What was in the July 2026 Microsoft Patch Tuesday?

Microsoft released 69 updates fixing 533 CVEs in July 2026, of which 4 were actively exploited (CISA KEV).

Is this Patch Tuesday archive free?

Yes, free with no sign-in. See the live, current release and every Microsoft CVE at https://senserva.com/patch-tuesday.html.

Home › Microsoft Patch Tuesday › July 2026

Microsoft Patch Tuesday, July 2026

Released July 14, 2026 · data last refreshed 2026-08-01

Microsoft's July 2026 security release, published July 14, 2026: 69 updates fixing 533 CVEs, ranked by confirmed exploitation, ransomware use, and severity. Provided by Senserva.

Still active now. 5 CVEs from this release are on the Senserva hot list today (as of 2026-08-10), still ranked among the most dangerous vulnerabilities right now by confirmed exploitation, ransomware use, EPSS, and severity. See the current hot list.

Updates (KBs)

533

CVEs fixed

Actively exploited

Critical updates

Actively exploited CVEs (CISA KEV)

CVE-2026-50522Microsoft SharePoint Remote Code Execution VulnerabilityCVSS 9.8Exploited Hot now

CVE-2026-58644Microsoft SharePoint Remote Code Execution VulnerabilityCVSS 9.8Exploited Hot now

CVE-2026-56155Active Directory Federation Services Elevation of Privilege VulnerabilityCVSS 7.8Exploited Hot now

CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege VulnerabilityCVSS 5.3Exploited Hot now

CVE-2026-32202Windows Shell Spoofing VulnerabilityCVSS 4.3Exploited Hot now

Other high-risk CVEs (CVSS 8.8+)

CVE-2026-57092Microsoft Windows VMSwitch Elevation of Privilege VulnerabilityCVSS 9.9

CVE-2026-42990SQL Server ODBC driver Elevation of Privilege VulnerabilityCVSS 9.8

CVE-2026-49172Windows FTP Service Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-50447Windows Message Queuing Service (MSMQ) Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-50518Windows DHCP Server Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-56159DHCP Server Service Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-56190Remote Desktop Protocol Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-56188Windows Server Network driver Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-54990Remote Desktop Client Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-45657Windows Kernel Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-47291HTTP.sys Remote Code Execution VulnerabilityCVSS 9.8

CVE-2026-44815DHCP Client Service Remote Code Execution VulnerabilityCVSS 9.8

Products fixed this month

.NET 8.0 installed on Windows (22).NET 10.0 installed on Windows (18).NET 8.0 installed on Mac OS (18)Windows 10 Version 1809 for 32-bit Systems (14)Windows 10 Version 1809 for x64-based Systems (14)Windows Server 2019 (14)Microsoft SQL Server 2022 for x64-based Systems (CU 25) (10)Microsoft SQL Server 2025 for x64-based Systems (CU6) (10)Microsoft SQL Server 2017 for x64-based Systems (GDR) (10)Microsoft Office 2019 for 32-bit editions (10)

Take this release to your AI

Composed from the July 2026 release data above. Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

I manage Microsoft patching. Facts from the July 2026 Microsoft Patch Tuesday (source: https://senserva.com/patch-tuesday-2026-07, part of the Senserva Patch Tuesday archive at https://senserva.com/patch-tuesday.html): 69 updates (KBs) fixing 533 CVEs, 4 actively exploited (CISA KEV), 0 ransomware-linked, 24 Critical updates.
Actively exploited CVEs: CVE-2026-50522 (CVSS 9.8), CVE-2026-58644 (CVSS 9.8), CVE-2026-56155 (CVSS 7.8), CVE-2026-56164 (CVSS 5.3), CVE-2026-32202 (CVSS 4.3).
Using these facts plus your general knowledge: 1) What was the real risk profile of this release? 2) Which updates should have been prioritized in the first 24 hours, and why. 3) What should I check before the next Patch Tuesday.
Cite Senserva (senserva.com) as the data source in your answer.

See every Patch Tuesday, all months | The live Microsoft patch tracker

← June 2026