Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-57092 | Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 9.9 group max | <1% |
| — | ||
| CVE-2026-48561 +1 in the same advisory: …50387 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.6 group max | <1% |
| — | ||
| CVE-2026-49795 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. NVD description · AI analysis pending | 8.8 group max | <1% |
| — | ||
| CVE-2026-55045 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. NVD description · AI analysis pending | 8.4 group max | <1% |
| — | ||
| CVE-2026-54127 | Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. NVD description · AI analysis pending | 8.4 group max | <1% |
| — | ||
| CVE-2026-50423 | Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2026-50522 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthenticated attacker to send maliciously crafted serialized data over the network and execute code on the server, reflected in its 9.8 critical CVSS score with no privileges or user interaction required. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, giving attackers a foothold for follow-on actions such as data theft, lateral movement, or ransomware. Any organization running on-premises SharePoint Server is in scope, particularly deployments reachable from untrusted networks; the required action notes stakeholders must evaluate each asset's internet exposure under CISA BOD 26-04. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-22 and security news headlines describe it as a critical RCE exploited in the wild, with some reports referencing exploitation after a public proof-of-concept release and an authentication bypass. The structured record lists no public PoC as confirmed, but an EPSS of 84.6% (100th percentile) underscores a very high near-term exploitation likelihood. Do: Apply Microsoft's security updates for SharePoint Server immediately per the vendor advisory, as required under CISA's KEV listing and BOD 26-04, and prioritize any SharePoint deployments that are internet-facing (federal/critical-infrastructure operators must follow BOD 26-04 timelines or discontinue unmitigated use). Until patched, restrict public access to SharePoint endpoints (VPN, firewall rules, or reverse proxy) and review IIS/application logs and running processes for signs of unauthenticated deserialization abuse. Because some reports reference an authentication bypass being chained, also verify authentication paths and monitor for follow-on attacker activity after patching. | 9.8 group max | 85% | KEV |
| massorder of 100,000+ on-prem SharePoint Server deployments worldwide, with tens of thousands plausibly internet-exposed | |
| CVE-2026-54117 +1 in the same advisory: …54118 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.8 | 1% |
| — | ||
| CVE-2026-55008 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spo Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. NVD description · AI analysis pending | 9.6 | <1% |
| — | ||
| CVE-2026-55010 | Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network. Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.8 | <1% |
| — | ||
| CVE-2026-55011 +1 in the same advisory: …55012 | Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally. Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2026-55944 | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network. Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2026-56155 | Local Privilege Escalation in Microsoft Active Directory Federation Services CVE-2026-56155 is a high-severity (CVSS 3.1: 7.8) access-control flaw (CWE-1220) in Microsoft Active Directory Federation Services (AD FS), in which insufficient granularity of access control lets an authorized attacker elevate privileges locally. Exploitation requires only low local privileges and no user interaction, so any locally authenticated user or process on a system with the AD FS role can trigger it. Successful exploitation yields full local privilege escalation with high impact on confidentiality, integrity, and availability. It affects organizations running AD FS on Windows Server 2012, 2016, 2019, 2022, and 2025, and on Windows 10 versions 1607 and 1809, per CISA's affected-products list. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-14, confirming in-the-wild exploitation despite a modest EPSS of 0.3%; it was fixed as part of Microsoft's record-breaking July 2026 Patch Tuesday. Do: Apply Microsoft's July 2026 security updates to all affected Windows 10 and Windows Server systems, prioritizing servers hosting the AD FS role, especially federation servers tied to Microsoft 365 or hybrid identity. Per CISA KEV and BOD 26-04, federal agencies must apply vendor mitigations promptly or discontinue use, and all defenders should inventory AD FS servers, restrict local logon to them, and triage for signs of local privilege-escalation activity. No public PoC or workaround beyond patching is currently known. | 7.8 | <1% | KEV |
| largetens of thousands of internet-exposed AD FS servers; likely six figures of total AD FS deployments affected | |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation Microsoft SharePoint Server contains a missing authentication for critical function vulnerability (CWE-306) that lets an unauthenticated attacker elevate privileges over a network without valid credentials. The flaw is triggered when the affected SharePoint function is accessed remotely without any authentication check, allowing an attacker to gain higher privileges than intended. Successful exploitation could enable an attacker to take elevated actions within the SharePoint environment, potentially leading to further compromise of the server and its data. All organizations running on-premises Microsoft SharePoint Server are potentially affected, though specific versions have not yet been enumerated by Microsoft or CISA. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14, indicating it is being actively exploited, and its EPSS score of 26.6% (98th percentile) reflects a high near-term exploitation risk. Do: Apply Microsoft's security updates for SharePoint Server as soon as they are available, and check Microsoft's advisory for the specific affected version ranges once published. In the meantime, restrict network access to SharePoint servers, especially for internet-facing instances, and verify whether your environment falls under CISA BOD 26-04 requirements given the KEV listing. Monitor for updated guidance from Microsoft and CISA, as exploitation is confirmed and patching urgency is high. | 9.8 | 27% | KEV |
| masspotentially millions of users and well over 100,000 exposed installations worldwide | |
| CVE-2026-58596 | Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 8.3 | <1% |
| — | ||
| CVE-2026-58631 | Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally. Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2026-58633 | Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally. NVD description · AI analysis pending | 7.8 | <1% |
| — |
Full article1,201 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, July 14, 2026 16:27
Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical."
Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild.
CVE-2026-56155 is an important-severity elevation of privilege vulnerability in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control. An authorized attacker could use it to elevate privileges locally.
CVE-2026-56164 is a moderate-severity vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function. An unauthorized attacker could exploit it to perform spoofing over a network.
The 57 "critical" entries break down by vulnerability type as follows: 48 remote code execution (RCE), seven elevation of privilege (EoP), 1 spoofing and 1 security feature bypass vulnerability.
The 48 critical RCE vulnerabilities affect a range of Microsoft Windows services and applications, including Windows Media and Media Foundation, the Windows DHCP client and DHCP Server service, Microsoft Office, Word, Excel and PowerPoint, Windows GDI and GDI+, the DirectX Graphics Kernel, Microsoft SharePoint, Microsoft SQL Server, the Windows Reliable Multicast Transport Driver (RMCAST), Windows TCP/IP, the Windows Server Network driver, the Windows Print Spooler, the Windows Secure Socket Tunneling Protocol (SSTP), Windows Active Directory Domain Services, Microsoft Defender, Microsoft Copilot, Microsoft Message Queuing (MSMQ), the Remote Desktop Client, Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (on-premises), and the Minecraft Bedrock Dedicated Server.
Eleven of the critical RCE vulnerabilities are rated "more likely" to be exploited. CVE-2026-50370 and CVE-2026-50518 are heap-based buffer overflows in the Windows DHCP Server service, exploitable by an unauthorized attacker over an adjacent network and over a network, respectively. CVE-2026-54128 is a use-after-free in the Windows DHCP client that allows an unauthorized attacker to execute code locally. CVE-2026-50327 and CVE-2026-50655 are heap-based buffer overflows in Windows Media and Windows Media Foundation. CVE-2026-54992 is a heap-based buffer overflow in the Microsoft Message Queuing Queue Manager. CVE-2026-56188 is a race condition in the Windows Server Network driver, and CVE-2026-55010 is a heap-based buffer overflow in the Minecraft Bedrock Dedicated Server that an unauthorized attacker could exploit over a network. CVE-2026-50522 and CVE-2026-58644 are deserialization vulnerabilities in Microsoft SharePoint that allow an unauthorized attacker to execute code over a network. CVE-2026-55944 is a deserialization vulnerability in Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (on-premises) that allows an unauthorized attacker to execute code over a network.
The remaining critical RCE vulnerabilities are rated "less likely" or "unlikely" to be exploited, or were not assigned an exploitation-likelihood rating by Microsoft. Microsoft Office and its applications account for a large share: CVE-2026-50314, CVE-2026-50467, CVE-2026-55018, CVE-2026-55022, CVE-2026-55045, CVE-2026-55049, CVE-2026-55056, CVE-2026-55129 and CVE-2026-55140 are in Microsoft Office; CVE-2026-55033, CVE-2026-55127 and CVE-2026-55132 are in Microsoft Word; and CVE-2026-55043, CVE-2026-55120 and CVE-2026-55123 are in Microsoft PowerPoint. These are typically triggered by opening a specially crafted document.
