Microsoft's security release of 14 July 2026
Patch Tuesday, July 2026, page 2
As of , CISA lists five of the 570 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-55040, Microsoft SharePoint Server Security Feature Bypass.
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 101 | CVE-2026-50304Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 102 | CVE-2026-50328Windows Server Update Service (WSUS) Tampering | None | Not on CISA's list | 7.5 High | 0.01 |
| 103 | CVE-2026-50330Windows Remote Desktop Client Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 104 | CVE-2026-50355Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 105 | CVE-2026-50368Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 106 | CVE-2026-50379Windows Media Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 107 | CVE-2026-50411Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 108 | CVE-2026-50414Windows Media Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 109 | CVE-2026-50424Windows Domain Controller Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 110 | CVE-2026-50463Windows Kernel Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 111 | CVE-2026-50470Windows Network Policy Server SNMP Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 112 | CVE-2026-50496Windows Network Policy Server SNMP Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 113 | CVE-2026-50500Windows Netlogon Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 114 | CVE-2026-50505Windows Message Queuing Service (MSMQ) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 115 | CVE-2026-50506OData for ASP.NET and ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 116 | CVE-2026-50524.NET Framework Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 117 | CVE-2026-50525.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 118 | CVE-2026-50527.NET Framework Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 119 | CVE-2026-50647Active Directory Federation Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 120 | CVE-2026-50648.NET Framework Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 121 | CVE-2026-50651.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 122 | CVE-2026-50653Azure Active Directory Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 123 | CVE-2026-50685Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 124 | CVE-2026-50695Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 125 | CVE-2026-50696Internet Key Exchange (IKE) Protocol Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 126 | CVE-2026-54119Windows Active Directory Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 127 | CVE-2026-54983Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 128 | CVE-2026-56170ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 129 | CVE-2026-56648Windows NFS Server Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 130 | CVE-2026-57089Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 131 | CVE-2026-57108.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 132 | CVE-2026-58531Windows SMB Elevation of Privilege | None | Not on CISA's list | 7.5 High | 0.01 |
| 133 | CVE-2026-58627Windows DHCP Server Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 134 | CVE-2026-55021Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 135 | CVE-2026-55034Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 136 | CVE-2026-55126Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 137 | CVE-2026-50682Active Directory Denial of Service | None | Not on CISA's list | 7.1 High | 0.01 |
| 138 | CVE-2026-55122Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 139 | CVE-2026-58529Windows Active Directory Federation Services (ADFS) Information Disclosure | None | Not on CISA's list | 7.1 High | 0.01 |
| 140 | CVE-2026-50426Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 141 | CVE-2026-58528Windows USB Audio Class Driver Information Disclosure | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 142 | CVE-2026-34348Windows Event Logging Service Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 143 | CVE-2026-47282GitHub Copilot and Visual Studio Code Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 144 | CVE-2026-49799Windows Local Security Authority Subsystem Service (LSASS) Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 145 | CVE-2026-50366Windows Active Directory Domain Services Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 146 | CVE-2026-50376Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 147 | CVE-2026-50445Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 148 | CVE-2026-50468Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 149 | CVE-2026-50497Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 150 | CVE-2026-50504Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 151 | CVE-2026-50659.NET Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 152 | CVE-2026-54108Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 153 | CVE-2026-54116Microsoft SQL Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 154 | CVE-2026-54126Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 155 | CVE-2026-55003Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 156 | CVE-2026-55051Microsoft SharePoint Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 157 | CVE-2026-55054Microsoft Excel Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 158 | CVE-2026-56168Windows SMB Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 159 | CVE-2026-56185Windows Admin Center Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 160 | CVE-2026-57976Windows Active Directory Domain Services Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 161 | CVE-2026-57979Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 162 | CVE-2026-57982Windows Remote Desktop Protocol (RDP) Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 163 | CVE-2026-58279Azure CycleCloud Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 164 | CVE-2026-58533Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 165 | CVE-2026-58535Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 166 | CVE-2026-58539Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 167 | CVE-2026-58546Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 168 | CVE-2026-57097Microsoft XML Security Feature Bypass | None | Not on CISA's list | 6.4 Medium | 0.01 |
| 169 | CVE-2026-55145Outlook Copilot Tampering | None | Not on CISA's list | 6.3 Medium | 0.01 |
| 170 | CVE-2026-49807Windows DirectX Information Disclosure | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 171 | CVE-2026-50294Windows Kernel Information Disclosure | None | Not on CISA's list | 6.2 Medium | 0.01 |
| 172 | CVE-2026-50453Windows USB Audio Class Driver Information Disclosure | None | Not on CISA's list | 6.1 Medium | 0.01 |
| 173 | CVE-2026-50324Windows Active Directory Federation Services Denial of Service | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 174 | CVE-2026-56649Windows Network File System Remote Code Execution | None | Not on CISA's list | 5.9 Medium | 0.01 |
| 175 | CVE-2026-48580Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 176 | CVE-2026-50408Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 177 | CVE-2026-55023Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 178 | CVE-2026-55027Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 179 | CVE-2026-55028Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 180 | CVE-2026-55035Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 181 | CVE-2026-55042Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 182 | CVE-2026-55046Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 183 | CVE-2026-55047Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 184 | CVE-2026-55050Microsoft Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 185 | CVE-2026-55057Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 186 | CVE-2026-55121Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 187 | CVE-2026-55124Microsoft Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 188 | CVE-2026-55138Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 189 | CVE-2026-55142Microsoft Word Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 190 | CVE-2026-56192Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 191 | CVE-2026-56195Microsoft Office Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 192 | CVE-2026-57083Windows Media Photo Codec Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 193 | CVE-2026-57084Windows File Explorer Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 194 | CVE-2026-44806Windows Secure Channel Denial of Service | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 195 | CVE-2026-50415Windows Media Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 196 | CVE-2026-50432Window Virtual Filtering Platform (VFP) Denial of Service | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 197 | CVE-2026-55016Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 198 | CVE-2026-55019Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 199 | CVE-2026-55020Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |
| 200 | CVE-2026-55030Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 4.6 Medium | 0.01 |