP Server Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 22 | CVE-2026-56188Windows Server Network driver Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 23 | CVE-2026-56190Remote Desktop Protocol Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 24 | CVE-2026-48561Microsoft Edge Copilot Remote Code Execution | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 25 | CVE-2026-50380Windows GDI+ Remote Code Execution | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 26 | CVE-2026-55008Microsoft Exchange Server Spoofing | None | Not on CISA's list | 9.6 Critical | 0.01 |
| 27 | CVE-2026-47295Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 28 | CVE-2026-47300ASP.NET Core Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 29 | CVE-2026-47301Configuration Manager Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 30 | CVE-2026-47303ASP.NET Core Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 31 | CVE-2026-48564DHCP Server Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 32 | CVE-2026-49178Windows Active Directory Domain Services Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 33 | CVE-2026-50360Windows SMB Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 34 | CVE-2026-50369Windows Remote Desktop Services Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 35 | CVE-2026-50370DHCP Server Service Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 36 | CVE-2026-50398Windows Media Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 37 | CVE-2026-50444Windows Server Update Service (WSUS) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 38 | CVE-2026-50474Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 39 | CVE-2026-50663Game: Age of Empires II: Definitive Edition Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 40 | CVE-2026-50666Windows Remote Access Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 41 | CVE-2026-54121Active Directory Certificate Services Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 42 | CVE-2026-54982Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 43 | CVE-2026-55002Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 44 | CVE-2026-55005Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 45 | CVE-2026-55052Microsoft SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 46 | CVE-2026-56194Windows NFS Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 47 | CVE-2026-56196Windows Admin Center (WAC) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 48 | CVE-2026-56197Windows Admin Center (WAC) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 49 | CVE-2026-56642Microsoft Fabric Data Warehouse Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 50 | CVE-2026-56647Windows Remote Access Service Infrastructure Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 51 | CVE-2026-57087Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 52 | CVE-2026-57090Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 53 | CVE-2026-57094Microsoft Windows Media Foundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 54 | CVE-2026-57102Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.01 |
| 55 | CVE-2026-57969Azure CycleCloud Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 56 | CVE-2026-58277Microsoft SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 57 | CVE-2026-58594Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 58 | CVE-2026-58608Windows Print Spooler Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 59 | CVE-2026-58626Windows Remote Desktop Services Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 60 | CVE-2026-50340Windows Runtime Elevation of Privilege | None | Not on CISA's list | 8.5 High | 0.01 |
| 61 | CVE-2026-50338Azure Spring Apps Elevation of Privilege | None | Not on CISA's list | 8.2 High | 0.01 |
| 62 | CVE-2026-50429Windows Kernel Information Disclosure | None | Not on CISA's list | 8.2 High | 0.01 |
| 63 | CVE-2026-50528.NET Security Feature Bypass | None | Not on CISA's list | 8.2 High | 0.01 |
| 64 | CVE-2026-42900Microsoft Windows App Store Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 65 | CVE-2026-49164Windows Active Directory Domain Services Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 66 | CVE-2026-50439Microsoft Message Queuing Queue Manager Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 67 | CVE-2026-50460Windows Runtime Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 68 | CVE-2026-50487Windows DNS Client Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 69 | CVE-2026-50686Windows OLE Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 70 | CVE-2026-50694Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 71 | CVE-2026-54995Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 72 | CVE-2026-56169Windows Admin Center Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 73 | CVE-2026-56186Windows Secure Channel Information Disclosure | None | Not on CISA's list | 8.1 High | 0.01 |
| 74 | CVE-2026-58595Microsoft Bing App for IOS Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 75 | CVE-2026-58617M365 Copilot for iOS Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 76 | CVE-2026-40400Windows PowerShell Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 77 | CVE-2026-42975Windows Bluetooth Port Driver Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 78 | CVE-2026-49169Windows DNS Server Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 79 | CVE-2026-50365Remote Access Management service/API (RPC server) Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 80 | CVE-2026-50502Windows Event Logging Service Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 81 | CVE-2026-50683Windows DHCP Client Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 82 | CVE-2026-58647Microsoft PowerBI Report Server Spoofing | None | Not on CISA's list | 8.0 High | 0.01 |
| 83 | CVE-2026-50665Microsoft Office Information Disclosure | None | Not on CISA's list | 7.8 High | 0.01 |
| 84 | CVE-2026-55032Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 85 | CVE-2026-55033Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 86 | CVE-2026-55038Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 87 | CVE-2026-55055Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 88 | CVE-2026-55125Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 89 | CVE-2026-55127Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 90 | CVE-2026-55128Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 91 | CVE-2026-55130Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 92 | CVE-2026-55132Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 93 | CVE-2026-55134Microsoft Word Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 94 | CVE-2026-40378Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 95 | CVE-2026-45646OData for ASP.NET and ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 96 | CVE-2026-47296Microsoft SQL Server Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 97 | CVE-2026-47302.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 98 | CVE-2026-49181Windows DHCP Client Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 99 | CVE-2026-49787HTTP.sys Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 100 | CVE-2026-49788HTTP/2 Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 14 July 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.