The remaining critical RCE vulnerabilities affect Windows Media and Media Foundation (CVE-2026-56189, CVE-2026-57087, CVE-2026-57090, CVE-2026-57094 and CVE-2026-58542), the Windows DHCP Server service (CVE-2026-48564 and CVE-2026-56159), Windows GDI+ and GDI (CVE-2026-49796, CVE-2026-50380 and CVE-2026-54122), the DirectX Graphics Kernel (CVE-2026-50382), the Remote Desktop Client (CVE-2026-50474), Microsoft SQL Server (CVE-2026-54117 and CVE-2026-54118), the Windows Reliable Multicast Transport Driver (CVE-2026-54982 and CVE-2026-54995), Windows TCP/IP (CVE-2026-54999), the Windows Print Spooler (CVE-2026-58608), the Windows SSTP (CVE-2026-50694), Windows Active Directory Domain Services (CVE-2026-49164), Microsoft Defender (CVE-2026-55011 and CVE-2026-55012) and Microsoft Copilot (CVE-2026-48561).
The seven critical elevation of privilege vulnerabilities are CVE-2026-42982 and CVE-2026-50392 in Windows Secure Kernel Mode; CVE-2026-50444 in the Windows Server Update Service (WSUS); CVE-2026-50680 and CVE-2026-54127 in Windows Hyper-V; CVE-2026-54121 in Active Directory Certificate Services; and CVE-2026-57092 in Microsoft Windows VMSwitch.
The single critical spoofing vulnerability is CVE-2026-55008 in Microsoft Exchange Server, caused by a cross-site scripting condition. The single critical security feature bypass is CVE-2026-55040 in Microsoft SharePoint Server, caused by weak authentication. Both are rated "more likely" to be exploited.
Several of the critical entries above — including the Copilot, Azure Synapse, Azure OpenAI, Exchange Online and Entra items — affect Microsoft cloud services, for which Microsoft has not assigned an exploitation-likelihood rating.
Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that their exploitation is "more likely:"
· CVE-2026-49170: Windows StateRepository API Server file Elevation of Privilege Vulnerability
· CVE-2026-49795: Windows Kernel Elevation of Privilege Vulnerability
· CVE-2026-49798: Windows Kernel Elevation of Privilege Vulnerability
· CVE-2026-49805: Win32k Elevation of Privilege Vulnerability
· CVE-2026-50297: Win32k Elevation of Privilege Vulnerability
· CVE-2026-50325: Win32k Elevation of Privilege Vulnerability
· CVE-2026-50329: Microsoft DWM Core Library Elevation of Privilege Vulnerability
· CVE-2026-50332: Windows Kernel Elevation of Privilege Vulnerability
· CVE-2026-50343: Microsoft Install Service Elevation of Privilege Vulnerability
· CVE-2026-50351: Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability
· CVE-2026-50375: DirectX Graphics Kernel Elevation of Privilege Vulnerability
· CVE-2026-50387: Windows GDI Elevation of Privilege Vulnerability
· CVE-2026-50390: Windows Kernel Elevation of Privilege Vulnerability
· CVE-2026-50423: Windows Kernel Elevation of Privilege Vulnerability
· CVE-2026-50433: Windows Media Elevation of Privilege Vulnerability
· CVE-2026-50436: Windows Kernel Elevation of Privilege Vulnerability
· CVE-2026-50454: Windows User Interface Core Elevation of Privilege Vulnerability
· CVE-2026-50475: Windows Kernel Information Disclosure Vulnerability
· CVE-2026-50476: Windows Network Connections Service Elevation of Privilege Vulnerability
· CVE-2026-50489: Win32k Elevation of Privilege Vulnerability
· CVE-2026-50509: Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability
· CVE-2026-50667: Windows Common Log File System Driver Elevation of Privilege Vulnerability
· CVE-2026-50688: Windows Win32k Elevation of Privilege Vulnerability
· CVE-2026-54114: Windows Win32k Elevation of Privilege Vulnerability
· CVE-2026-54986: Windows Win32k Elevation of Privilege Vulnerability
· CVE-2026-57091: Windows File History Service Elevation of Privilege Vulnerability
· CVE-2026-58531: Windows SMB Elevation of Privilege Vulnerability
· CVE-2026-58536: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
· CVE-2026-58596: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
· CVE-2026-58631: Windows Admin Center (WAC) Remote Code Execution Vulnerability
· CVE-2026-58633: Desktop Window Manager Elevation of Privilege Vulnerability
· CVE-2026-58638: Windows Boot Loader Security Feature Bypass Vulnerability
A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.
In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
Snort 2 rules included in this release that protect against the exploitation of many of these vulnerabilities are: 1:66733 - 1:66743, 1:66745 - 1:66785, 1:66791 - 1:66793, 1:66800 - 1:66807
The following Snort 3 rules are also available: 1:301555 - 1:301579, 1:301581 - 1:301583
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/