Microsoft Patch Tuesday, July 2026: the CVEs

Microsoft Patch Tuesday July 2026: the CVEs Microsoft published on 14 July 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 9.1CVE-2026-55040KEVExploitEPSS 70%2026-07-14

   Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

2. 9.8CVE-2026-58644KEVExploitEPSS 16%2026-07-14

   Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

3. 9.8CVE-2026-56164KEVEPSS 27%2026-07-14

   Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

4. 7.8CVE-2026-56155KEVEPSS 0.3%2026-07-14

   Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

5. 9.8CVE-2026-50522KEVEPSS 3.0%2026-07-14

   Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.