security updates

CVE-2026-50412 is a high-severity Windows NTFS vulnerability that allows a locally authenticated attacker to elevate privileges through a stack-based buffer overflow. Microsoft released the fix on July 14, 2026, as part of its monthly Windows security updates, covering supported Windows 10...

CVE-2026-50360 exposes Windows SMB Server to a high-severity privilege-escalation attack that can be launched across a network by an attacker who already has valid credentials. Microsoft fixed the flaw in its July 14, 2026 security updates, making prompt deployment particularly important for...

CVE-2026-50325 is a Windows Win32k elevation-of-privilege vulnerability that can let an authenticated local attacker gain higher permissions, potentially taking full control of an affected system. Microsoft disclosed the flaw on July 14, 2026, rated it High severity with a CVSS 3.1 score of 7.0...

CVE-2026-50342, a high-severity elevation-of-privilege flaw in the Windows MIDI Service Module, is fixed by Microsoft’s July 14, 2026 security updates for Windows 11 versions 24H2, 25H2, and 26H1. Administrators should prioritize the cumulative updates because successful exploitation requires...

CVE-2026-49180 affects the Windows Universal Plug and Play library, upnp.dll, and can allow a locally authenticated attacker to expose or improperly affect protected information through unsafe link handling. Microsoft disclosed the flaw on July 14, 2026, alongside its monthly security updates...

CVE-2026-58614 is a Windows Kernel security-feature bypass caused by an out-of-bounds read, and Microsoft has patched it across supported Windows 10, Windows 11, and Windows Server releases in the July 14, 2026 security updates. The flaw requires an authorized attacker to operate locally, but...

Microsoft published CVE-2026-56170, titled “ASP.NET Core Denial of Service Vulnerability,” at 2026-07-14 07:00 PDT. The supplied record does not yet identify affected versions, severity, attack prerequisites, exploitability, or a fix. Administrators should treat the publication as a prompt for...

Microsoft has patched CVE-2026-50678, a Microsoft Excel heap-based buffer overflow that can expose information and disrupt the application when a user interacts with malicious content. Released on July 14, 2026, the flaw affects Microsoft 365 Apps for enterprise, Excel 2016, Office 2019, Office...

CVE-2026-54118 exposes supported Microsoft SQL Server installations to remote code execution through unsafe deserialization, with Microsoft assigning the vulnerability a CVSS 3.1 score of 8.8. The important operational detail is that the attack can cross a network and is considered...

Microsoft has fixed CVE-2026-55012, a remote code execution vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender and several legacy antimalware products. The last affected engine is version 1.1.26050.11, while version 1.1.26060.3008 is the first release containing...

CVE-2026-55009 affects Microsoft Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM, allowing an authenticated attacker to elevate privileges through unsafe deserialization. Microsoft addressed the flaw in security updates released on July...

CVE-2026-54997 exposes sensitive memory through Windows SMB, and Microsoft has shipped the fix across supported Windows 10, Windows 11, and Windows Server releases in the July 14, 2026 security updates. Administrators should deploy the relevant cumulative update rather than attempting to...

CVE-2026-54112 is a newly patched Windows Win32k elevation-of-privilege vulnerability that can let an attacker with limited local access gain broader control of an affected PC or server. Microsoft released the fix on July 14, 2026, as part of its monthly security updates, covering supported...

Microsoft has patched CVE-2026-49164, a Critical remote code execution vulnerability in Windows Active Directory Domain Services, as part of the July 14, 2026 security updates. Because Active Directory domain controllers sit at the center of authentication, authorization, Group Policy, and...

Microsoft published CVE-2026-42990 on July 14, 2026, identifying an elevation-of-privilege vulnerability in the Microsoft ODBC Driver for SQL Server. The immediate job for administrators is to inventory every deployed copy of the driver—not merely patch SQL Server hosts—because ODBC is a client...

Microsoft has patched CVE-2026-47302, a denial-of-service vulnerability in .NET Framework, through the July 14, 2026 security updates. Windows administrators should treat the flaw as an availability risk for applications and services built on affected .NET Framework components and deploy the...

Microsoft has identified CVE-2026-58281 as a remote code execution vulnerability in Chromium-based Microsoft Edge, but the available advisory material does not disclose the affected versions, attack path, severity, exploitation status, technical root cause, release date, or the update that...

Google Chrome on Android versions earlier than 150.0.7871.47 are affected by CVE-2026-13868, a medium-severity flaw that the supplied National Vulnerability Database record describes as an inappropriate implementation in Chrome’s Network component. According to that record, a remote attacker who...

Microsoft has extended Windows 10’s consumer Extended Security Updates program for eligible enrolled PCs until October 12, 2027, giving New Zealand users and some small businesses another year of security patches after the operating system’s formal support deadline of October 14, 2025. The...

Microsoft extended free consumer security updates for Windows 10 through October 12, 2027, while Sony said new PlayStation game discs will stop in January 2028 and Microsoft’s low-cost Surface Go and Surface Laptop Go lines reportedly reached the end of production. The timing makes the week feel...