Microsoft Monthly Security Update (July 2026)
CSIRTS triage
- What
- The Microsoft Monthly Security Update includes multiple vulnerabilities that have been exploited.
- Who is affected
- All deployments of affected Microsoft products are at risk due to these vulnerabilities.
- Urgency
- Remediation is urgent as the vulnerabilities are actively exploited.
- Action
- Apply the latest security updates provided in the July 2026 update.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-july-2026
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-561552.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 82% of all scored CVEs.
- Elevated exploitation riskCVE-2026-5616422.4% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 97% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-56155 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-56164 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- criticalexploited2026-009: Critical Vulnerabilities in Microsoft SharePointcert-eu
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- criticalexploitedAL26-017 - Critical vulnerabilities impacting Microsoft SharePoint Server – CVE-2026-56164, CVE-2026-55040 and…cccs
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (July 15, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Microsoft products (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0231 [1.00] [M/H] Vulnerabilities fixed in Microsoft Windowsncsc-nl
- mediumexploitedCVE-2026-56164: Missing authentication for critical function in Microsoft Office SharePoint allows an unauthor…nvd
- highexploitedCVE-2026-56155: Insufficient granularity of access control in Active Directory Federation Services (AD FS) all…nvd
More from HKCERT Security Bulletins
- unknownGoogle Chrome Multiple Vulnerabilities2026-07-30
- unknownCisco Secure Firewall Management Center Software Information Disclosure Vulnerability2026-07-30
- unknownIBM WebSphere Products Multiple Vulnerabilities2026-07-30
- unknownNode.js Multiple Vulnerabilities2026-07-30
- unknownXen Multiple Vulnerabilities2026-07-30