Skip to content
Threat Feed
Subscribe
high advisory PoC

Microsoft Security Updates — July 2026

Roundup of Microsoft security advisories published in July 2026.

CVE search metadata

CVE search record: CVE-2026-47302. Severity: high. CVSS: 7.5. EPSS: 1.03%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-50318. Severity: high. CVSS: 7.8. EPSS: 0.26%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-50313. Severity: high. CVSS: 7.8. EPSS: 0.43%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-50361. Severity: high. CVSS: 7.8. EPSS: 0.18%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-58630. Severity: critical. CVSS: 10.0. EPSS: 0.86%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-58278. Severity: medium. CVSS: 5.4. EPSS: 0.28%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-40422. Severity: medium. CVSS: 5.5. EPSS: 0.30%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-50460. Severity: high. CVSS: 8.1. EPSS: 0.51%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-50650. Severity: high. CVSS: 7.8. EPSS: 0.29%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

CVE search record: CVE-2026-50669. Severity: high. CVSS: 7.0. EPSS: 0.15%. KEV: no. Brief: Microsoft Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-microsoft-security-updates/

What's new

  • 1. poc_available; added CVE-2026-40422 +4; microsoft edge version < 150.0.4078.48 Aug 10, 14:37 via exploit-db
  • 2. added CVE-2026-47302 +4 Aug 10, 13:30 via the-hacker-news
  • 3. new IOCs Aug 5, 09:12 via risky-biz
  • 4. added CVE-2026-42982 +4 Jul 31, 15:31 via reddit-blueteamsec
  • 5. added CVE-2026-47300 +3 Jul 30, 21:31 via nvd

Aggregated Microsoft security advisories for July 2026. CVEs from this cycle are folded into the list below as they are published.

Recommendation

Review affected products and apply Microsoft's July 2026 security updates.

Indicators of compromise

75

domain

7

email

12

hash_md5

3

hash_sha256

4

ip

126

url

TypeValue
urlhttps://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
urlhttps://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
urlhttps://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
urlhttps://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log
urlhttps://devblogs.microsoft.com/scripting/automating-quser-through-powershell/
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log
urlhttps://sploitus.com/exploit?id=816BFD0D-57FA-5C9C-B54C-3F0F88BD2C84
domainsharepoint.local
urlhttp://127.0.0.1:8080
domaingraph.windows.net
urlhttps://github.com/andreisss/Ghosting-AMSI
domainnvd.nist.gov
domainmsrc.microsoft.com
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57983
emailnvd@nist.gov
emailsoc@us-cert.gov
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58288
urlhttps://nvd.nist.gov
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58292
domainnist.gov
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58297
urlhttps://microsoft.com/devicelogin
urlhttps://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode
urlhttps://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
urlhttps://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
urlhttps://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
urlhttps://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log
urlhttps://github.com/its-a-feature/bifrost
urlhttps://any.run/malware-trends/tycoon/
domainpool.supportxmr[.]com
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58525
urlhttps://www.cve.org/CVERecord?id=CVE-2026-58525
urlhttps://sploitus.com/exploit?id=833581E3-D09A-5C85-BB3D-46DA43EDAF50
urlhttps://api.github.com/repos/stamparm/maltrail/commits/62bcccbdb75b98a64c49f74282b0942f4661fb2a
urlhttps://x.com/suyog41/status/2075572390315311333
urlhttps://www.virustotal.com/gui/file/372226c831de35186e1c96ec28c9ca8ceb02d69c9fe718e21d35b2e921ccf1de/detection
hash_sha256372226c831de35186e1c96ec28c9ca8ceb02d69c9fe718e21d35b2e921ccf1de
urlhttps://www.virustotal.com/gui/file/5ef25d162827195f2fbdc80fd5c6d119ff41dd16f980692a8c4308465d88c554/detection
hash_sha2565ef25d162827195f2fbdc80fd5c6d119ff41dd16f980692a8c4308465d88c554
urlhttps://x.com/volrant136/status/2076012175685287991
domaindownload-msoffice.com
domainbdnavy.download-msoffice.com
domaincabinet-division-gov-pk.download-msoffice.com
domainceh.download-msoffice.com
domaindocx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com
domainmm.download-msoffice.com
domainportmin.download-msoffice.com
domaintraining.docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com
domainword.download-msoffice.com
domainmail-bcc-gov-bd.vercel.app
urlhttps://sploitus.com/exploit?id=8D8B971C-F5EE-53DF-AAC5-417AF3B19481
urlhttps://github.com/gabe-k/themebleed
urlhttps://github.com/fortra/impacket/blob/master/impacket/smbserver.py
urlhttps://github.com/TalAloni/SMBLibrary/blob/master/SMBLibrary/NTFileStore/Enums/NtCreateFile/ShareAccess.cs
urlhttps://jnns.de/posts/cve-2023-38146-poc/
urlhttps://github.com/Jnnshschl/ThemeBleedReverseShellDLL
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58596
domainlogfriend.com
domain334thribetlhkyo977gqrcht1k7bvdj2.oastify.com
urlhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164
urlhttps://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
urlhttps://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
urlhttps://nvd.nist.gov/vuln/detail/CVE-2026-56164
urlhttps://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations
urlhttps://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/
urlhttps://attack.mitre.org/techniques/T1204/002/
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55008
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49162
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49171
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50293
emailus-cert@us-cert.gov
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54993
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58595
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50306
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50317
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50321
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50348
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50357
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50390
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50397
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50406
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50423
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50425
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50449
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50476
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50478
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50479
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50510
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50665
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50673
urlhttps://sploitus.com/exploit?id=AC8BA49C-6B0C-5FC3-A311-C5C14C8864A6
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50338
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117
urlhttps://johannes-moeller.dev/blog/cve-2026-50338-spring-cloud-azure-b2c-cross-issuer
urlhttps://github.com/Azure/azure-sdk-for-java/pull/49252
urlhttps://github.com/Azure/azure-sdk-for-java/pull/49033
urlhttps://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
urlhttps://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
urlhttps://pushsecurity.com/blog/consentfix
urlhttps://github.com/secureworks/family-of-client-ids-research
urlhttps://sploitus.com/exploit?id=E845E4F1-345B-599F-A195-00B7604EBC69
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58635
urlhttps://nvd.nist.gov/vuln/detail/CVE-2026-58635
urlhttps://support.microsoft.com/help/5101650
urlhttps://brltty.app/
urlhttps://github.com/tylerdotrar/SigmaPotato
hash_sha256EC68A6BF7F104A815BD21E27E73A8DFB8AFCB282D4997BEBE9ECCD6C89259506
urlhttps://sploitus.com/exploit?id=EE91804C-7619-5280-A1EA-CD09C9E65284
ip112.213.124.132
domainhurgadatour[.]shop
domaincodebasecode[.]com
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58598
urlhttps://sploitus.com/exploit?id=2CC212A7-032B-5922-B8BE-86F87D50EA33
domainsploitus.com
urlhttps://sploitus.com/exploit?id=0136FBFD-5983-5F81-959C-30B22846A9AA
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56171
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62826
urlhttps://www.cve.org/CVERecord?id=CVE-2026-56171
urlhttps://www.cve.org/CVERecord?id=CVE-2026-62826
urlhttps://app.any.run/tasks/d078f430-c3cc-44e8-a809-5506205049c3?utm_source=anyrunblog&utm_medium=article&utm_campaign=kali365-phishing-targeting-us&utm_term=210726&utm_content=linktoservice
domaincloudlanecdn[.]com
domainwindiam.com
urlhttp://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/n/windiam
domainvkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
domainmybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
domainbrain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion
domain77nrxelcwh47yikvpaz2rvtsten4sen2elybo5r5st6wlxsbitv255qd.onion
domainp6wmotxzvg34tdmpwm4beqgrcyp5iys43snkccsahnw74la3k3xx6pad.onion
domainzktnif5vckhmz5tyrukp5bamatbfhkxjnb23rspsanyzywcrx3bvtqad.onion
domain4ldgw2wuidqu5ef3rzx4byonf3y7rdnh43jiw2z4sbtjiwic6gkov7yd.onion
domaincuuhrxbg52c5agytmtjpwfu7mrs4xtaitc4mukkiy2kqdxeqbcmuhaid.onion
emailbrain.dataleak@cyberfear.com
emailbrain.decrypt@cyberfear.com
emailbrain.support@cyberfear.com
emailibrain.support@cyberfear.com
hash_md50da1f4ede654e83241eaad7719a708a0
hash_md541050b2b9f619cdd9916e3bdd5b9f2f9
hash_md5448f1796fe8de02194b21c0715e0a5f6
hash_md5523c501118ef5d7957ce54aee86d9b1d
hash_md5714b31629c37dee57038ca4e52ef65ac
hash_md571c109f3bf4da2fc0173b9bcff07e979
hash_md58b3a45ebb7f2331e90ac57a2a20536fd
hash_md58dbd57b042bc63b9ecdc9e3e5506ce85
hash_md59c5698924d4d1881efaf88651a304cb3
hash_md5a0efa7fb6dff1e035510ec1f42e083e4
hash_md5b32a8951fc4c2e4c2d63d17200ca0032
hash_md5f94d17b5f232e9cfd2255ca9823cb18a
urlhttps://sploitus.com/exploit?id=1994C25F-7EC9-5173-B572-042AF6615038
urlhttps://sploitus.com/exploit?id=B4E1D3A6-7173-5883-9366-19658411A20B
domain.ru
urlhttps://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
urlhttps://twitter.com/pr0xylife/status/1590394227758104576
urlhttps://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/executables_suspicious_file_path/exec_susp_path2.log
urlhttps://learn.microsoft.com/en-us/powershell/module/scheduledtasks/?view=windowsserver2022-ps
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/pwsh_scheduledtask.log
urlhttps://attacker.example/x.sh
urlhttps://sploitus.com/exploit?id=FBD3DBC5-71EE-57F6-A156-58C2288B70BD
urlhttps://sploitus.com/exploit?id=411122DF-F525-5EBC-9FBF-47D3F8CA07B7
urlhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50522
urlhttps://vulners.com/cve/CVE-2026-50522
urlhttps://nvd.nist.gov/vuln/detail/CVE-2026-50522
urlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-50522
urlhttps://www.zerodayinitiative.com/advisories/ZDI-26-412/
urlhttps://digital.nhs.uk/cyber-alerts/2026/cc-4818
urlhttps://www.bleepingcomputer.com/news/security/critical-sharepoint-rce-flaw-exploited-to-steal-machine-keys/
urlhttps://censys.com/advisory/cve-2026-50522-cve-2026-58644/
domaingithubusercontent.com
domainanonfiles.com
domaincdn.discordapp.com
domainddns.net
domaindl.dropboxusercontent.com
domainghostbin.co
domainglitch.me
domaingofile.io
domainhastebin.com
domainmediafire.com
domainmega.nz
domainonrender.com
domainpages.dev
domainpaste.ee
domainpastebin.com
domainpastetext.net
domainprivatlab.com
domainsend.exploit.in
domainsendspace.com
domainstorage.googleapis.com
domainstorjshare.io
domainsupabase.co
domaintemp.sh
domaintransfer.sh
domaintrycloudflare.com
domainufile.io
domainw3spaces.com
urlhttps://attack.mitre.org/techniques/T1553/005/
urlhttps://github.com/nmantani/PS-MOTW#remove-motwps1
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.005/mark_of_the_web_bypass/possible-motw-deletion.log
urlhttps://blog.talosintelligence.com/2018/02/olympic-destroyer.html
urlhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/sysmon.log
domainsequrityupdate.top
domainscan-security.top
domainsystem-online.top
domainsystem-connect.top
domaincorp-connect.top
domaininfo-secure.top
domainsupportsoft.top
domainupdate-syscontrol.top
domainsequpdate.top
domainservice-clien.top
domainservice-corporation.top
domainscansequrity.top
domainservice-help.top
domainit-service.top
domainsequritycheck.top
domainupsecscan.top
ip94.140.114.192
ip94.140.115.18
ip94.140.115.129
urlhttps://sploitus.com/exploit?id=C28553BE-4C45-5EF1-858E-239BEE31A10F
urlhttps://github.com/DavidCarliez/CVE-2026-49176_LPE_POC
urlhttps://davidcarliez.github.io/blog/cve-2026-49176-walletservice-to-system/
urlhttps://www.wiz.io/blog/cosmosescape-taking-over-every-database-in-azure-cosmos-db
urlhttps://therecord.media/north-korea-hackers-ransomware
urlhttp://localhost:8080