cve.bz

Microsoft Patch Tuesday, July 2026: the CVEs

Filter

Microsoft Patch Tuesday July 2026: the CVEs Microsoft published on 14 July 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 9.8CVE-2026-47304EPSS 0.3%

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

  2. 9.8CVE-2026-58617EPSS 0.8%

    Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

  3. 9.8CVE-2026-58594EPSS 0.8%

    Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network.

  4. 9.9CVE-2026-57092EPSS 0.9%

    Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.

  5. 9.8CVE-2026-57090EPSS 0.8%

    Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.

  6. 9.8CVE-2026-57089EPSS 0.7%

    Use after free in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to execute code over a network.

  7. 9.8CVE-2026-56190EPSS 1.0%

    Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network.

  8. 9.8CVE-2026-56159EPSS 1.0%

    Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  9. 9.8CVE-2026-55944EPSS 1.5%

    Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

  10. 9.1CVE-2026-55040KEVExploitEPSS 70%

    Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

  11. 9.8CVE-2026-55010EPSS 1.0%

    Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network.

  12. 9.8CVE-2026-50518EPSS 1.0%

    Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

  13. 9.8CVE-2026-50487EPSS 0.8%

    Use after free in Microsoft Windows DNS allows an unauthorized attacker to elevate privileges over a network.

  14. 9.8CVE-2026-50447EPSS 1.0%

    Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

  15. 9.8CVE-2026-50439EPSS 0.8%

    Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.

  16. 9.6CVE-2026-50380EPSS 0.8%

    Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

  17. 9.8CVE-2026-50330EPSS 1.3%

    Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to elevate privileges over a network.

  18. 9.8CVE-2026-58644KEVExploitEPSS 16%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  19. 9.8CVE-2026-56164KEVEPSS 27%

    Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

  20. 9.6CVE-2026-55008EPSS 0.9%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

  21. 9.8CVE-2026-54995EPSS 0.8%

    Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

  22. 9.8CVE-2026-54118EPSS 1.5%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

  23. 9.8CVE-2026-54117EPSS 1.5%

    Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

  24. 9.8CVE-2026-50694EPSS 0.8%

    Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

  25. 9.8CVE-2026-50522KEVEPSS 3.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  26. 9.3CVE-2026-49798EPSS 0.4%

    Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

  27. 9.8CVE-2026-49181EPSS 1.2%

    Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.

  28. 9.8CVE-2026-49172EPSS 1.0%

    Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.

  29. 9.8CVE-2026-49164EPSS 0.8%

    Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

  30. 9.6CVE-2026-48561EPSS 0.9%

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

  31. 9.8CVE-2026-42990EPSS 1.0%

    Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.