Patch Tuesday, July 2026

Microsoft's monthly security release, Tuesday, July 14, 2026. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

37 CVEs · 5 critical · 3 exploited · 2 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← June 2026 August 2026 →Open in the dashboard

Microsoft

37 CVEs · 5 critical · 3 exploited · 2 with public exploit code

9.8CriticalJul 16, 2026Microsoft SharePoint DeserializationCVE-2026-58644Microsoft SharePoint is affected. An attacker gains remote code execution. Update to SharePoint 2022 CU December 2022 or later and ensure deserialization protections are enabled.Exploited16% likelyExploit codeNucleiDetection
5.3MediumJul 14, 2026Microsoft SharePoint Server Auth bypass / access controlCVE-2026-56164Microsoft SharePoint Server is affected. An attacker gains ability to perform arbitrary file operations on the server. Patch SharePoint Server with the latest security updates and restrict access to sensitive areas.Exploited1% likelyExploit code
7.8HighJul 14, 2026Microsoft Active Directory Federation Services Auth bypass / access controlCVE-2026-56155Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.Exploited
9.3CriticalJul 16, 2026Microsoft o365-moodle Crypto / certificateCVE-2026-54733The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in ver
9.3CriticalJul 16, 2026Microsoft kiota Path traversal / file handlingCVE-2026-59864Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inc1.3% likely
9.3CriticalJul 16, 2026Microsoft kiota Code / command injectionCVE-2026-59865Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota in4.4% likely
9.3CriticalJul 16, 2026Microsoft kiota Path traversal / file handlingCVE-2026-59866Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generat1.4% likely
8.8HighJul 14, 2026Microsoft .netCVE-2026-47300Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
8.8HighJul 14, 2026Microsoft .net Auth bypass / access controlCVE-2026-47303Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
8.7HighJul 16, 2026Microsoft prompty Code / command injectionCVE-2026-53597Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an attacker-controlled .prompty file with ---js frontmatter to execute arbitrary JavaScript during prompt loading. This issue is fixed in version 2.0.0-beta.3.
8.6HighJul 16, 2026Microsoft simplechat Auth bypass / access controlCVE-2026-57206SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/single_app/plugin_validation_endpoint.py, including `POST /api/admin/plugins/test-instantiation`, `GET /api/admin/plugins/health-check/<plugin_name>`, `POST /api/admin/plugins/repair/<plugin_name>`, and `POST /api/plugins/validate`, relied on @swagger_route(security=get_auth_security()) documentation without
8.3HighJul 12, 2026Microsoft edge chromium Memory corruptionCVE-2026-58596Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
8.2HighJul 14, 2026Microsoft .net Auth bypass / access controlCVE-2026-50528Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
8.1HighJul 14, 2026Microsoft .net framework Auth bypass / access controlCVE-2026-47304Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
7.8HighJul 14, 2026Microsoft Windows 10 Version 1809 Privilege escalationCVE-2026-50343Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
7.8HighJul 14, 2026Microsoft .net framework DeserializationCVE-2026-50646Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.4% likely
7.8HighJul 14, 2026Microsoft .net framework DeserializationCVE-2026-50649Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.4% likely
7.8HighJul 14, 2026Microsoft .net framework Code / command injectionCVE-2026-50650Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.
7.5HighJul 14, 2026Microsoft .net framework Denial of serviceCVE-2026-47302Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 14, 2026Microsoft .netCVE-2026-50524Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 14, 2026Microsoft .net framework Denial of serviceCVE-2026-50525Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 14, 2026Microsoft .net framework Memory corruptionCVE-2026-50527Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 14, 2026Microsoft .net framework Denial of serviceCVE-2026-50648Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 14, 2026Microsoft .net Denial of serviceCVE-2026-50651Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 16, 2026Microsoft prompty Path traversal / file handlingCVE-2026-53598Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2.1.3% likely
7.5HighJul 14, 2026Microsoft .net Denial of serviceCVE-2026-56170Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 14, 2026Microsoft .net Memory corruptionCVE-2026-57108Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.1.2% likely
7.5HighJul 16, 2026Microsoft kiota Code / command injectionCVE-2026-59862Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum.values[].description flow through KiotaBuilder.SetEnumOptions into Documentation.DescriptionTemplate and PythonConventionService.RemoveInvalidDescriptionCharacters without newline sanitization, allowing generated inline comments to split and execute attacker-controlled Python code at module scope when generated modules were impo1.4% likely
7.1HighJul 16, 2026Microsoft kiota Path traversal / file handlingCVE-2026-59867Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.4% likely
7.0HighJul 14, 2026Microsoft .net Path traversal / file handlingCVE-2026-50526Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
7.0HighJul 16, 2026Microsoft kiota Path traversal / file handlingCVE-2026-59863Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or per-plugin outputPath values during kiota client generate and kiota plugin generate, allowing a malicious repository or pull request to use absolute paths, rooted POSIX / paths, UNC \\ or // paths, Windows drive X:\ paths, or .. traversal segments to write generated client files outside the workspace root on a de1.4% likely
6.5MediumJul 14, 2026Microsoft .net frameworkCVE-2026-50659Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
6.5MediumJul 16, 2026Microsoft UFO Denial of serviceCVE-2026-55440Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handler.py called get_or_create_session in ufo/server/services/session_manager.py without owner_client_id, allowing an authenticated client to create an unowned attacker-chosen session_id such as constellation_task_id = f"{task_name}@{task_id}" and deny the legitimate owner or exhaust memory with phantom sessions. This issue is fixed in version1.3% likely
5.5MediumJul 14, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-57083Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
5.5MediumJul 14, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-57084Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.
4.3MediumJul 16, 2026Microsoft UFO Auth bypass / access controlCVE-2026-54568Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICE_INFO_REQUEST with another device's target_id and receive that device's server-side system_info through ufo/server/ws/handler.py, because handle_device_info_request and get_device_info did not enforce the constellation-only role or object-level authorization boundary. This issue is fixed in version 3.0.6.
4.3MediumJul 16, 2026Microsoft simplechat Information disclosureCVE-2026-57205SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/info/<user_id> and GET /api/user/profile-image/<user_id> endpoints in application/single_app/route_backend_users.py accepted a caller-supplied user_id and read the matching Cosmos DB user-settings document without object-level authorization, allowing a low-privilege authenticated user to retrieve another user's email address

Adobe

1 CVE · 1 critical · 1 exploited · 0 with public exploit code

9.3CriticalJul 14, 2026Adobe Commerce Path traversal / file handlingCVE-2026-48356Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.Exploited1% likely

SAP

No tracked SAP CVEs in this window.

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.