From d6f8c6002c67d5127018cfb6857b61d60511b2cd Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 15 Jul 2026 13:15:25 +0000 Subject: [PATCH 1/2] briefing: July 2026 Patch Tuesday Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Vvd16FxoM4h11uu3VxAetB --- docs/briefings/2026-07.md | 102 ++++++++++++++++++++++++++++++++++++++ docs/index.md | 1 + 2 files changed, 103 insertions(+) create mode 100644 docs/briefings/2026-07.md diff --git a/docs/briefings/2026-07.md b/docs/briefings/2026-07.md new file mode 100644 index 0000000..b23abad --- /dev/null +++ b/docs/briefings/2026-07.md @@ -0,0 +1,102 @@ +--- +layout: default +title: "July 2026 Patch Tuesday Briefing — What to Patch First" +description: "Microsoft July 2026 Patch Tuesday triage: 67 Critical CVEs, two CISA KEV entries (SharePoint and AD FS elevation-of-privilege bugs under active exploitation), and a run of Critical SharePoint/DHCP/Exchange RCEs — ranked by real-world urgency." +--- + +# July 2026 Patch Tuesday Briefing + +*Release date: July 14, 2026 · Generated from the [MSRC Security Update Guide](https://msrc.microsoft.com/update-guide) by [patch-tuesday-mcp](https://github.com/jonnybottles/patch-tuesday-mcp)* + +## The month at a glance + +The July 2026 security update spans **1,164 entries** in Microsoft's CVRF document +(including Chromium/Edge and open-source components Microsoft redistributes). Of those: + +- **67 Critical** and **600 Important** severity +- **1 publicly disclosed** before the release: a BitLocker security-feature-bypass +- **2 on the CISA KEV catalog**, both already exploited in the wild: a **SharePoint Server** + elevation-of-privilege bug ([CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164), + federal remediation due **July 17, 2026**) and an **AD FS** elevation-of-privilege bug + ([CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155), due **July 28, 2026**) +- Impact mix: Elevation of Privilege (256) leads, followed by Remote Code Execution (165) and Information Disclosure (108) + +A note on ranking this month: EPSS scores are unusually flat across the board (nothing +above ~1.1% outside the two KEV entries), so a pure EPSS-first sort buries several Critical +RCEs on page two. The picks below override that raw sort with the same judgment an analyst +would apply — active exploitation and blast radius first, EPSS/CVSS second. + +## What to patch first + +1. **SharePoint Server** — [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) + (Elevation of Privilege) is on the **CISA KEV catalog** and **confirmed exploited**, despite + carrying only a **Moderate 5.3** severity rating — don't let the score fool you. The same + release also ships two **Critical 9.8** RCEs, [CVE-2026-50522](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522) + and [CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644), plus a + **Critical 9.1** security-feature-bypass, [CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040). + Four SharePoint bugs, one under active attack: this is the month's top priority for anyone + running SharePoint Server on-prem (KB5002873–KB5002891 family). +2. **Active Directory Federation Services** — [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) + (Elevation of Privilege, CVSS 7.8) is the second **CISA KEV** entry this month and is also + **confirmed exploited**. Any AD FS deployment used for SSO or federation should get this + immediately (KB5099444 family). +3. **Windows DHCP Server** — [CVE-2026-50518](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518) + (RCE, CVSS 9.8), flagged **"Exploitation More Likely"** by MSRC — an unauthenticated, + network-facing DHCP server bug in the same family of components as June's DHCP client RCE. +4. **Windows Server network driver** — [CVE-2026-56188](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188) + (RCE, CVSS 9.8), also **"Exploitation More Likely"** — shares a KB family with the DHCP fix, + so batch these together on server maintenance windows. +5. **Microsoft Exchange Server** — [CVE-2026-55008](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008) + (Spoofing, CVSS 9.6), **"Exploitation More Likely"** — a high-severity spoofing bug on mail + infrastructure deserves the same urgency as the RCEs above. + +The lone publicly disclosed item this month, BitLocker security-feature-bypass +[CVE-2026-50661](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661) +(Important, 6.1), is a local issue: patch on the normal cycle, but assume proof-of-concept +code circulates. + +## Top 25 by urgency + +Ranked KEV/exploited first, then EPSS exploitation probability, severity, and CVSS. + +| CVE | Title | Impact | Sev | CVSS | EPSS | Why prioritized | +|---|---|---|---|---|---|---| +| [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) | Active Directory Federation Services EoP | EoP | Important | 7.8 | — | **On CISA KEV (due 2026-07-28)**; exploited in the wild | +| [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) | Microsoft SharePoint Server EoP | EoP | Moderate | 5.3 | — | **On CISA KEV (due 2026-07-17)**; exploited in the wild | +| [CVE-2026-8925](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8925) | SASL double-free | — | Moderate | 5.9 | 1% | Highest EPSS this month | +| [CVE-2026-9079](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-9079) | Stale proxy password leak | — | Important | — | 1% | High EPSS | +| [CVE-2026-11856](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11856) | Cross-origin Digest auth state leak | — | Moderate | 5.3 | 1% | — | +| [CVE-2026-10536](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10536) | HTTP/2 stream-dependency tree UAF | — | Moderate | 5.5 | 1% | — | +| [CVE-2026-41109](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109) | GitHub Copilot / VS Code security feature bypass | SFB | Important | 8.8 | 1% | High CVSS | +| [CVE-2026-8927](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8927) | Env-set cross-proxy Digest auth state leak | — | Moderate | 5.3 | 1% | — | +| [CVE-2026-57991](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991) | Edge (Chromium) Information Disclosure | Info | Important | 7.4 | 1% | — | +| [CVE-2026-58250](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58250) | NATS Server pre-auth crash via double INFO | DoS | Moderate | 7.5 | 1% | — | +| [CVE-2026-58281](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281) | Edge (Chromium) RCE | RCE | Important | 8.3 | 1% | — | +| [CVE-2026-56646](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646) | Edge (Chromium) Spoofing | Spoofing | Important | 6.5 | 1% | — | +| [CVE-2026-8924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8924) | Trailing dot domain super cookie | — | Important | 9.1 | 1% | High CVSS | +| [CVE-2026-56003](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56003) | libXfont2 computeProps heap buffer overflow | — | Important | 8.5 | 1% | — | +| [CVE-2026-57100](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100) | Microsoft Entra Provisioning Service EoP | EoP | Critical | 9.9 | 1% | Critical severity | +| [CVE-2026-54998](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998) | Microsoft Exchange Online EoP | EoP | Critical | 8.8 | 1% | Critical severity | +| [CVE-2026-57987](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987) | Edge (Chromium) Spoofing | Spoofing | Important | 6.5 | 1% | — | +| [CVE-2026-8926](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8926) | Password leak with netrc and user in URL | — | Critical | 9.1 | 1% | Critical severity | +| [CVE-2026-45499](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499) | Azure OpenAI EoP | EoP | Critical | 9.9 | 1% | Critical severity | +| [CVE-2026-57993](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993) | Edge (Chromium) Spoofing | Spoofing | Important | 7.4 | 1% | — | +| [CVE-2026-12413](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12413) | IKEv2 DoS via malformed fragmentation | DoS | Important | 7.5 | 1% | — | +| [CVE-2026-58208](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58208) | NATS Server MQTT-over-WebSocket crash | DoS | Moderate | 6.8 | 1% | — | +| [CVE-2026-56002](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56002) | libXfont2 PCF font parsing heap buffer overflow | — | Important | 8.5 | 1% | — | +| [CVE-2026-58291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291) | Edge (Chromium) Information Disclosure | Info | Important | 6.1 | 1% | — | +| [CVE-2026-12064](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12064) | Proto-default skips SSH verification | — | Important | 7.5 | 1% | — | + +## Reproduce this briefing + +This page is the output of one tool call against the free, keyless MSRC API: + +``` +msrc_search(month="2026-Jul", include_stats=True, format="markdown") +``` + +Run it from any MCP client via [patch-tuesday-mcp](https://github.com/jonnybottles/patch-tuesday-mcp) +(`uvx patch-tuesday-mcp`), or try the [hosted endpoint](https://github.com/jonnybottles/patch-tuesday-mcp#try-it-instantly--hosted-endpoint-no-install) +with no install at all. + +*Data sources: [MSRC CVRF v3 API](https://github.com/microsoft/MSRC-Microsoft-Security-Updates-API) · [FIRST.org EPSS](https://www.first.org/epss/) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). EPSS scores are point-in-time as of 2026-07-15.* diff --git a/docs/index.md b/docs/index.md index e4da648..5ac47ca 100644 --- a/docs/index.md +++ b/docs/index.md @@ -15,6 +15,7 @@ MCP client) answer questions like *"what do I patch first this month?"* ## Briefings +- [July 2026]({{ site.baseurl }}/briefings/2026-07) - [June 2026]({{ site.baseurl }}/briefings/2026-06) ## Ask these questions yourself From e19f0129a80f84a9d93a330912711d1f7e04bd38 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 22 Jul 2026 13:18:43 +0000 Subject: [PATCH 2/2] briefing: refresh July 2026 data (MSRC/CISA updated since initial draft) --- docs/briefings/2026-07.md | 128 +++++++++++++++++++------------------- 1 file changed, 63 insertions(+), 65 deletions(-) diff --git a/docs/briefings/2026-07.md b/docs/briefings/2026-07.md index b23abad..f570db0 100644 --- a/docs/briefings/2026-07.md +++ b/docs/briefings/2026-07.md @@ -1,7 +1,7 @@ --- layout: default title: "July 2026 Patch Tuesday Briefing — What to Patch First" -description: "Microsoft July 2026 Patch Tuesday triage: 67 Critical CVEs, two CISA KEV entries (SharePoint and AD FS elevation-of-privilege bugs under active exploitation), and a run of Critical SharePoint/DHCP/Exchange RCEs — ranked by real-world urgency." +description: "Microsoft July 2026 Patch Tuesday triage: 102 Critical CVEs, two KEV-listed SharePoint flaws (EoP + RCE) and a KEV-listed AD FS EoP under active exploitation — ranked by real-world urgency." --- # July 2026 Patch Tuesday Briefing @@ -10,50 +10,48 @@ description: "Microsoft July 2026 Patch Tuesday triage: 67 Critical CVEs, two CI ## The month at a glance -The July 2026 security update spans **1,164 entries** in Microsoft's CVRF document +The July 2026 security update spans **1,339 entries** in Microsoft's CVRF document (including Chromium/Edge and open-source components Microsoft redistributes). Of those: -- **67 Critical** and **600 Important** severity -- **1 publicly disclosed** before the release: a BitLocker security-feature-bypass -- **2 on the CISA KEV catalog**, both already exploited in the wild: a **SharePoint Server** - elevation-of-privilege bug ([CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164), - federal remediation due **July 17, 2026**) and an **AD FS** elevation-of-privilege bug - ([CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155), due **July 28, 2026**) -- Impact mix: Elevation of Privilege (256) leads, followed by Remote Code Execution (165) and Information Disclosure (108) - -A note on ranking this month: EPSS scores are unusually flat across the board (nothing -above ~1.1% outside the two KEV entries), so a pure EPSS-first sort buries several Critical -RCEs on page two. The picks below override that raw sort with the same judgment an analyst -would apply — active exploitation and blast radius first, EPSS/CVSS second. +- **102 Critical** and **668 Important** severity +- **1 publicly disclosed** before the release (a BitLocker bypass, not observed exploited) +- **3 on the CISA KEV catalog**, all confirmed exploited in the wild: two SharePoint Server + flaws — elevation of privilege [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) + (due **July 17**) and remote code execution [CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644) + (due **July 19**) — plus Active Directory Federation Services elevation of privilege + [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) (due **July 28**) +- Impact mix: Elevation of Privilege (257) leads, followed by Remote Code Execution (166) and Information Disclosure (109) ## What to patch first -1. **SharePoint Server** — [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) - (Elevation of Privilege) is on the **CISA KEV catalog** and **confirmed exploited**, despite - carrying only a **Moderate 5.3** severity rating — don't let the score fool you. The same - release also ships two **Critical 9.8** RCEs, [CVE-2026-50522](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522) - and [CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644), plus a - **Critical 9.1** security-feature-bypass, [CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040). - Four SharePoint bugs, one under active attack: this is the month's top priority for anyone - running SharePoint Server on-prem (KB5002873–KB5002891 family). -2. **Active Directory Federation Services** — [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) - (Elevation of Privilege, CVSS 7.8) is the second **CISA KEV** entry this month and is also - **confirmed exploited**. Any AD FS deployment used for SSO or federation should get this - immediately (KB5099444 family). -3. **Windows DHCP Server** — [CVE-2026-50518](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518) - (RCE, CVSS 9.8), flagged **"Exploitation More Likely"** by MSRC — an unauthenticated, - network-facing DHCP server bug in the same family of components as June's DHCP client RCE. -4. **Windows Server network driver** — [CVE-2026-56188](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56188) - (RCE, CVSS 9.8), also **"Exploitation More Likely"** — shares a KB family with the DHCP fix, - so batch these together on server maintenance windows. -5. **Microsoft Exchange Server** — [CVE-2026-55008](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008) - (Spoofing, CVSS 9.6), **"Exploitation More Likely"** — a high-severity spoofing bug on mail - infrastructure deserves the same urgency as the RCEs above. - -The lone publicly disclosed item this month, BitLocker security-feature-bypass +1. **SharePoint Server — both KEV-listed flaws** — [CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644) + is a **CVSS 9.8 Critical unauthenticated RCE**, confirmed exploited, federal remediation due + **July 19**. Its sibling [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) + is a lower-severity (Moderate 5.3) elevation of privilege that's *also* confirmed exploited, + due **July 17**. On-prem SharePoint keeps being a favorite active target — patch today + regardless of the CVSS number. +2. **Active Directory Federation Services EoP** — [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) + (Important, 7.8), confirmed exploited, KEV due **July 28**. Any AD FS servers belong in the + same emergency change window as SharePoint above. +3. **The