This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Microsoft fixes more than 600 vulnerabilities in Patch Tuesday
As part of the July Patch Tuesday, Microsoft released fixes for more than 600 vulnerabilities, 2 of which are actively exploited. The most severe of them are described below; the remaining ones, including available fixes, are listed at [1][2].
Allows an unauthenticated remote attacker to escalate their privileges in Microsoft SharePoint Server due to missing authentication for a critical function. This vulnerability is already being actively exploited [3].
The vulnerability is present in products:
- Microsoft SharePoint Enterprise Server 2016; >=16.0.0, <16.0.5561.1001
- Microsoft SharePoint Server 2019; >=16.0.0, <16.0.10417.20175
- Microsoft SharePoint Server Subscription Edition; >=16.0.0, <16.0.19725.20434
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C
More information:
- CVE-2026-56164 at cve.org, NVD
- CWE-306: Missing Authentication for Critical Function at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Allows an authenticated local attacker to escalate their privileges due to improper access control in Active Directory Federation Services (AD FS) in Windows and Windows Server. This vulnerability is already being actively exploited [4].
The vulnerability is present in products:
- Windows 10 Version 1607; >=10.0.14393.0, <10.0.14393.9339
- Windows 10 Version 1809; >=10.0.17763.0, <10.0.17763.9020
- Windows Server 2012; >=6.2.9200.0, <6.2.9200.26226
- Windows Server 2012 (Server Core); >=6.2.9200.0, <6.2.9200.26226
- Windows Server 2012 R2; >=6.3.9600.0, <6.3.9600.23291
- Windows Server 2012 R2 (Server Core); >=6.3.9600.0, <6.3.9600.23291
- Windows Server 2016; >=10.0.14393.0, <10.0.14393.9339
- Windows Server 2016 (Server Core); >=10.0.14393.0, <10.0.14393.9339
- Windows Server 2019; >=10.0.17763.0, <10.0.17763.9020
- Windows Server 2019 (Server Core); >=10.0.17763.0, <10.0.17763.9020
- Windows Server 2022; >=10.0.20348.0, <10.0.20348.5386
- Windows Server 2025; >=10.0.26100.0, <10.0.26100.33158
- Windows Server 2025 (Server Core); >=10.0.26100.0, <10.0.26100.33158
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
More information:
- CVE-2026-56155 at cve.org, NVD
- CWE-1220: Insufficient Granularity of Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Allows an authenticated remote attacker with low privileges to escalate their privileges due to use after free in the Windows VMSwitch component [5].
The vulnerability is present in products:
- Windows 10 Version 1607; >=10.0.14393.0, <10.0.14393.9339
- Windows 10 Version 1809; >=10.0.17763.0, <10.0.17763.9020
- Windows 10 Version 21H2; >=10.0.19044.0, <10.0.19044.7548
- Windows 10 Version 22H2; >=10.0.19045.0, <10.0.19045.7548
- Windows 11 Version 24H2; >=10.0.26100.0, <10.0.26100.8875
- Windows 11 Version 25H2; >=10.0.26200.0, <10.0.26100.8875
- Windows 11 Version 26H1; >=10.0.28000.0, <10.0.28000.2525
- Windows Server 2012; >=6.2.9200.0, <6.2.9200.26226
- Windows Server 2012 (Server Core); >=6.2.9200.0, <6.2.9200.26226
- Windows Server 2012 R2; >=6.3.9600.0, <6.3.9600.23291
- Windows Server 2012 R2 (Server Core); >=6.3.9600.0, <6.3.9600.23291
- Windows Server 2016; >=10.0.14393.0, <10.0.14393.9339
- Windows Server 2016 (Server Core); >=10.0.14393.0, <10.0.14393.9339
- Windows Server 2019; >=10.0.17763.0, <10.0.17763.9020
- Windows Server 2019 (Server Core); >=10.0.17763.0, <10.0.17763.9020
- Windows Server 2022; >=10.0.20348.0, <10.0.20348.5386
- Windows Server 2025; >=10.0.26100.0, <10.0.26100.33158
- Windows Server 2025 (Server Core); >=10.0.26100.0, <10.0.26100.33158
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-57092 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Allows an unauthenticated remote attacker to bypass a security feature in Microsoft SharePoint Server due to weak authentication [6].
The vulnerability is present in products:
- Microsoft SharePoint Enterprise Server 2016; >=16.0.0, <16.0.5561.1001
- Microsoft SharePoint Server 2019; >=16.0.0, <16.0.10417.20175
- Microsoft SharePoint Server Subscription Edition; >=16.0.0, <16.0.19725.20434
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
More information:
- CVE-2026-55040 at cve.org, NVD
- CWE-1390: Weak Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Allows an unauthenticated remote attacker to carry out a spoofing attack in Microsoft Exchange Server after user interaction, due to improper neutralization of input during web page generation [7].
The vulnerability is present in products:
- Microsoft Exchange Server 2016 CU23; >=15.01.0.0, <15.01.2507.071
- Microsoft Exchange Server 2019 CU14; >=15.02.0.0, <15.02.1544.043
- Microsoft Exchange Server 2019 CU15; >=15.02.0.0, <15.02.1748.048
- Microsoft Exchange Server Subscription Edition RTM; >=15.02.0.0, <15.02.2562.045
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
More information:
- CVE-2026-55008 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 7. 2026.
Links
- [1] https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul
- [2] https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html
- [3] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
- [4] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
- [5] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092
- [6] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
- [7] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008
By CESNET, z.s.p.o. Henrieta Paločková on 15. 7. 2026.