Report Name: Microsoft Patch Tuesday, July 2026
Generated: 2026-07-25 23:17:09

Product Name	Prevalence	U	C	H	M	L	A	Comment
Microsoft Desktop Window Manager	0.95			3			3	Desktop Window Manager (DWM) is a core component of Microsoft Windows responsible for compositing and rendering the graphical user interface, including window effects, transparency, and desktop composition.
Active Directory	0.9			1			1	Active Directory is a directory service developed by Microsoft for Windows domain networks
Active Directory Federation Server	0.9			1	1		2	Active Directory is a directory service developed by Microsoft for Windows domain networks
HTTP/2	0.9			1			1	HTTP/2 is a major revision of the HTTP network protocol used by the World Wide Web
Windows DNS Server	0.9			2			2	Windows component
Windows Kernel	0.9		1	22	5		28	Windows Kernel
Windows TCP/IP	0.9			2	2		4	Windows component
Windows Win32k	0.9			12	3		15	The Win32k.sys driver is the kernel side of some core parts of the Windows subsystem. Its main functionality is the GUI of Windows; it's responsible for window management.
.NET Framework	0.8			5			5	.NET Framework
ASP.NET Core	0.8			3			3	An open-source, server-side web-application framework designed for web development
DirectX Graphics Kernel	0.8			6	2		8	DirectX Graphics Kernel
Microsoft Brokering File System	0.8			1	4		5	The Microsoft Brokering File System (BFS) is a Windows component designed to act as an intermediary for file access in isolated (sandboxed) Win32 applications
Microsoft DWM Core Library	0.8			2			2	Windows component
Microsoft Defender	0.8			2			2	Anti-malware component of Microsoft Windows
Microsoft Exchange	0.8			2	2		4	Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft
Microsoft Office	0.8			19	8		27	Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer
Microsoft Windows App Store	0.8			1	3		4	Windows component
Microsoft Windows Media Foundation	0.8			7			7	Windows component
Microsoft Windows VMSwitch	0.8			1			1	Windows component
Quality Windows Audio/Video Experience (QWAVE)	0.8				1		1	Windows component
Secure Boot	0.8			1			1	Secure boot is a security standard developed by members of the PC industry to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM)
Windows Active Directory	0.8			1			1	Windows component
Windows Active Directory Domain Services	0.8			4			4	Windows component
Windows Active Directory Federation Services	0.8			6	1		7	Windows component
Windows Active Directory Federation Services (ADFS)	0.8			1			1	Windows component
Windows Admin Center	0.8			2	1		3	Windows component
Windows Admin Center (WAC)	0.8			3			3	Windows component
Windows Ancillary Function Driver for WinSock	0.8			1	3		4	Windows component
Windows App Package Installer	0.8			1	2		3	Windows component
Windows AppX Deployment Extensions	0.8				1		1	Windows component
Windows Application Model Core API	0.8			1			1	Windows component
Windows Audio Compression Manager (ACM)	0.8			1			1	Windows component
Windows Audio Service	0.8				2		2	Windows component
Windows Backup Engine	0.8				1		1	Windows component
Windows Backup Service	0.8			1			1	Windows component
Windows BitLocker	0.8			1			1	Windows component
Windows Bluetooth	0.8			1			1	Windows component
Windows Bluetooth Service	0.8			1			1	Windows component
Windows Boot Loader	0.8				1		1	Windows component
Windows Client-Side Caching	0.8				1		1	Windows component
Windows Clip Service	0.8				1		1	Windows component
Windows Clipboard Server	0.8				2		2	Windows component
Windows Cloud Files Mini Filter Driver	0.8		1	1	2		4	Windows component
Windows Common Log File System Driver	0.8			2			2	Common Log File System is a general-purpose logging subsystem that is accessible to both kernel-mode as well as user-mode applications for building high-performance transaction logs
Windows Connected User Experiences and Telemetry	0.8			1			1	Windows component
Windows Container Isolation FS Filter Driver (unionfs.sys)	0.8				1		1	Windows component
Windows Cryptographic Services	0.8			1	1		2	Windows component
Windows Cryptography API: Next Generation (CNG)	0.8				1		1	Windows component
Windows DHCP Client	0.8			3			3	Windows component
Windows DHCP Server	0.8			3			3	Windows component
Windows DNS Client	0.8			2	1		3	Windows component
Windows DWM Core Library	0.8				2		2	Windows component
Windows Data.dll	0.8			1			1	Windows component
Windows DirectX	0.8				1		1	Windows component
Windows Domain Controller	0.8			1			1	Windows component
Windows Event Logging Service	0.8			2			2	Windows component
Windows FTP Service	0.8			1			1	Windows component
Windows File Explorer	0.8			2	6		8	Windows component
Windows File History Service	0.8			1			1	Windows component
Windows Filtering Platform	0.8				1		1	Windows component
Windows GDI	0.8			1			1	Windows component
Windows GDI+	0.8			3			3	Windows component
