In a significant move to bolster cybersecurity, Microsoft has rolled out its July 2026 Patch Tuesday updates, addressing an impressive 570 new security vulnerabilities. This brings the total number of patches released this month to over 620, setting a new benchmark for the company. The previous record, established just last month, stood at 206 vulnerabilities. Notably, the cumulative count of vulnerabilities patched this year has already reached 1,380, surpassing the entire total of 2020, which was 1,250.
Windows Security Updates
A substantial portion of the vulnerabilities addressed—more than 400—are related to various versions of Windows, including Windows 10, Windows 11, and Windows Server. Microsoft has also extended the Windows 10 Extended Security Update (ESU) program until October 12, 2027, ensuring continued support for users.
Attacks on Active Directory
Among the vulnerabilities, one stands out due to its active exploitation: the Elevation of Privilege (EoP) vulnerability CVE-2026-56155 in Active Directory Federation Services (ADFS). This flaw allows attackers to gain administrator rights due to insufficient access controls, affecting Windows Server versions from 2012 to 2025, as well as older Windows 10 versions.
Critical Windows Vulnerabilities
This month’s updates include 24 critical Remote Code Execution (RCE) vulnerabilities and seven critical EoP vulnerabilities. A particularly concerning vulnerability, CVE-2026-57092, exists within Hyper-V’s VMSwitch, enabling attackers with low privileges to elevate their access on the host system. Additionally, the RCE vulnerability CVE-2026-56190 in Remote Desktop Protocol (RDP) can be exploited through specially crafted packets, allowing attackers to manipulate memory and execute injected code.
Another noteworthy RCE vulnerability, CVE-2026-50518, affects the DHCP server, while CVE-2026-56188 poses a threat within the Windows Server network driver, both of which can be exploited through crafted data packets.
Microsoft Office Security Updates
Microsoft has addressed 97 vulnerabilities in its Office products this month, nearly doubling the number from June. Among these, 17 are classified as critical RCE vulnerabilities. Notably, many of these vulnerabilities can be exploited via the preview pane, meaning users do not need to open a file for an attack to succeed. Additionally, the EoP vulnerability CVE-2026-56164 in SharePoint Server is already being exploited, allowing unauthorized access via the network.
Exchange Server Security Updates
In the realm of Exchange Server, Microsoft has patched four vulnerabilities, including a spoofing vulnerability, CVE-2026-55008, which could allow arbitrary JavaScript execution in the browser when a malicious email is opened in Outlook Web Access (OWA).
Microsoft Edge Security Updates
The latest update for Microsoft Edge, version 150.0.4078.65, released on July 9, addresses 27 vulnerabilities related to Chromium. Notably, these vulnerabilities are not included in the overall count of patched vulnerabilities for the month.
Security Updates for Gamers
For gaming enthusiasts, Microsoft has patched the RCE vulnerability CVE-2026-55010 in dedicated Minecraft Bedrock servers, requiring no further action from server operators. However, players of Age of Empires II: Definitive Edition should be vigilant, as RCE vulnerability CVE-2026-50663 can be exploited through malicious game scenario files.
Tip: Keeping your Windows system updated is crucial, but equally important is ensuring robust antivirus protection to maintain security and privacy. Explore our recommendations for the best antivirus software and VPN services to stay ahead of potential threats.
This article originally appeared on our sister publication PC-WELT and has been translated and localized from German.
<h3 class="articleauthorhead”>Author: Frank Ziemann, Contributor, PCWorld
Frank Ziemann has been a freelance author for PC-WELT since 2005, focusing on IT security, malware, antivirus, and internet technology.
<h3 class="recentstorieshead”>Recent stories by Frank Ziemann:
