patch tuesday

CVE-2026-34328 exposes Windows Event Log service memory addresses through the Windows Audio Service, giving a locally authenticated attacker information that could help defeat memory-protection defenses or support a larger exploit chain. Microsoft fixed the vulnerability in its July 14, 2026...

Microsoft has fixed CVE-2026-33842, an Important-rated Windows File Explorer information-disclosure vulnerability, in the July 14, 2026 security updates. The flaw can allow a locally authenticated attacker to expose sensitive information without requiring another user to interact with a file or...

Microsoft has patched CVE-2026-58640, an Important-rated Windows NTFS remote code execution vulnerability caused by a heap-based buffer overflow. The flaw affects supported and extended-support releases spanning Windows 10, Windows 11, Windows Server 2012, and Windows Server 2025, making the...

Microsoft’s July 14, 2026 security updates fix CVE-2026-58635, a command-injection vulnerability in Windows Narrator’s braille support that could let a locally authenticated attacker elevate privileges. The flaw affects supported Windows 10, Windows 11, Windows Server 2019, Windows Server 2022...

Microsoft has fixed CVE-2026-58610, a Windows Media Foundation remote code execution vulnerability caused by a heap-based buffer overflow, in the July 14, 2026 security updates. The flaw carries a CVSS 3.1 score of 7.8 and affects supported Windows 10, Windows 11, and Windows Server releases...

Microsoft has patched CVE-2026-58609, a high-severity Windows Graphics Component vulnerability that could let an attacker execute code after convincing a user to interact with malicious content. The fix arrived in the July 14, 2026 cumulative security updates for supported Windows client and...

CVE-2026-58602 exposes supported Windows 11 and Windows Server 2025 systems to a local privilege-escalation attack, with Microsoft shipping a fix in its July 14, 2026 security updates. The flaw carries a CVSS 3.1 score of 7.8, rated Important by Microsoft and High under the CVSS scale, because...

CVE-2026-54988 can expose a limited amount of memory from Microsoft Excel and then force the affected application or service to become unavailable. Microsoft rates the flaw 6.1, Medium, with the CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H, making the availability impact considerably more...

Microsoft has patched CVE-2026-55002, an Important-rated SQL Server elevation-of-privilege vulnerability that can let an authenticated local attacker gain greater control over a database host. The flaw affects supported servicing branches from SQL Server 2016 through SQL Server 2025, making the...

CVE-2026-55006 is a high-severity privilege-escalation vulnerability in Microsoft Exchange Server that can let an authenticated, low-privileged attacker take full control of a vulnerable server. Microsoft released fixes on July 14, 2026, covering Exchange Server 2016 CU23, Exchange Server 2019...

Microsoft has patched CVE-2026-54122, an 8.4-rated Windows GDI+ remote code execution vulnerability affecting supported and Extended Security Update editions of Windows 10, Windows 11, and Windows Server. The flaw is a heap-based buffer overflow that can give an unauthorized attacker full...

Microsoft has patched CVE-2026-54996, an elevation-of-privilege vulnerability in the Windows USB Print Driver, through the cumulative security updates released on July 14, 2026. Administrators should treat the flaw as a local privilege-escalation risk and deploy the appropriate Windows update...

Microsoft’s July 14, 2026 security release fixes CVE-2026-54982, a remote code execution vulnerability in the Windows Reliable Multicast Transport Driver, or RMCAST. Systems that receive the corresponding Windows cumulative update should be treated as patch priorities, particularly where...

CVE-2026-55004, an Important-rated elevation-of-privilege flaw in Windows Print Configuration, has been patched in Microsoft’s July 14, 2026 security updates. Windows users and administrators should treat it as a local privilege-escalation risk: an attacker who already has access to a vulnerable...

CVE-2026-55001 is an Important-rated Active Directory Domain Services elevation-of-privilege vulnerability fixed in Microsoft’s July 14, 2026 security updates. Administrators should prioritize domain controllers running Windows Server 2016, Windows Server 2019, Windows Server 2022, or Windows...

Microsoft has patched CVE-2026-54107, an elevation-of-privilege vulnerability in the Windows Win32k subsystem that could allow an authenticated attacker to gain higher permissions on an affected PC. The flaw carries a CVSS 3.1 base score of 8.8, making July’s cumulative Windows updates the...

Microsoft has patched CVE-2026-54132, a Windows Kernel heap-based buffer overflow that could let an attacker with physical access elevate privileges on affected Windows 10, Windows 11, and Windows Server systems. The vulnerability carries Microsoft’s “Important” rating and a CVSS 3.1 base score...

Microsoft published CVE-2026-54991 on July 14, 2026, identifying an elevation-of-privilege flaw in the Windows USB Print Driver and distributing the fix through this month’s Windows security updates. Systems that use locally attached USB printers should receive particular attention, but the...

Additional coverage of this story: July 2026 Patch Tuesday: Fix 2 Exploited AD FS and SharePoint Zero-Days It notes that Zero Day Initiative and SecurityWeek count 622 flaws under broader methodologies, and contrasts July’s tally with June’s roughly 200 vulnerabilities...

Microsoft’s July 14, 2026 security release fixes CVE-2026-54111, an Important-rated elevation-of-privilege vulnerability in the Universal Print Management Service. Windows administrators should deploy the applicable cumulative security updates, particularly on shared workstations...