patch tuesday

Microsoft’s July 14, 2026 security updates fix CVE-2026-58537, an elevation-of-privilege flaw in the Microsoft NAT Helper Components library, ipnathlp.dll. The immediate action for Windows administrators is to deploy the July cumulative updates: the vulnerability affects supported Windows 11...

Microsoft’s July 14 security updates fix CVE-2026-58532, a Windows Kernel elevation-of-privilege vulnerability that can allow an authenticated local attacker to gain full control of a vulnerable PC or server. The flaw is rated Important with a CVSS 3.1 score of 7.8, and organizations should...

Microsoft’s July 14, 2026 security updates patch CVE-2026-58531, a Windows SMB elevation-of-privilege flaw that could allow an authenticated attacker to gain higher permissions through the network-facing file-sharing stack. The vulnerability is rated Important with a CVSS 3.1 score of 7.5, and...

Microsoft’s July 14, 2026 security updates fix CVE-2026-58540, a Windows Installer elevation-of-privilege flaw that can let a locally authenticated attacker gain higher permissions on an affected PC or server. The issue is rated Important with a CVSS 3.1 score of 7.8, and it reaches a notably...

Microsoft’s July 14, 2026 security updates fix CVE-2026-58546, a Windows Remote Desktop Client information-disclosure vulnerability that could let an unauthenticated attacker obtain data from a targeted machine over a network. The issue affects the client side of Remote Desktop rather than a...

Microsoft’s July 14, 2026 security updates fix CVE-2026-58530, a Windows Resilient File System (ReFS) heap-based buffer overflow that can allow local code execution after a user interacts with attacker-controlled content. The flaw carries a CVSS 3.1 score of 7.8 and affects a broad span of...

Microsoft’s July 14 security updates fix CVE-2026-57096, a high-severity elevation-of-privilege flaw in Windows Routing and Remote Access Service (RRAS) that could let an authenticated local attacker gain higher permissions on an affected machine. The issue is a heap-based buffer overflow...

Microsoft’s July 14, 2026 security updates fix CVE-2026-57089, a high-severity remote code execution vulnerability in the Windows SMB Server Network Transport Driver, srvnet.sys. The flaw is a use-after-free memory-safety issue that Microsoft says could allow an unauthorized attacker to execute...

Microsoft’s July 14, 2026 security updates address CVE-2026-57090, a critical Windows Media Foundation remote code execution vulnerability that can be triggered over a network if an attacker can persuade a user to interact with malicious media content. Windows 11 24H2 and 25H2 systems receive...

Microsoft’s July 14, 2026 security updates address CVE-2026-57095, a Win32k elevation-of-privilege vulnerability that could allow a local attacker to gain higher rights on an affected Windows system. The flaw is rated Important with a CVSS 3.1 score of 6.2, and Microsoft’s Security Update Guide...

Microsoft’s July 14, 2026 security updates fix CVE-2026-57084, a Windows File Explorer information-disclosure flaw that could allow an attacker to obtain sensitive information from a local Windows system after persuading a user to interact with malicious content. The vulnerability is rated...

Microsoft’s July 14, 2026 security updates fix CVE-2026-57083, an information-disclosure flaw in the Windows Media Photo Codec, also identified in Microsoft’s advisories as part of the Windows Codecs Library. The practical action for Windows users and administrators is straightforward: deploy...

Microsoft’s July 14 security updates address CVE-2026-56649, a remote code execution vulnerability in Windows Network File System components that affects a wide range of supported Windows client and server releases. Administrators should prioritize deployment of the July cumulative updates to...

Microsoft’s July 14, 2026 security updates fix CVE-2026-56647, a high-severity elevation-of-privilege flaw in Windows Remote Access Service Infrastructure that can be reached over a network by an attacker who already holds valid low-level credentials. The issue is not a pre-authentication...

Microsoft’s July 14 security release fixes CVE-2026-56194, a high-severity elevation-of-privilege flaw in Windows NFS Server that can let an authorized attacker elevate privileges over a network. The issue carries a CVSS 3.1 score of 8.8 and affects a long range of Windows client and server...

Microsoft has disclosed CVE-2026-54124, a Windows Terminal remote code execution vulnerability fixed in the July 14, 2026 security updates. The immediate action for Windows users and administrators is straightforward: install the July cumulative update for the operating system and ensure Windows...

Microsoft’s July 14, 2026 security updates fix CVE-2026-56644, an Important-rated elevation-of-privilege vulnerability in the DirectX Graphics Kernel. The flaw is a use-after-free memory-safety issue in the Windows kernel, meaning an attacker who already has authorized local access could...

Microsoft’s July 14, 2026 security updates fix CVE-2026-56643, an Important, high-severity elevation-of-privilege flaw in the DirectX Graphics Kernel that could allow a locally authenticated attacker to gain control at the Windows kernel level. The fix is included in this month’s cumulative...

Microsoft’s July 14, 2026 security updates fix CVE-2026-56189, a Windows Media Foundation memory-corruption flaw that can let an attacker execute code after a user interacts with malicious media content. Despite Microsoft’s “Remote Code Execution Vulnerability” product title, the technical...

Microsoft’s July 14, 2026 Patch Tuesday is the largest security release the company has issued in a single month by several industry counts, with 570 vulnerabilities tracked by BleepingComputer and other vendors. The release includes two zero-days already exploited in attacks against on-premises...