Windows Graphics Component	0.8			1	1		2	Windows component
Windows Group Policy	0.8			1			1	Windows component
Windows Human Interface Device	0.8				1		1	Windows component
Windows Image Acquisition	0.8			1			1	Windows component
Windows Input Method Editor (IME)	0.8			1			1	Windows component
Windows Installer	0.8			1	1		2	Windows component
Windows Internal System User Profile	0.8			1			1	Windows component
Windows Internal Task Bar	0.8			1			1	Windows component
Windows Kernel-Mode Driver	0.8				3		3	Windows component
Windows Key Guard	0.8				2		2	Windows component
Windows LUA File Virtualization Filter Driver	0.8				1		1	Windows component
Windows Local Security Authority Subsystem Service (LSASS)	0.8			2			2	Windows component
Windows MIDI Service Module	0.8			1	2		3	Windows component
Windows Management Services	0.8				1		1	Windows component
Windows Media	0.8			8	6		14	Windows component
Windows Media Photo Codec	0.8			1			1	Windows component
Windows Message Queuing (MSMQ)	0.8			1			1	Windows component
Windows Message Queuing Service (MSMQ)	0.8			2			2	Windows component
Windows NFS Server	0.8			2			2	Windows component
Windows NTFS	0.8			19	3		22	The default file system of the Windows NT family
Windows Narrator Braille	0.8			1			1	Windows component
Windows Netlogon	0.8			1			1	Windows component
Windows Network Address Translation (NAT)	0.8				1		1	Windows component
Windows Network Connections Service	0.8			1	1		2	Windows component
Windows Network File System	0.8			2			2	Windows component
Windows Network Policy Server SNMP	0.8			2			2	Windows component
Windows Notification	0.8			1			1	Windows component
Windows OLE	0.8			2			2	Windows component
Windows Operating Systems	0.8			1	1		2	Windows component
Windows Overlay Filter	0.8			2	1		3	Windows component
Windows PowerShell	0.8			1			1	Windows component
Windows Print Configuration	0.8			2			2	Windows component
Windows Print Spooler	0.8			2	2		4	Windows component
Windows Projected File System	0.8			1			1	Windows component
Windows Push Notification	0.8				4		4	Windows component
Windows Push Notifications	0.8			1	1		2	Windows component
Windows Quality of Service (QoS) Packet Scheduler	0.8			1			1	Windows component
Windows Redirected Drive Buffering System	0.8				1		1	Windows component
Windows Reliable Multicast Transport Driver (RMCAST)	0.8			2			2	Windows component
Windows Remote Access	0.8			1			1	Windows component
Windows Remote Access Service Infrastructure	0.8			1			1	Windows component
Windows Remote Desktop Client	0.8			10			10	Remote Desktop Protocol Client
Windows Remote Desktop Protocol	0.8			7			7	Windows component
Windows Remote Desktop Services	0.8			2			2	Remote Desktop Services, known as Terminal Services in Windows Server 2008 and earlier, is one of the components of Microsoft Windows that allow a user to initiate and control an interactive session on a remote computer or virtual machine over a network connection
Windows Remote Help Defense	0.8				1		1	Windows component
Windows Resilient File System (ReFS)	0.8			11	1		12	Windows component
Windows Routing and Remote Access Service (RRAS)	0.8			1	2		3	Windows component
Windows Runtime	0.8			6	11		17	Windows component
Windows SMB	0.8			1	3		4	Windows component
Windows SMB Server	0.8			2			2	Windows component
Windows SMB Server Network Transport Driver (srvnet.sys)	0.8			1			1	Windows component
Windows Search Service	0.8			2			2	Windows component
Windows Secure Channel	0.8			2	1		3	Windows component
Windows Secure Kernel Mode	0.8			1	1		2	Windows component
Windows Secure Socket Tunneling Protocol (SSTP)	0.8			1			1	Windows component
Windows Sensor Data Service	0.8			1	1		2	Windows component
Windows Server	0.8				1		1	Windows component
Windows Server Network driver	0.8			1			1	Windows component
Windows Server Update Service (WSUS)	0.8			1	1		2	Windows component
Windows Spaceport.sys	0.8			1	1		2	Windows component
Windows Speech Runtime	0.8				1		1	Windows component
Windows StateRepository API Server file	0.8			1			1	Windows component
Windows Storage	0.8				1		1	Windows component
Windows Storage Spaces Direct	0.8			1			1	Windows component
Windows Subsystem for Linux (WSL2) Kernel	0.8			1	1		2	Windows component
Windows Telephony Server	0.8				1		1	Windows component
Windows Terminal	0.8			1			1	Windows component
Windows Trusted Runtime Interface Driver	0.8				1		1	Windows component
Windows USB Audio Class Driver	0.8			1	2		3	Windows component
Windows USB Driver	0.8				1		1	Windows component
Windows USB Hub Driver	0.8			1			1	Windows component
Windows USB Print Driver	0.8				6		6	Windows component
Windows USB Video Driver	0.8			1			1	Windows component
Windows Unified Consent System	0.8			1			1	Windows component
Windows Universal Disk Format File System Driver (UDFS)	0.8			1	1		2	Windows component
Windows Universal Plug and Play (UPnP) Device Host	0.8				1		1	Windows component
