patch tuesday

CVE-2026-50502 exposes the Windows Event Logging Service to remote code execution, with Microsoft assigning the flaw a CVSS 3.1 score of 8.0 High and shipping fixes in the July 14, 2026 security updates. Administrators should prioritize supported Windows clients and servers that have not reached...

Microsoft has patched CVE-2026-50493, an Important-rated use-after-free vulnerability in the DirectX Graphics Kernel that could let a locally authenticated attacker elevate privileges on affected Windows PCs and servers. The fix arrived with the July 14, 2026 security updates and should be...

CVE-2026-50495 is a Windows DNS Client tampering vulnerability that allows a locally authenticated attacker to alter protected behavior through improper access control. Microsoft fixed the flaw in its July 14, 2026 security updates for supported Windows 10, Windows 11, Windows Server 2019...

Microsoft’s July 14, 2026 security updates fix CVE-2026-50482, a high-severity heap-based buffer overflow in Windows NTFS that can lead to code execution. Despite Microsoft naming it a “Windows NTFS Remote Code Execution Vulnerability,” the published attack vector describes a local, authorized...

CVE-2026-50459 is a newly patched Windows Kernel elevation-of-privilege vulnerability that can let an unauthorized local attacker gain higher privileges after triggering a use-after-free memory error. Microsoft published the flaw on July 14, 2026, with a CVSS 3.1 base score of 7.0 and an...

CVE-2026-50470 exposes Windows Network Policy Server systems to unauthenticated information disclosure through SNMP, with Microsoft rating the vulnerability Important and assigning it a CVSS 3.1 base score of 7.5. Administrators running NPS or related SNMP components should install the July 14...

CVE-2026-50450 is a Windows local privilege-escalation vulnerability in the Wireless Wide Area Network Service, fixed by Microsoft in the July 14, 2026 security updates. An attacker who already has low-level access to an affected PC or server could exploit a race condition to cross a security...

CVE-2026-50429, a Windows Kernel information-disclosure vulnerability patched on July 14, 2026, can reportedly be exploited remotely without credentials or user interaction. Microsoft rates the flaw Important, while its CVSS 3.1 score of 8.2 places it firmly in the high-severity range and makes...

CVE-2026-50458 is a high-severity local privilege-escalation vulnerability in the Microsoft Brokering File System, fixed for Windows 11 versions 24H2 and 25H2 and Windows Server 2025 in Microsoft’s July 14, 2026 security updates. An authenticated attacker who already has low-privilege access...

Microsoft’s July 2026 security updates fix CVE-2026-50394, an Important-rated Windows Media information disclosure vulnerability affecting supported Windows 10, Windows 11, and Windows Server installations. Administrators should deploy the July 14 cumulative updates because exploitation requires...

Additional coverage of this story: KB5101650 Updates Windows 11 24H2/25H2, Withholds Some Dell PCs It highlights a date-based Windows Update pause of up to 35 days, less intrusive Widgets behavior, and Microsoft withholding the update from some Dell PCs; it also cites BleepingComputer’s count of...

CVE-2026-50444 exposes Windows Server Update Services to network-based privilege escalation, allowing an authenticated attacker with limited permissions to potentially gain extensive control of an affected server. Microsoft rated the vulnerability Critical, assigned it a CVSS 3.1 score of 8.8...

Microsoft has patched CVE-2026-50420, an Important-rated information disclosure vulnerability in Windows HTTP.sys that could let an unauthorized attacker expose sensitive memory data from a local system. The fix arrived on July 14, 2026, through cumulative updates for Windows 11 24H2, 25H2...

CVE-2026-50431 exposes sensitive information through the Windows Quality of Service Packet Scheduler, affecting supported Windows 10, Windows 11, and Windows Server releases until July 2026 security updates are installed. Microsoft rates the flaw Important, although its CVSS 3.1 base score is a...

CVE-2026-50399, a newly patched Windows Kernel elevation-of-privilege vulnerability, allows a locally authenticated attacker to gain higher privileges through an out-of-bounds memory read. Microsoft fixed the Important-rated flaw in its July 14, 2026 security updates for supported Windows 10...

CVE-2026-50456 is a Windows File Explorer information-disclosure vulnerability that can let a locally authenticated attacker expose sensitive data, and Microsoft has shipped the fix in its July 14, 2026 security updates. The flaw is rated Important by Microsoft with a CVSS 3.1 base score of 5.5...

CVE-2026-50442 exposes sensitive information through Windows File Explorer, but it requires an attacker who already has local access and low-level privileges on the affected machine. Microsoft addressed the flaw in its July 14, 2026 security updates across supported Windows 10, Windows 11, and...

CVE-2026-50457 is a high-severity Windows Runtime vulnerability that can let a locally authenticated attacker elevate privileges through a use-after-free memory error. Microsoft addressed the flaw in security updates released on July 14, 2026, covering Windows 11 24H2, 25H2 and 26H1, supported...

CVE-2026-50439 exposes Microsoft Message Queuing Queue Manager to unauthenticated remote code execution through a use-after-free memory flaw, affecting supported Windows client and server releases from Windows Server 2012 through Windows Server 2025 and Windows 11 version 26H1. Microsoft fixed...

CVE-2026-50465, an Important-rated Windows DNS Client tampering vulnerability, has been fixed for Windows 11 24H2 and 25H2 alongside Windows Server 2025 in Microsoft’s July 14, 2026 security updates. The flaw requires local access and an already authorized, low-privileged attacker, but...