[NEW] [medium] Microsoft Windows: Multiple Vulnerabilities

mediumCVE-2026-58598 CVE-2026-56171

An attacker can exploit multiple vulnerabilities in Microsoft Windows Backup Service, Microsoft Windows Admin Center, and Microsoft Windows Remote Desktop Web Client to disclose information and gain elevated privileges.

CSIRTS triage

vendor: Microsoft product: Windows Information disclosure Privilege escalation

What: An attacker can exploit multiple vulnerabilities in Microsoft Windows Backup Service, Microsoft Windows Admin Center, and Microsoft Windows Remote Desktop Web Client to disclose information and gain elevated privileges.
Who is affected: Users of Microsoft Windows services are affected.
Urgency: Remediation is medium due to the potential for information disclosure and privilege escalation.
Action: Apply the latest updates for Microsoft Windows.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Windows

Get an email when a new Windows advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-07-20
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2401

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-585980.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all scored CVEs.
Low exploitation riskCVE-2026-561710.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-58598	coverage & exploitation status	NVD · CVE.org
CVE-2026-56171	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Microsoft Windows

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

critical[NEW] [critical] Microsoft Windows products: Multiple vulnerabilitiescert-bund · 2026-07-27
high[UPDATE] [high] Microsoft Windows: Multiple vulnerabilitiescert-bund · 2026-07-23
medium[NEW] [medium] Microsoft Windows Terminal: Vulnerability allows code executioncert-bund · 2026-07-17
medium[NEW] [medium] Microsoft Windows Admin Center: Vulnerability allows Cross-Site Scriptingcert-bund · 2026-07-17
unknownMultiple vulnerabilities in Microsoft Windows (July 17, 2026)cert-fr-avis · 2026-07-17
high[NEW] [high] Microsoft Windows Terminal and 365 Copilot: Multiple Vulnerabilitiescert-bund · 2026-07-15