Windows User Interface Core	0.8		1				1	Windows component
Windows WalletService	0.8		1				1	Windows component
Windows Web Proxy Auto-Discovery Protocol (WPAD)	0.8			2			2	Windows component
Windows WebView	0.8				1		1	Windows component
Windows Win32 Kernel Subsystem	0.8			1			1	Windows component
Windows Wireless Network Manager	0.8				1		1	Windows component
Windows Zero Trust DNS	0.8				1		1	Windows component
.NET	0.7			3	6		9	.NET
Clipboard User Service	0.7				1		1	Clipboard User Service
Microsoft SharePoint	0.7	1	1	2			4	Microsoft SharePoint
Storage Spaces Direct	0.7				1		1	Storage Spaces Direct is a feature of Azure Stack HCI and Windows Server that enables you to cluster servers with internal storage into a software-defined storage solution
Microsoft Excel	0.6			4	30		34	MS Office product
Microsoft PowerPoint	0.6			3			3	Microsoft PowerPoint
Microsoft Word	0.6			4	8		12	Microsoft Word is a widely used commercial word processor developed by Microsoft. It is a component of the Microsoft Office suite of productivity software but can also be purchased as a standalone product.
Windows Hyper-V	0.6				4		4	Hardware virtualization component of the client editions of Windows NT
Active Directory Certificate Services	0.5			1			1	Active Directory Certificate Services
Active Directory Domain Services	0.5				1		1	Active Directory Domain Services
Active Directory Federation Services	0.5		1				1	Active Directory Federation Services
Azure Active Directory	0.5				2		2	Azure Active Directory
Azure CycleCloud	0.5			1	1		2	Azure CycleCloud
Azure Monitor Agent Metrics Extension	0.5				1		1	Azure Monitor Agent Metrics Extension
Azure Spring Apps	0.5			1			1	Azure Spring Apps
Code Integrity DLL (ci.dll)	0.5				1		1	Code Integrity DLL (ci.dll)
Composite Image File System driver (cimfs.sys)	0.5				1		1	Composite Image File System driver (cimfs.sys)
Configuration Manager	0.5				1		1	Configuration Manager
Content Delivery Manager	0.5				1		1	Content Delivery Manager
DHCP Server Service	0.5			3			3	DHCP Server Service
DNS Client	0.5				2		2	DNS Client
Extensible Storage Engine (ESENT)	0.5				1		1	Extensible Storage Engine (ESENT)
Game: Age of Empires II: Definitive Edition	0.5			1			1	Game: Age of Empires II: Definitive Edition
GitHub Copilot	0.5				1		1	GitHub Copilot
GitHub Copilot and Visual Studio Code	0.5			1	1		2	GitHub Copilot and Visual Studio Code
HTTP.sys	0.5				2		2	HTTP.sys
Internet Key Exchange (IKE) Protocol	0.5				1		1	Internet Key Exchange (IKE) Protocol
M365 Copilot for iOS	0.5				1		1	M365 Copilot for iOS
Microsoft Bing App for IOS	0.5				1		1	Microsoft Bing App for IOS
Microsoft Copilot	0.5			1			1	Microsoft Copilot
Microsoft Defender for Endpoint for Mac	0.5				3		3	Microsoft Defender for Endpoint for Mac
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises)	0.5			1			1	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises)
Microsoft Fabric Data Warehouse	0.5			1			1	Microsoft Fabric Data Warehouse
Microsoft Install Service	0.5			1			1	Microsoft Install Service
Microsoft Message Queuing Queue Manager	0.5			2			2	Microsoft Message Queuing Queue Manager
Microsoft NAT Helper Components (ipnathlp.dll)	0.5				1		1	Microsoft NAT Helper Components (ipnathlp.dll)
Microsoft OneNote	0.5				1		1	Microsoft OneNote
Microsoft PC Manager	0.5				2		2	Microsoft PC Manager
Microsoft PowerBI Report Server	0.5				1		1	Microsoft PowerBI Report Server
Microsoft SQL Server	0.5			3	4		7	Microsoft SQL Server
Microsoft SharePoint Server	0.5		1	1	11		13	Microsoft SharePoint Server
Microsoft XML	0.5				1		1	Microsoft XML
Microsoft XML Core Services	0.5				1		1	Microsoft XML Core Services
Minecraft Bedrock Dedicated Server	0.5			1			1	Minecraft Bedrock Dedicated Server
Netlogon RPC	0.5				1		1	Netlogon RPC
OData for ASP.NET and ASP.NET Core	0.5				2		2	OData for ASP.NET and ASP.NET Core
Outlook Copilot	0.5				1		1	Outlook Copilot
Remote Access Management service/API (RPC server)	0.5				1		1	Remote Access Management service/API (RPC server)
SQL Server ODBC driver	0.5			1			1	SQL Server ODBC driver
Surface Broker SDMA	0.5				1		1	Surface Broker SDMA
Universal Plug and Play (upnp.dll)	0.5				2		2	Universal Plug and Play (upnp.dll)
Universal Print Management Service	0.5				2		2	Universal Print Management Service
Window Virtual Filtering Platform (VFP)	0.5				1		1	Window Virtual Filtering Platform (VFP)
Windows 10 1607	0.5				1		1	Product detected by o:microsoft:windows_10_1607 (exists in CPE dict)
Wireless Wide Area Network Service (WwanSvc)	0.5			1			1	Wireless Wide Area Network Service (WwanSvc)
windows_11_24h2	0.5				1		1	Product detected by o:microsoft:windows_11_24h2 (does NOT exist in CPE dict)
Visual Studio	0.3				1		1	Integrated development environment
Visual Studio Code	0.3				4		4	Integrated development environment

