Microsoft

July 2026 Security Updates

2026-Jul Jul 14, 2026 Source: Vendor

Imported by the Microsoft release catcher from the MSRC CVRF API (2026-Jul, revision 2026-08-03T07:00:00Z). 2070 vulnerabilities, 658 of them carrying an acknowledgement. Draft — review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul

Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1055 lines

Showing 101–150 of 1055 · page 3 of 22

CVE-2026-55005 BR2026-0000-000101 unclaimed

Microsoft Exchange Server Remote Code Execution Vulnerability

Credited as kunlun Lab

CVE-2026-55005 BR2026-0000-000102 unclaimed

Microsoft Exchange Server Remote Code Execution Vulnerability

Credited as GLM

CVE-2026-55006 BR2026-0000-000103 unclaimed

Microsoft Exchange Server Elevation of Privilege Vulnerability

Credited as MARIOS GYFTOS

CVE-2026-55008 BR2026-0000-000104 unclaimed

Microsoft Exchange Server Spoofing Vulnerability

Credited as Michael Maturi with Google

CVE-2026-50338 BR2026-0000-000105 unclaimed

Azure Spring Apps Elevation of Privilege Vulnerability

Credited as Lukas Johannes Moeller

CVE-2026-50524 BR2026-0000-000106 unclaimed

.NET Framework Denial of Service Vulnerability

Credited as 41ae55e9310ff27fa6f26af4727e5590

CVE-2026-54117 BR2026-0000-000107 unclaimed

Microsoft SQL Server Remote Code Execution Vulnerability

Credited as Piotr Bazydło (@chudypb)

CVE-2026-54118 BR2026-0000-000108 unclaimed

Microsoft SQL Server Remote Code Execution Vulnerability

Credited as Piotr Bazydło (@chudypb)

CVE-2026-55002 BR2026-0000-000109 unclaimed

Microsoft SQL Server Elevation of Privilege Vulnerability

Credited as Fabiano Amorim with Pythian

CVE-2026-55144 BR2026-0000-000110 unclaimed

Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

Credited as Samuel Lee with Microsoft

CVE-2026-50520 BR2026-0000-000111 unclaimed

Visual Studio Code Remote Code Execution Vulnerability

Credited as Daniel Santos with Microsoft

CVE-2026-54108 BR2026-0000-000112 unclaimed

Microsoft SharePoint Server Spoofing Vulnerability

Credited as Piotr Bazydło (@chudypb)

CVE-2026-54108 BR2026-0000-000113 unclaimed

Microsoft SharePoint Server Spoofing Vulnerability

Credited as 41ae55e9310ff27fa6f26af4727e5590

CVE-2026-50678 BR2026-0000-000114 unclaimed

Microsoft Excel Information Disclosure Vulnerability

Credited as f4

CVE-2026-50678 BR2026-0000-000115 unclaimed

Microsoft Excel Information Disclosure Vulnerability

Credited as Zhiniang Peng with HUST

CVE-2026-54988 BR2026-0000-000116 unclaimed

Microsoft Excel Information Disclosure Vulnerability

Credited as Haein Lee with KAIST Hacking Lab

CVE-2026-55899 BR2026-0000-000117 unclaimed

Microsoft Excel Remote Code Execution Vulnerability

Credited as 0ccbbf129444eb66344ccafb92b00df4

CVE-2026-55945 BR2026-0000-000118 unclaimed

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Credited as Gal Weizman (weizmangal@gmail.com / https://x.com/weizmangal)

CVE-2026-55948 BR2026-0000-000119 unclaimed

Microsoft Excel Remote Code Execution Vulnerability

Credited as 0ccbbf129444eb66344ccafb92b00df4

CVE-2026-56155 BR2026-0000-000120 unclaimed

Active Directory Federation Services Elevation of Privilege Vulnerability

Credited as Scott Clark (DART) with Microsoft

CVE-2026-56155 BR2026-0000-000121 unclaimed

Active Directory Federation Services Elevation of Privilege Vulnerability

Credited as Jeremy Kingston (DART) with Microsoft

CVE-2026-56164 BR2026-0000-000122 unclaimed

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Credited as Genwei Jiang with Google Cloud, FLARE OTF

CVE-2026-56164 BR2026-0000-000123 unclaimed

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Credited as Jayson Frost with Mandiant Incident Response

CVE-2026-56169 BR2026-0000-000124 unclaimed

Windows Admin Center Elevation of Privilege Vulnerability

Credited as Howard McGreehan with MSRC V&M

CVE-2026-56170 BR2026-0000-000125 unclaimed

ASP.NET Core Denial of Service Vulnerability

Credited as Ky0toFu

CVE-2026-54127 BR2026-0000-000126 unclaimed

Windows Hyper-V Elevation of Privilege Vulnerability

Credited as MORSE with Microsoft

CVE-2026-56193 BR2026-0000-000127 unclaimed

Microsoft Office Information Disclosure Vulnerability

Credited as Haein Lee with KAIST Hacking Lab

CVE-2026-56185 BR2026-0000-000128 unclaimed

Windows Admin Center Information Disclosure Vulnerability

Credited as Howard McGreehan with MSRC V&M

CVE-2026-57097 BR2026-0000-000129 unclaimed

Microsoft XML Security Feature Bypass Vulnerability

Credited as Ken Pyle with Independent Academic

CVE-2026-57097 BR2026-0000-000130 unclaimed

Microsoft XML Security Feature Bypass Vulnerability

Credited as Responsible Cybersecurity Research

CVE-2026-57107 BR2026-0000-000131 unclaimed

Windows Admin Center Elevation of Privilege Vulnerability

Credited as sho odagiri with GMO Cybersecurity by Ierae inc

CVE-2026-57969 BR2026-0000-000132 unclaimed

Azure CycleCloud Elevation of Privilege Vulnerability

Credited as Asaf Cohen with XBreach.ai

CVE-2026-57969 BR2026-0000-000133 unclaimed

Azure CycleCloud Elevation of Privilege Vulnerability

Credited as XBREACH.AI TEAM with https://xbreach.ai/

CVE-2026-57976 BR2026-0000-000134 unclaimed

Windows Active Directory Domain Services Denial of Service Vulnerability

Credited as Ravi Kumar

CVE-2026-57979 BR2026-0000-000135 unclaimed

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability

Credited as Sanil Singh Tomar with Microsoft

CVE-2026-57981 BR2026-0000-000136 unclaimed

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability