NCSC-2026-0231 [1.00] [M/H] Vulnerabilities fixed in Microsoft Windows
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Microsoft has fixed a very large number of vulnerabilities in Windows. An attacker can exploit the vulnerabilities to carry out attacks that can lead to categories of damage, as mentioned in the table below. The most severe vulnerabilities have been assigned characteristics CVE-2026-49172, CVE-2026-56190, CVE-2026-54990, CVE-2026-49798, CVE-2026-50380, CVE-2026-50447, CVE-2026-50518, CVE-2026-56159, CVE-2026-56188, and CVE-2026-57092 and are located in the FTP service, Remote Desktop (client and server), the Kernel, GDI+, Message Queuing Service, DHCP Server, Server Network Driver, and VMSwitch, respectively. Attackers with access to these services may be able to execute code or gain access to the vulnerable system without prior authentication. In addition to these severe vulnerabilities, more than 400 vulnerabilities have been fixed, all varying in severity from medium to high/critical. Due to the nature and scope of these updates, the NCSC advises to prioritize the deployment of these updates.
CSIRTS triage
- What
- Microsoft has fixed a large number of vulnerabilities in Windows that can be exploited by attackers.
- Who is affected
- Users of Microsoft Windows operating systems.
- Urgency
- Remediation is urgent due to active exploitation of these vulnerabilities.
- Action
- Users should apply the latest patches provided by Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Windows
Get an email when a new Windows advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-49172Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 49% of all scored CVEs.
- Exploitation confirmedCVE-2026-56190Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 62% of all scored CVEs.
- Exploitation confirmedCVE-2026-54990Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 43% of all scored CVEs.
- Exploitation confirmedCVE-2026-49798Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 81% of all scored CVEs.
- Exploitation confirmedCVE-2026-50380Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 46% of all scored CVEs.
- Exploitation confirmedCVE-2026-50447Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 56% of all scored CVEs.
- Exploitation confirmedCVE-2026-50518Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 95% of all scored CVEs.
- Exploitation confirmedCVE-2026-56159Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 59% of all scored CVEs.
- Exploitation confirmedCVE-2026-56188Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 57% of all scored CVEs.
- Exploitation confirmedCVE-2026-57092Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 65% of all scored CVEs.
- Exploitation confirmedCVE-2026-56169Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
- Exploitation confirmedCVE-2026-56185Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now.
Referenced CVEs
+365 more CVEs referenced in this advisory.
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- critical[NEW] [critical] Microsoft Windows products: Multiple vulnerabilitiescert-bund
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- unknownexploitedNCSC-2026-0237 [1.02] [H/H] Vulnerabilities Fixed in Microsoft Officencsc-nl
- unknownexploitedNCSC-2026-0237 [1.01] [H/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- high[NEW] [high] Microsoft Windows Terminal and 365 Copilot: Multiple Vulnerabilitiescert-bund
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0237 [1.00] [M/H] Vulnerabilities fixed in Microsoft Officencsc-nl
- mediumCVE-2026-58638: Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a se…nvd
- highCVE-2026-58637: Use after free in Windows Client-Side Caching (CSC) Service allows an authorized attacker to e…nvd
- highCVE-2026-58634: Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges l…nvd
Recent advisories for Microsoft Windows
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- critical[NEW] [critical] Microsoft Windows products: Multiple vulnerabilitiescert-bund · 2026-07-27
- high[UPDATE] [high] Microsoft Windows: Multiple vulnerabilitiescert-bund · 2026-07-23
- medium[NEW] [medium] Microsoft Windows: Multiple Vulnerabilitiescert-bund · 2026-07-20
- medium[NEW] [medium] Microsoft Windows Terminal: Vulnerability allows code executioncert-bund · 2026-07-17
- medium[NEW] [medium] Microsoft Windows Admin Center: Vulnerability allows Cross-Site Scriptingcert-bund · 2026-07-17
- unknownMultiple vulnerabilities in Microsoft Windows (July 17, 2026)cert-fr-avis · 2026-07-17
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30