Vulnerability Type	Criticality	U	C	H	M	L	A
Remote Code Execution	1.0	1	1	109	30		141
Authentication Bypass	0.98				1		1
Security Feature Bypass	0.9			7	9		16
Elevation of Privilege	0.85		5	136	111		252
Information Disclosure	0.83		1	38	63		102
Denial of Service	0.7			22	13		35
Spoofing	0.4				16		16
Tampering	0.3				8		8

Source	U	C	H	M	L	A
Qualys	1	3	52	4		60
Tenable		2	2			4
Rapid7		2	3			5
ZDI		3	29	1		33

Urgent (1)

1. Remote Code Execution - Microsoft SharePoint (CVE-2026-58644) - Urgent [833]

Description: Microsoft SharePoint Remote Code Execution Vulnerability

Qualys: CVE-2026-58644 & CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability A deserialization of untrusted data flaw in Microsoft Office SharePoint may allow an unauthenticated attacker to execute code over a network. CISA added the CVE-2026-50522 to its Known Exploited Vulnerabilities Catalog, urging users to patch before July 25, 2026.

Critical (7)

2. Remote Code Execution - Microsoft SharePoint (CVE-2026-50522) - Critical [747]

Description: Microsoft SharePoint Remote Code Execution Vulnerability

Qualys: CVE-2026-58644 & CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability A deserialization of untrusted data flaw in Microsoft Office SharePoint may allow an unauthenticated attacker to execute code over a network. CISA added the CVE-2026-50522 to its Known Exploited Vulnerabilities Catalog, urging users to patch before July 25, 2026.

ZDI: -    CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability. This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly. . -    CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability. This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

3. Elevation of Privilege - Microsoft SharePoint Server (CVE-2026-56164) - Critical [737]

Description: Microsoft SharePoint Server Elevation of Privilege Vulnerability

Qualys: CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability Missing authentication for a critical function in Microsoft Office SharePoint could allow an unauthenticated attacker to elevate privileges over a network. Microsoft mentioned in the advisory that enabling the Antimalware Scan Interface (AMSI) on the server and setting the Request Body Scan mode to Full can help mitigate this flaw. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging users to patch it before July 17, 2026.

Qualys: CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability This vulnerability has a CVSS: 3.1 5.3 / 4.9 Policy Audit Control IDs (CIDs): 30908 Status of the ‘Antimalware Scan Interface’ in SharePoint Server The following QQL will return a posture assessment for the CIDs for this Patch Tuesday: control.id: [30908] Visit the July 2026 Security Updates to access the full description of each vulnerability and the systems it affects. Qualys customers can scan their network with QIDs 110529, 110530, 387867, 387868, 50148, 92416, 92417, 92418, 92419, 92420, 92421, 92422, 92423, 92424, 92425, 92426, 92427, and 92428 to detect vulnerable assets. Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities. References: https://msrc.microsoft.com/update-guide https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul

Tenable: Microsoft’s July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)

Tenable: CVE-2026-56164 | Microsoft SharePoint Server Elevation of Privilege Vulnerability

Tenable: CVE-2026-56164 is an EoP vulnerability in Microsoft SharePoint Server. It received a CVSSv3 score of 5.3 and is rated moderate. According to Microsoft, it was exploited in the wild as a zero-day. This vulnerability affects Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, as well as SharePoint Server 2016 and SharePoint Enterprise Server 2016.

Rapid7: It’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is aware of existing in-the-wild exploitation of CVE-2026-56164, where successful exploitation allows an attacker to elevate privileges over a network, with no existing privileges required, and low attack complexity since “an attacker does not require significant prior knowledge of the system, and can achieve repeatable success”. This is as good an example as any that a relatively low CVSS v3 base score (5.3) may be an imperfect signal concealing something much spicier, and Microsoft acknowledges that possibility by assigning a severity rating of Important. Microsoft certainly intended to list CVE-2026-56164 in the new Notable CVEs section of the Security Update Guide instead of erroneously listing CVE-2026-56155 twice, and it’s likely that this will be corrected shortly.

ZDI: -    CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability. The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

4. Elevation of Privilege - Active Directory Federation Services (CVE-2026-56155) - Critical [701]

Description: Active Directory Federation Services Elevation of Privilege Vulnerability

Qualys: CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability Insufficient granularity of access control in Active Directory Federation Services (AD FS) could allow an authenticated attacker to elevate privileges locally. Successful exploitation of the vulnerability may allow an attacker to gain administrator privileges. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging users to patch it before July 28, 2026.

Tenable: Microsoft’s July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)

Tenable: CVE-2026-56155 | Active Directory Federation Services Elevation of Privilege Vulnerability

Tenable: CVE-2026-56155 is an EoP vulnerability affecting Active Directory Federation Services. It received a CVSSv3 score of 7.8 and is rated important. Microsoft notes that this flaw was exploited in the wild as a zero-day and is credited to researchers with the Microsoft Detection and Response Team (DART). Successful exploitation would allow an attacker to gain administrator privileges.

Rapid7: It’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is aware of existing in-the-wild exploitation of CVE-2026-56164, where successful exploitation allows an attacker to elevate privileges over a network, with no existing privileges required, and low attack complexity since “an attacker does not require significant prior knowledge of the system, and can achieve repeatable success”. This is as good an example as any that a relatively low CVSS v3 base score (5.3) may be an imperfect signal concealing something much spicier, and Microsoft acknowledges that possibility by assigning a severity rating of Important. Microsoft certainly intended to list CVE-2026-56164 in the new Notable CVEs section of the Security Update Guide instead of erroneously listing CVE-2026-56155 twice, and it’s likely that this will be corrected shortly.

Rapid7: Active Directory administrators should note the emergence today of CVE-2026-56155, an exploited-in-the-wild elevation of privilege vulnerability in Active Directory Federation Services which allows an authorized attacker to elevate privileges locally. Eight other vulnerabilities are also published today in Active Directory Federation Services, all ranked as Important on Microsoft’s proprietary severity ranking scale. The advisory doesn’t explicitly describe the location of the attacker, but it’s likely that an attacker would need an existing toehold on the target system to chain together with the elevation of privilege opportunity on offer here.

ZDI: -    CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability. This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

5. Information Disclosure - Windows Kernel (CVE-2026-50475) - Critical [619]

Description: Windows Kernel Information Disclosure Vulnerability

6. Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2026-58613) - Critical [618]

Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

7. Elevation of Privilege - Windows User Interface Core (CVE-2026-50454) - Critical [618]

Description: Windows User Interface Core Elevation of Privilege Vulnerability

8. Elevation of Privilege - Windows WalletService (CVE-2026-49176) - Critical [606]

Description: Windows WalletService Elevation of Privilege Vulnerability

High (312)

9. Remote Code Execution - Microsoft Message Queuing Queue Manager (CVE-2026-54992) - High [595]

Description: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

Qualys: CVE-2026-54992: Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Windows Message Queuing Queue Manager may allow an unauthenticated attacker to execute code locally.

10. Elevation of Privilege - Windows Narrator Braille (CVE-2026-58635) - High [594]

Description: Windows Narrator Braille Elevation of Privilege Vulnerability

11. Information Disclosure - Windows Win32k (CVE-2026-50416) - High [583]

Description: Win32k Information Disclosure Vulnerability

12. Elevation of Privilege - Azure Spring Apps (CVE-2026-50338) - High [580]

Description: Azure Spring Apps Elevation of Privilege Vulnerability

13. Remote Code Execution - Windows DHCP Server (CVE-2026-50518) - High [538]

Description: Windows DHCP Server Remote Code Execution Vulnerability

Qualys: CVE-2026-56159, CVE-2026-50370, CVE-2026-48564, & CVE-2026-50518: DHCP Server Service Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Windows DHCP Server may allow an authenticated attacker to execute code over a network.

