CVE-2026-54128

Rapid7 · Jul 14, 2026

Microsoft is publishing 622 vulnerabilities on July 2026 Patch Tuesday, including a record-breaking 416 Windows vulnerabilities. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today, both of which are listed on CISA KEV, as well as public disclosure for one other. As usual, browser vulns are not included in the Patch Tuesday count above. Rapid7 noted last month that Microsoft no longer enumerates Chromium CVEs in the Security Update Guide. However, Microsoft has now taken the pursuit of minimalism much further, since today’s Security Update Guide no longer lists out even Microsoft vulnerabilities! Instead, we now receive a summary table of vulnerability counts by product family, as well as a new slimline “Notable CVEs” section. All of this only serves to illustrate the recent industry-wide trend of exploding vulnerability report counts, with an associated uptick in the publication of remediations as a trailing indicator.SharePoint: critical auth bypass by Rapid7Today sees the publication of CVE-2026-55040, a critical authentication bypass in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, and published today in coordination with Microsoft, this vulnerability is the first in a pair of exploits which, when chained together, can lead to unauthenticated remote code execution against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. As the full Rapid7 blog post sets out, the second vulnerability in the full RCE chain remains embargoed for now, with Microsoft expected to publish patches for that second vulnerability as part of Patch Tuesday August 2026. Microsoft noted: “We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”SharePoint: zero-day EoPIt’s a rare Patch Tuesday which doesn’t include multiple SharePoint fixes, and today is no exception. Microsoft is...

Tenable Blog · Jul 14, 2026

56Critical510Important3Moderate0LowMicrosoft addresses 569 CVEs in the largest Patch Tuesday release yet. This month’s release includes three zero-days, two of which were exploited in the wild.Microsoft patched 569 CVEs in its July 2026 Patch Tuesday release, with 56 rated critical, 510 rated as important, and 3 rated as moderate. This marks the largest Patch Tuesday release ever, crushing the previous record of 198 CVEs in June. Last week, Microsoft announced that its multi-model agentic scanning harness (MDASH) is being used to identify vulnerabilities faster and noted that “customers will see a higher volume of security updates included in each security release.”This month’s update includes patches for:.NET.NET Core.NET FrameworkASP.NET CoreActive Directory Certificate Services (AD CS)Active Directory Domain ServicesActive Directory Federation Services (AD FS)Azure Active DirectoryAzure CycleCloudAzure Monitor AgentAzure Spring AppsCode Integrity DLL (ci.dll)Composite Image File System DriverContent Delivery ManagerDesktop Window ManagerExtensible Storage Engine (ESENT)GitHub Copilot and Visual StudioGitHub Copilot and Visual Studio CodeGithub CopilotHTTP/2Microsoft 365 Copilot for iOSMicrosoft Bing App for IOSMicrosoft CopilotMicrosoft DefenderMicrosoft Defender for EndpointMicrosoft Dynamics NAVMicrosoft Edge for AndroidMicrosoft Exchange ServerMicrosoft Fabric Data WarehouseMicrosoft Graphics ComponentMicrosoft Input Method Editor (IME)Microsoft Install ServiceMicrosoft NAT Helper Components (ipnathlp.dll)Microsoft OfficeMicrosoft Office ExcelMicrosoft Office OneNoteMicrosoft Office PowerPointMicrosoft Office SharePointMicrosoft Office WordMicrosoft Printer DriversMicrosoft SurfaceMicrosoft WindowsMicrosoft Windows App StoreMicrosoft Windows Codecs LibraryMicrosoft Windows Media FoundationMicrosoft Windows Search ComponentMicrosoft Windows SpeechMicrosoft XMLMicrosoft XML Core ServicesMinecraft Bedrock Dedicated ServerOutlook CopilotPower BIQuality Windows...