other SharePoint RCE** — [CVE-2026-50522](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522) + (CVSS 9.8 Critical, **20% EPSS** — the highest in this release) isn't on KEV yet, but it + shares update packages with the exploited EoP flaw above. Patch it in the same window. +4. **Windows DHCP Server RCE** — [CVE-2026-50518](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518), + CVSS 9.8 Critical, 7% EPSS. Unauthenticated network RCE against any box running the DHCP + Server role. +5. **The Windows kernel / Win32k elevation cluster** — a dozen-plus Important EoP CVEs (CVSS + 7.0–9.3) spanning the kernel, Win32k, DWM, GDI, and CLFS, including + [CVE-2026-49798](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49798) + (CVSS 9.3, the highest of the bunch). All are fixed by the same July cumulative updates — + one maintenance window covers the lot. +6. **Domain controllers** — with AD FS under confirmed active attack this month, treat identity + infrastructure broadly as a priority: get the July cumulative onto every DC and federation + server, not just the AD FS boxes named in CVE-2026-56155. + +The remaining publicly disclosed item — BitLocker bypass [CVE-2026-50661](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661) -(Important, 6.1), is a local issue: patch on the normal cycle, but assume proof-of-concept -code circulates. +(Important, 6.1, not observed exploited) — is a local issue: patch on the normal cycle, but +assume proof-of-concept code circulates. ## Top 25 by urgency @@ -61,31 +59,31 @@ Ranked KEV/exploited first, then EPSS exploitation probability, severity, and CV | CVE | Title | Impact | Sev | CVSS | EPSS | Why prioritized | |---|---|---|---|---|---|---| -| [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) | Active Directory Federation Services EoP | EoP | Important | 7.8 | — | **On CISA KEV (due 2026-07-28)**; exploited in the wild | -| [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) | Microsoft SharePoint Server EoP | EoP | Moderate | 5.3 | — | **On CISA KEV (due 2026-07-17)**; exploited in the wild | -| [CVE-2026-8925](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8925) | SASL double-free | — | Moderate | 5.9 | 1% | Highest EPSS this month | -| [CVE-2026-9079](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-9079) | Stale proxy password leak | — | Important | — | 1% | High EPSS | -| [CVE-2026-11856](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11856) | Cross-origin Digest auth state leak | — | Moderate | 5.3 | 1% | — | -| [CVE-2026-10536](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10536) | HTTP/2 stream-dependency tree UAF | — | Moderate | 5.5 | 1% | — | -| [CVE-2026-41109](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109) | GitHub Copilot / VS Code security feature bypass | SFB | Important | 8.8 | 1% | High CVSS | -| [CVE-2026-8927](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8927) | Env-set cross-proxy Digest auth state leak | — | Moderate | 5.3 | 1% | — | -| [CVE-2026-57991](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57991) | Edge (Chromium) Information Disclosure | Info | Important | 7.4 | 1% | — | -| [CVE-2026-58250](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58250) | NATS Server pre-auth crash via double INFO | DoS | Moderate | 7.5 | 1% | — | -| [CVE-2026-58281](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58281) | Edge (Chromium) RCE | RCE | Important | 8.3 | 1% | — | -| [CVE-2026-56646](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56646) | Edge (Chromium) Spoofing | Spoofing | Important | 6.5 | 1% | — | -| [CVE-2026-8924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8924) | Trailing dot domain super cookie | — | Important | 9.1 | 1% | High CVSS | -| [CVE-2026-56003](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56003) | libXfont2 computeProps heap buffer overflow | — | Important | 8.5 | 1% | — | -| [CVE-2026-57100](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57100) | Microsoft Entra Provisioning Service EoP | EoP | Critical | 9.9 | 1% | Critical severity | -| [CVE-2026-54998](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54998) | Microsoft Exchange Online EoP | EoP | Critical | 8.8 | 1% | Critical severity | -| [CVE-2026-57987](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57987) | Edge (Chromium) Spoofing | Spoofing | Important | 6.5 | 1% | — | -| [CVE-2026-8926](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8926) | Password leak with netrc and user in URL | — | Critical | 9.1 | 1% | Critical severity | -| [CVE-2026-45499](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45499) | Azure OpenAI EoP | EoP | Critical | 9.9 | 1% | Critical severity | -| [CVE-2026-57993](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57993) | Edge (Chromium) Spoofing | Spoofing | Important | 7.4 | 1% | — | -| [CVE-2026-12413](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12413) | IKEv2 DoS via malformed fragmentation | DoS | Important | 7.5 | 1% | — | -| [CVE-2026-58208](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58208) | NATS Server MQTT-over-WebSocket crash | DoS | Moderate | 6.8 | 