ZDI: -    CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability. There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

14. Elevation of Privilege - Windows Kernel (CVE-2026-49795) - High [504]

Description: Windows Kernel Elevation of Privilege Vulnerability

15. Elevation of Privilege - Windows Kernel (CVE-2026-49798) - High [504]

Description: Windows Kernel Elevation of Privilege Vulnerability

16. Remote Code Execution - Windows Message Queuing Service (MSMQ) (CVE-2026-50447) - High [502]

Description: Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

ZDI: That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

17. Remote Code Execution - Windows Remote Desktop Protocol (CVE-2026-56190) - High [502]

Description: Remote Desktop Protocol Remote Code Execution Vulnerability

ZDI: -    CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability. This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly. . -    CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability. This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

18. Elevation of Privilege - Windows Kernel (CVE-2026-50423) - High [492]

Description: Windows Kernel Elevation of Privilege Vulnerability

19. Elevation of Privilege - Windows Kernel (CVE-2026-50436) - High [492]

Description: Windows Kernel Elevation of Privilege Vulnerability

20. Elevation of Privilege - Windows Win32k (CVE-2026-50688) - High [492]

Description: Windows Win32k Elevation of Privilege Vulnerability

21. Elevation of Privilege - Windows Win32k (CVE-2026-54114) - High [492]

Description: Windows Win32k Elevation of Privilege Vulnerability

22. Elevation of Privilege - Windows Win32k (CVE-2026-54986) - High [492]

Description: Windows Win32k Elevation of Privilege Vulnerability

23. Remote Code Execution - .NET Framework (CVE-2026-50646) - High [490]

Description: .NET Framework Remote Code Execution Vulnerability

24. Remote Code Execution - Windows Admin Center (WAC) (CVE-2026-56196) - High [490]

Description: Windows Admin Center (WAC) Remote Code Execution Vulnerability

ZDI: The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

25. Remote Code Execution - Windows Admin Center (WAC) (CVE-2026-56197) - High [490]

Description: Windows Admin Center (WAC) Remote Code Execution Vulnerability

26. Remote Code Execution - Windows FTP Service (CVE-2026-49172) - High [490]

Description: Windows FTP Service Remote Code Execution Vulnerability

ZDI: That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

27. Remote Code Execution - Windows GDI+ (CVE-2026-50380) - High [490]

Description: Windows GDI+ Remote Code Execution Vulnerability

Qualys: CVE-2026-49796 & CVE-2026-50380: Windows GDI+ Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Windows GDI+ may allow an unauthenticated attacker to execute code locally.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

ZDI: That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

28. Remote Code Execution - Windows Server Network driver (CVE-2026-56188) - High [490]

Description: Windows Server Network driver Remote Code Execution Vulnerability

Qualys: CVE-2026-56188: Windows Server Network driver Remote Code Execution Vulnerability A race condition flaw in the Windows Server Network driver may allow an unauthenticated attacker to execute code over a network.

ZDI: -    CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability. Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

29. Elevation of Privilege - Windows Win32k (CVE-2026-49805) - High [480]

Description: Win32k Elevation of Privilege Vulnerability

30. Remote Code Execution - Microsoft Exchange (CVE-2026-55005) - High [478]

Description: Microsoft Exchange Server Remote Code Execution Vulnerability

ZDI: The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

31. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-57087) - High [478]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Qualys: CVE-2026-56189, CVE-2026-57090, CVE-2026-57094, & CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Microsoft Windows Media Foundation may allow an unauthenticated attacker to execute code locally.

32. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-57090) - High [478]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Qualys: CVE-2026-56189, CVE-2026-57090, CVE-2026-57094, & CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Microsoft Windows Media Foundation may allow an unauthenticated attacker to execute code locally.

33. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-57094) - High [478]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Qualys: CVE-2026-56189, CVE-2026-57090, CVE-2026-57094, & CVE-2026-57087: Microsoft Windows Media Foundation Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Microsoft Windows Media Foundation may allow an unauthenticated attacker to execute code locally.

