Patch Tuesday July 2026: what's exploited and what to install first
Microsoft released fixes for 571 vulnerabilities on Jul 14, 2026. 3 are already being exploited by attackers, so install those fixes first. 1 was publicly disclosed before the fix came out. 57 are rated Critical.
Install these first: already exploited
- Active Directory Federation Services (AD FS)ExploitedImportantCVSS 7.8Active Directory Federation Services Elevation of Privilege Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Microsoft Office SharePointExploitedModerateCVSS 5.3Microsoft SharePoint Server Elevation of Privilege Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Microsoft Office SharePointExploitedCriticalCVSS 9.8Microsoft SharePoint Remote Code Execution Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
Publicly disclosed before the fix
Details were public before Microsoft's update, so attacks often follow quickly.
Critical fixes
- CVSS 9.9 Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
- CVSS 9.8 Windows DHCP Server Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft SharePoint Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft SQL Server Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft SQL Server Remote Code Execution Vulnerability
- CVSS 9.8 Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
- CVSS 9.8 DHCP Server Service Remote Code Execution Vulnerability
- CVSS 9.8 Windows Server Network driver Remote Code Execution Vulnerability
- CVSS 9.8 Microsoft SharePoint Remote Code Execution Vulnerability
- CVSS 9.6 Windows GDI+ Remote Code Execution Vulnerability
- CVSS 9.6 Microsoft Exchange Server Spoofing Vulnerability
How to install this month's updates
- Windows PCs: Settings → Windows Update → Check for updates, install, and restart. Restarting is what actually applies the fix.
- Managed fleets: approve this month's updates in Intune, Windows Update for Business or WSUS, and push the exploited fixes first instead of waiting for your normal ring schedule.
- Microsoft 365 Apps / Office: usually updates itself; in any Office app, File → Account → Update Options → Update Now to make sure.
- Servers: Exchange, SharePoint and SQL Server need their own update packages; they don't come through Windows Update alone.
- Check it worked: confirm the build number afterwards (run
winver) or check with our version checker.
By type
| Type | Fixes |
|---|---|
| Elevation of Privilege | 247 |
| Remote Code Execution | 142 |
| Information Disclosure | 101 |
| Denial of Service | 35 |
| Security Feature Bypass | 17 |
| Spoofing | 16 |
| Tampering | 8 |
Most-patched products
| Product | Fixes |
|---|---|
| Windows Kernel | 35 |
| Microsoft Office Excel | 34 |
| Microsoft Office | 27 |
| Windows NTFS | 24 |
| Windows Runtime | 17 |
| Microsoft Office SharePoint | 17 |
| Windows Media | 15 |
| Windows Win32K | 12 |
The next Patch Tuesday is Nov 10, 2026 (in 5 days). Microsoft usually publishes around 10 a.m. Pacific; this page updates within the hour.
Questions
What should I patch first from Patch Tuesday July 2026?
The 3 exploited flaws: Active Directory Federation Services Elevation of Privilege Vulnerability; Microsoft SharePoint Server Elevation of Privilege Vulnerability; Microsoft SharePoint Remote Code Execution Vulnerability. Attackers are already using them.
When is the next Patch Tuesday?
Nov 10, 2026. Microsoft releases security updates on the second Tuesday of every month.
Source: Microsoft's July 2026 release notes and CISA's exploited-vulnerability catalog. Counts exclude Chromium fixes shipped in Microsoft Edge. Microsoft last revised this release on Nov 4, 2026. General information only; confirm details with Microsoft.