1% | — | -| [CVE-2026-56002](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56002) | libXfont2 PCF font parsing heap buffer overflow | — | Important | 8.5 | 1% | — | -| [CVE-2026-58291](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58291) | Edge (Chromium) Information Disclosure | Info | Important | 6.1 | 1% | — | -| [CVE-2026-12064](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12064) | Proto-default skips SSH verification | — | Important | 7.5 | 1% | — | +| [CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164) | SharePoint Server Elevation of Privilege | EoP | Moderate | 5.3 | 6% | **On CISA KEV (due 2026-07-17)**; exploited in the wild | +| [CVE-2026-58644](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644) | SharePoint Remote Code Execution | RCE | Critical | 9.8 | 1% | **On CISA KEV (due 2026-07-19)**; exploited in the wild | +| [CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) | AD FS Elevation of Privilege | EoP | Important | 7.8 | 0% | **On CISA KEV (due 2026-07-28)**; exploited in the wild | +| [CVE-2026-50522](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522) | SharePoint Remote Code Execution | RCE | Critical | 9.8 | **20%** | Highest EPSS this month; Critical | +| [CVE-2026-50518](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50518) | Windows DHCP Server RCE | RCE | Critical | 9.8 | 7% | Unauthenticated network RCE | +| [CVE-2026-50343](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343) | Microsoft Install Service EoP | EoP | Important | 7.8 | 3% | — | +| [CVE-2026-49170](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49170) | Windows StateRepository API Server file EoP | EoP | Important | 7.8 | 3% | — | +| [CVE-2026-50351](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50351) | Windows ACM EoP | EoP | Important | 7.8 | 3% | — | +| [CVE-2026-50423](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50423) | Windows Kernel EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-49805](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49805) | Win32k EoP | EoP | Important | 7.0 | 2% | — | +| [CVE-2026-50509](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50509) | Wireless WAN Service EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-49798](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49798) | Windows Kernel EoP | EoP | Important | 9.3 | 2% | Highest CVSS of the kernel cluster | +| [CVE-2026-50012](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50012) | Squid: memory corruption in cache_digest reply handling | — | Moderate | 5.5 | 2% | — | +| [CVE-2026-50667](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50667) | Windows CLFS Driver EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-47729](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47729) | Squid: memory disclosure in FTP gateway | — | Moderate | 6.5 | 2% | — | +| [CVE-2026-50387](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50387) | Windows GDI EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-50433](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50433) | Windows Media EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-54114](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54114) | Windows Win32k EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-54986](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54986) | Windows Win32k EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-49795](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49795) | Windows Kernel EoP | EoP | Important | 8.8 | 2% | — | +| [CVE-2026-50375](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50375) | DirectX Graphics Kernel EoP | EoP | Important | 6.3 | 2% | — | +| [CVE-2026-50329](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50329) | Microsoft DWM Core Library EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-58536](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58536) | Windows Cloud Files Mini Filter Driver EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-50688](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50688) | Windows Win32k EoP | EoP | Important | 7.8 | 2% | — | +| [CVE-2026-50436](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50436) | Windows Kernel EoP | EoP | Important | 7.8 | 2% | — | ## Reproduce this briefing @@ -99,4 +97,4 @@ Run it from any MCP client via [patch-tuesday-mcp](https://github.com/jonnybottl (`uvx patch-tuesday-mcp`), or try the [hosted endpoint](https://github.com/jonnybottles/patch-tuesday-mcp#try-it-instantly--hosted-endpoint-no-install) with no install at all. -*Data sources: [MSRC CVRF v3 API](https://github.com/microsoft/MSRC-Microsoft-Security-Updates-API) · [FIRST.org EPSS](https://www.first.org/epss/) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). EPSS scores are point-in-time as of 2026-07-15.* +*Data sources: [MSRC CVRF v3 API](https://github.com/microsoft/MSRC-Microsoft-Security-Updates-API) · [FIRST.org EPSS](https://www.first.org/epss/) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). EPSS scores are point-in-time as of 2026-07-22. This page refreshes the initial (2026-07-15) draft — MSRC/CISA had added a third KEV entry and revised severity/EPSS data by the time of this update.*