34. Remote Code Execution - Windows Active Directory Domain Services (CVE-2026-49178) - High [478]

Description: Windows Active Directory Domain Services Remote Code Execution Vulnerability

ZDI: The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

35. Remote Code Execution - Windows Remote Desktop Client (CVE-2026-50474) - High [478]

Description: Remote Desktop Client Remote Code Execution Vulnerability

Qualys: CVE-2026-50474: Windows Remote Desktop Client Elevation of Privilege Vulnerability A use-after-free flaw in the Remote Desktop Client may allow an unauthenticated attacker to elevate privileges over a network.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

ZDI: The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

36. Remote Code Execution - Windows Remote Desktop Client (CVE-2026-54990) - High [478]

Description: Remote Desktop Client Remote Code Execution Vulnerability

ZDI: That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

37. Remote Code Execution - Windows Remote Desktop Client (CVE-2026-58594) - High [478]

Description: Remote Desktop Client Remote Code Execution Vulnerability

ZDI: The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

38. Remote Code Execution - Windows Remote Desktop Services (CVE-2026-58626) - High [478]

Description: Windows Remote Desktop Services Remote Code Execution Vulnerability

39. Elevation of Privilege - Microsoft DWM Core Library (CVE-2026-50329) - High [475]

Description: Microsoft DWM Core Library Elevation of Privilege Vulnerability

40. Elevation of Privilege - Microsoft Windows VMSwitch (CVE-2026-57092) - High [475]

Description: Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

Qualys: CVE-2026-57092: Microsoft Windows VMSwitch Elevation of Privilege Vulnerability A use-after-free in Windows VMSwitch may allow an authenticated attacker to elevate privileges over a network.

ZDI: -    CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability. This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

41. Elevation of Privilege - Windows Audio Compression Manager (ACM) (CVE-2026-50351) - High [475]

Description: Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability

42. Elevation of Privilege - Windows Cloud Files Mini Filter Driver (CVE-2026-58536) - High [475]

Description: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

43. Elevation of Privilege - Windows Common Log File System Driver (CVE-2026-50667) - High [475]

Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability

44. Elevation of Privilege - Windows GDI (CVE-2026-50387) - High [475]

Description: Windows GDI Elevation of Privilege Vulnerability

45. Elevation of Privilege - Windows Media (CVE-2026-50433) - High [475]

Description: Windows Media Elevation of Privilege Vulnerability

46. Elevation of Privilege - Windows StateRepository API Server file (CVE-2026-49170) - High [475]

Description: Windows StateRepository API Server file Elevation of Privilege Vulnerability

47. Remote Code Execution - Windows DNS Server (CVE-2026-49169) - High [471]

Description: Windows DNS Server Remote Code Execution Vulnerability

48. Remote Code Execution - Windows Active Directory Domain Services (CVE-2026-49164) - High [466]

Description: Windows Active Directory Domain Services Remote Code Execution Vulnerability

Qualys: CVE-2026-49164: Windows Active Directory Domain Services Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Active Directory Domain Services may allow an unauthenticated attacker to execute code over a network.

49. Remote Code Execution - Windows DHCP Server (CVE-2026-50685) - High [466]

Description: Windows DHCP Server Remote Code Execution Vulnerability

50. Remote Code Execution - Windows Event Logging Service (CVE-2026-50502) - High [466]

Description: Windows Event Logging Service Remote Code Execution Vulnerability

51. Remote Code Execution - Windows OLE (CVE-2026-50686) - High [466]

Description: Windows OLE Remote Code Execution Vulnerability

52. Remote Code Execution - Windows SMB Server Network Transport Driver (srvnet.sys) (CVE-2026-57089) - High [466]

Description: Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability

53. Remote Code Execution - Windows Secure Socket Tunneling Protocol (SSTP) (CVE-2026-50694) - High [466]

Description: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

Qualys: CVE-2026-50694: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability A use-after-free flaw in Windows Secure Socket Tunneling Protocol may allow an unauthenticated attacker to execute code over a network.

54. Remote Code Execution - Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) (CVE-2026-55944) - High [464]

Description: Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Qualys: CVE-2026-55944: Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability Deserialization of untrusted data in Microsoft Dynamics NAV may allow an unauthenticated attacker to execute code over a network. An attacker could exploit the vulnerability by sending a specially crafted login request to an affected Dynamics NAV or Business Central server.

Tenable: CVE-2026-55944 | Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Tenable: CVE-2026-55944 is a RCE vulnerability in Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central. It received a CVSSv3 score of 9.8, is rated critical and assessed as “Exploitation More Likely.” Successful exploitation can be achieved by sending a crafted login request to an affected Dynamics NAV or Business Central server in order to trigger a deserialization of untrusted data vulnerability. Microsoft’s advisory cautions that no user-interaction is required, nor is authentication a requirement in order to successfully exploit this vulnerability.

