VulnerabilitycriticalExploited in the wild

Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

Cisco TalosJul 15, 2026 · 14:52 UTC (Jul 15, 2026)5 min read2 · 1 read

Read at blog.talosintelligence.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-56155 CVE-2026-56164 CVE-2026-50370 CVE-2026-50518 CVE-2026-54128 CVE-2026-50327 CVE-2026-50655 CVE-2026-54992 CVE-2026-56188 CVE-2026-55010 CVE-2026-50522 CVE-2026-58644 CVE-2026-55944 CVE-2026-50314 CVE-2026-50467 CVE-2026-55018 CVE-2026-55022 CVE-2026-55045 CVE-2026-55049 CVE-2026-55056 CVE-2026-55129 CVE-2026-55140 CVE-2026-55033 CVE-2026-55127 CVE-2026-55132 CVE-2026-55043 CVE-2026-55120 CVE-2026-55123 CVE-2026-56189 CVE-2026-57087 CVE-2026-57090 CVE-2026-57094 CVE-2026-58542 CVE-2026-48564 CVE-2026-56159 CVE-2026-49796 CVE-2026-50380 CVE-2026-54122 CVE-2026-50382 CVE-2026-50474 CVE-2026-54117 CVE-2026-54118 CVE-2026-54982 CVE-2026-54995 CVE-2026-54999 CVE-2026-58608 CVE-2026-50694 CVE-2026-49164 CVE-2026-55011 CVE-2026-55012 CVE-2026-48561 CVE-2026-42982 CVE-2026-50392 CVE-2026-50444 CVE-2026-50680 CVE-2026-54127 CVE-2026-54121 CVE-2026-57092 CVE-2026-55008 CVE-2026-55040 CVE-2026-49170 CVE-2026-49795 CVE-2026-49798 CVE-2026-49805 CVE-2026-50297 CVE-2026-50325 CVE-2026-50329 CVE-2026-50332 CVE-2026-50343 CVE-2026-50351 CVE-2026-50375 CVE-2026-50387 CVE-2026-50390 CVE-2026-50423 CVE-2026-50433 CVE-2026-50436 CVE-2026-50454 CVE-2026-50475 CVE-2026-50476 CVE-2026-50489 CVE-2026-50509 CVE-2026-50667 CVE-2026-50688 CVE-2026-54114 CVE-2026-54986 CVE-2026-57091 CVE-2026-58531 CVE-2026-58536 CVE-2026-58596 CVE-2026-58631 CVE-2026-58633 CVE-2026-58638

Tags: cve-2026-50370 cve-2026-50518 cve-2026-54128 cve-2026-56155 cve-2026-56164 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-57092 +42 related CVEs CVE-2026-56159 CVE-2026-50518 CVE-2026-57090 CVE-2026-49164 CVE-2026-50694 CVE-2026-54995 CVE-2026-50380 CVE-2026-49798 CVE-2026-48564 CVE-2026-50474 CVE-2026-57094 CVE-2026-50444+30 more	Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network	9.9 group max	<1%		Jul 14, 2026
CVE-2026-48561 +1 related CVE CVE-2026-50387	Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute…	9.6 group max	<1%		Jul 14, 2026
CVE-2026-49795 +9 related CVEs CVE-2026-50382 CVE-2026-50680 CVE-2026-50329 CVE-2026-54114 CVE-2026-58536 CVE-2026-49170 CVE-2026-50343 CVE-2026-50375 CVE-2026-58638	Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally	8.8 group max	<1%		Jul 14, 2026
CVE-2026-55045 +14 related CVEs CVE-2026-55033 CVE-2026-55127 CVE-2026-55132 CVE-2026-50467 CVE-2026-55018 CVE-2026-55022 CVE-2026-50314 CVE-2026-55043 CVE-2026-55049 CVE-2026-55056 CVE-2026-55120 CVE-2026-55123+2 more	Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally	8.4 group max	<1%		Jul 14, 2026
CVE-2026-54127 +5 related CVEs CVE-2026-50454 CVE-2026-58542 CVE-2026-50436 CVE-2026-50327 CVE-2026-50392	Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally	8.4 group max	<1%		Jul 14, 2026
CVE-2026-50423	Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally	7.8	<1%		Jul 14, 2026
CVE-2026-58644 +2 related CVEs CVE-2026-50522 CVE-2026-55040	Unauthenticated Deserialization RCE in Microsoft SharePoint Server	9.8 group max	16%	KEV	Jul 14, 2026 KEV Jul 16, 2026
CVE-2026-54117 +1 related CVE CVE-2026-54118	Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network	9.8	1%		Jul 14, 2026
CVE-2026-55008	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…	9.6	<1%		Jul 14, 2026
CVE-2026-55010	Heap-based buffer overflow in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network	9.8	<1%		Jul 14, 2026
CVE-2026-55011 +1 related CVE CVE-2026-55012	Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally	7.8	<1%		Jul 14, 2026
CVE-2026-55944	Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network	9.8	2%	PoC	Jul 14, 2026
CVE-2026-56155	Local Privilege Escalation in Microsoft Active Directory Federation Services	7.8	<1%	KEV	Jul 14, 2026 KEV Jul 14, 2026
CVE-2026-56164	Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation	9.8	1%	KEV	Jul 14, 2026 KEV Jul 14, 2026
CVE-2026-58596	Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network	8.3	<1%		Jul 12, 2026
CVE-2026-58631	Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally	7.8	<1%		Jul 14, 2026
CVE-2026-58633	Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally	7.8	<1%		Jul 14, 2026

From the original article

5 min read at blog.talosintelligence.com

Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical." Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.