cve.bz

Microsoft Patch Tuesday, July 2026: the CVEs, page 6

Filter

Microsoft Patch Tuesday July 2026: the CVEs Microsoft published on 14 July 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 6.2CVE-2026-50294EPSS 0.5%

    Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.

  2. 7.8CVE-2026-50293EPSS 0.3%

    Use after free in Windows Internal Task Bar allows an authorized attacker to elevate privileges locally.

  3. 7.8CVE-2026-49808EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

  4. 6.2CVE-2026-49807EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.

  5. 7.0CVE-2026-49806EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  6. 7.0CVE-2026-49805EPSS 0.2%

    Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

  7. 6.6CVE-2026-49804EPSS 0.5%

    Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack.

  8. 7.0CVE-2026-49803EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

  9. 7.0CVE-2026-49802EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

  10. 5.5CVE-2026-49801EPSS 0.4%

    Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally.

  11. 7.8CVE-2026-49800EPSS 0.3%

    Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.

  12. 6.5CVE-2026-49799EPSS 1.1%

    Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

  13. 9.3CVE-2026-49798EPSS 0.4%

    Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

  14. 7.8CVE-2026-49797EPSS 0.5%

    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

  15. 7.8CVE-2026-49796EPSS 0.5%

    Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.

  16. 8.8CVE-2026-49795EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  17. 4.6CVE-2026-49794EPSS 0.5%

    Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.

  18. 7.8CVE-2026-49793EPSS 0.3%

    Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

  19. 7.8CVE-2026-49792EPSS 0.3%

    Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

  20. 7.8CVE-2026-49791EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

  21. 7.8CVE-2026-49790EPSS 0.4%

    Integer underflow (wrap or wraparound) in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.

  22. 7.8CVE-2026-49789EPSS 0.4%

    Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

  23. 7.5CVE-2026-49788EPSS 1.2%

    Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network.

  24. 7.5CVE-2026-49787EPSS 1.2%

    Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.

  25. 7.0CVE-2026-49784EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

  26. 7.8CVE-2026-49783EPSS 0.3%

    Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

  27. 7.8CVE-2026-49184EPSS 0.3%

    Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

  28. 7.0CVE-2026-49183EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.

  29. 9.8CVE-2026-49181EPSS 1.2%

    Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.

  30. 5.5CVE-2026-49180EPSS 0.4%

    Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

  31. 8.8CVE-2026-49178EPSS 0.9%

    Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.

  32. 7.8CVE-2026-49176EPSS 0.3%

    Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

  33. 7.8CVE-2026-49175EPSS 0.3%

    Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

  34. 6.1CVE-2026-49174EPSS 0.3%

    Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

  35. 7.8CVE-2026-49173EPSS 0.3%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  36. 9.8CVE-2026-49172EPSS 1.0%

    Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.

  37. 7.8CVE-2026-49171EPSS 0.3%

    Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.

  38. 7.8CVE-2026-49170EPSS 0.3%

    Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

  39. 8.8CVE-2026-49169EPSS 0.8%

    Use after free in DNS Server allows an authorized attacker to execute code over a network.

  40. 6.8CVE-2026-49168EPSS 0.4%

    Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.

  41. 7.8CVE-2026-49167EPSS 0.4%

    Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

  42. 7.8CVE-2026-49166EPSS 0.3%

    Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.

  43. 7.1CVE-2026-49165EPSS 0.3%

    Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.

  44. 9.8CVE-2026-49164EPSS 0.8%

    Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

  45. 7.0CVE-2026-49162EPSS 0.3%

    Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

  46. 7.8CVE-2026-48581EPSS 0.3%

    Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.

  47. 7.0CVE-2026-48572EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.

  48. 7.0CVE-2026-48571EPSS 0.3%

    Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally.

  49. 8.8CVE-2026-48564EPSS 0.9%

    Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

  50. 9.6CVE-2026-48561EPSS 0.9%

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

  51. 8.8CVE-2026-47632EPSS 0.5%

    Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

  52. 7.5CVE-2026-47296EPSS 0.7%

    Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

  53. 6.5CVE-2026-47282EPSS 0.9%

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  54. 7.5CVE-2026-45646EPSS 1.2%

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  55. 5.5CVE-2026-45496EPSS 0.5%

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  56. 7.5CVE-2026-44806EPSS 1.2%

    Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

  57. 7.8CVE-2026-44800EPSS 0.2%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

  58. 9.8CVE-2026-42990EPSS 1.0%

    Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.

  59. 7.8CVE-2026-42982EPSS 0.3%

    Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

  60. 8.8CVE-2026-42975EPSS 0.5%

    Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

  61. 8.1CVE-2026-42900EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.

  62. 5.5CVE-2026-41087EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

  63. 5.5CVE-2026-40422EPSS 0.4%

    Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.

  64. 8.0CVE-2026-40400EPSS 0.9%

    Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

  65. 7.5CVE-2026-40378EPSS 1.2%

    Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

  66. 5.5CVE-2026-34349EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.

  67. 6.5CVE-2026-34348EPSS 1.0%

    Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.

  68. 5.5CVE-2026-34346EPSS 0.3%

    Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.

  69. 5.5CVE-2026-34328EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.

  70. 5.5CVE-2026-33842EPSS 0.5%

    Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.