ZDI: That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

55. Elevation of Privilege - Microsoft Exchange (CVE-2026-55009) - High [463]

Description: Microsoft Exchange Server Elevation of Privilege Vulnerability

56. Elevation of Privilege - Windows Network Connections Service (CVE-2026-50476) - High [463]

Description: Windows Network Connections Service Elevation of Privilege Vulnerability

57. Remote Code Execution - .NET (CVE-2026-50649) - High [461]

Description: .NET Remote Code Execution Vulnerability

58. Remote Code Execution - Windows TCP/IP (CVE-2026-54999) - High [459]

Description: Windows TCP/IP Remote Code Execution Vulnerability

Qualys: CVE-2026-54999: Windows TCP/IP Remote Code Execution Vulnerability  A race condition flaw in Windows TCP/IP may allow an unauthenticated attacker to execute code over an adjacent network.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

59. Remote Code Execution - Microsoft Windows Media Foundation (CVE-2026-50655) - High [454]

Description: Microsoft Windows Media Foundation Remote Code Execution Vulnerability

Qualys: CVE-2026-50327, CVE-2026-50655 & CVE-2026-58542: Windows Media Remote Code Execution Vulnerability A heap-based buffer overflow flaw in Windows Media may allow an unauthenticated attacker to execute code locally.

60. Remote Code Execution - Windows Data.dll (CVE-2026-50347) - High [454]

Description: Windows Data.dll Remote Code Execution Vulnerability

61. Remote Code Execution - Windows Message Queuing Service (MSMQ) (CVE-2026-50505) - High [454]

Description: Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

62. Remote Code Execution - Windows NTFS (CVE-2026-50313) - High [454]

Description: Windows NTFS Remote Code Execution Vulnerability

63. Remote Code Execution - Windows NTFS (CVE-2026-50388) - High [454]

Description: Windows NTFS Remote Code Execution Vulnerability

64. Remote Code Execution - Windows PowerShell (CVE-2026-40400) - High [454]

Description: Windows PowerShell Remote Code Execution Vulnerability

65. Remote Code Execution - Windows Print Spooler (CVE-2026-58608) - High [454]

Description: Windows Print Spooler Remote Code Execution Vulnerability

Qualys: CVE-2026-58608: Windows Print Spooler Remote Code Execution Vulnerability A race condition flaw in Windows Print Spooler Components may allow an authenticated attacker to execute code over a network.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

66. Remote Code Execution - Windows Reliable Multicast Transport Driver (RMCAST) (CVE-2026-54982) - High [454]

Description: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Qualys: CVE-2026-54982: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability An integer underflow flaw in the Reliable Multicast Transport Driver (RMCAST) may allow an unauthenticated attacker to execute code over an adjacent network.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

67. Remote Code Execution - Windows Reliable Multicast Transport Driver (RMCAST) (CVE-2026-54995) - High [454]

Description: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Qualys: CVE-2026-54995: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability  A use-after-free in the Reliable Multicast Transport Driver (RMCAST) may allow an unauthenticated attacker to execute code over a network.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

68. Remote Code Execution - Windows Terminal (CVE-2026-54124) - High [454]

Description: Windows Terminal Remote Code Execution Vulnerability

69. Information Disclosure - Windows Kernel (CVE-2026-50429) - High [452]

Description: Windows Kernel Information Disclosure Vulnerability

70. Information Disclosure - Windows Kernel (CVE-2026-50463) - High [452]

Description: Windows Kernel Information Disclosure Vulnerability

71. Remote Code Execution - Microsoft SQL Server (CVE-2026-54117) - High [452]

Description: Microsoft SQL Server Remote Code Execution Vulnerability

Qualys: CVE-2026-54117 & CVE-2026-54118: Microsoft SQL Server Remote Code Execution Vulnerability A deserialization of untrusted data flaw in SQL Server may allow an authenticated attacker to execute code over a network.

ZDI: Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

72. Remote Code Execution - Microsoft SQL Server (CVE-2026-54118) - High [452]

Description: Microsoft SQL Server Remote Code Execution Vulnerability

Qualys: CVE-2026-54117 & CVE-2026-54118: Microsoft SQL Server Remote Code Execution Vulnerability A deserialization of untrusted data flaw in SQL Server may allow an authenticated attacker to execute code over a network.

73. Elevation of Privilege - DirectX Graphics Kernel (CVE-2026-50375) - High [451]

Description: DirectX Graphics Kernel Elevation of Privilege Vulnerability

74. Elevation of Privilege - Windows NFS Server (CVE-2026-56194) - High [451]

Description: Windows NFS Server Elevation of Privilege Vulnerability

75. Elevation of Privilege - Windows Remote Access (CVE-2026-50666) - High [451]

Description: Windows Remote Access Elevation of Privilege Vulnerability

76. Elevation of Privilege - Windows Remote Access Service Infrastructure (CVE-2026-56647) - High [451]

Description: Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability

77. Elevation of Privilege - Windows Remote Desktop Client (CVE-2026-50330) - High [451]

Description: Windows Remote Desktop Client Elevation of Privilege Vulnerability