Microsoft shipped 627 fixes this month, 62 rated critical. 2 are already under active attack and should be patched today; 1 publicly disclosed zero-day should be closed this week. Everything else fits the normal monthly cycle.
Confirmed in CISA KEV and flagged as exploited by Microsoft. Treat as active incidents, not routine patching.
in CISA KEV (added 2026-07-14); MSRC Exploited. Owner routes to the Identity / AD team.
in CISA KEV (added 2026-07-14); MSRC Exploited; network / no-auth / no-interaction; ⬆ HCL: flagged dangerous. Owner routes to the SharePoint owners team.
Publicly disclosed but not yet observed in the wild — a zero-day on a countdown. Schedule ahead of the normal cycle.
publicly disclosed (zero-day); ⬆ HCL: flagged dangerous. Owner routes to the Endpoints / Windows client team.
This month's priority items grouped by the team that patches them.
Ordered by a composite priority that weights active exploitation and disclosure above raw CVSS. Showing the sharp end; the full ranked set of 1,164 CVEs is in the index.
| CVE | Status | CVSS | Impact | Owner |
|---|---|---|---|---|
| CVE-2026-56155 | Exploited | 7.8 | Elevation of Privilege | Identity / AD |
| CVE-2026-56164 | Exploited | 5.3 | Elevation of Privilege | SharePoint owners |
| CVE-2026-50661 | Zero-day | 6.1 | Security Feature Bypass | Endpoints / Windows client |
| CVE-2026-45499 | Critical | 9.9 | Elevation of Privilege | Cloud / M365 apps |
| CVE-2026-57100 | Critical | 9.9 | Elevation of Privilege | Other / general Windows |
| CVE-2026-57092 | Critical | 9.9 | Elevation of Privilege | Virtualization / Hyper-V |
| CVE-2026-38968 | Critical | 9.8 | — | Other / general Windows |
| CVE-2026-50522 | Critical | 9.8 | Remote Code Execution | SharePoint owners |
| CVE-2026-58644 | Critical | 9.8 | Remote Code Execution | SharePoint owners |
| CVE-2026-50518 | Critical | 9.8 | Remote Code Execution | Network / infra servers |
| CVE-2026-55010 | Critical | 9.8 | Remote Code Execution | Other / general Windows |
| CVE-2026-55944 | Critical | 9.8 | Remote Code Execution | Cloud / M365 apps |
| CVE-2026-56159 | Critical | 9.8 | Remote Code Execution | Network / infra servers |
| CVE-2026-56188 | Critical | 9.8 | Remote Code Execution | Network / infra servers |
| CVE-2026-48561 | Critical | 9.6 | Remote Code Execution | Cloud / M365 apps |
Plus further Critical-severity items this cycle — browse and filter them all in the index.
The items on the sharp end, with attack profile and cross-source context.
“Um so our zero day is in the active directory federated services uh module.”From HCL webinar
“Uh, as well as share as well as SharePoint and, uh, the Microsoft message queuing system.”From HCL webinar
“You want to talk about your evil maid, Jason, and BitLocker?”From automox-podcast
Authoritative counts and exploitation flags come from Microsoft's MSRC Security Update Guide and CISA's Known Exploited Vulnerabilities catalog. Independent reporting and analyst commentary corroborate and add context but do not set priority.
Ranking is a composite score that weights active exploitation and public disclosure above raw CVSS, adjusted for network-reachable / no-authentication attack profiles and field-analyst judgment — which is why a low-CVSS vulnerability under active attack can outrank an unexploited 9.8.