Patch Tuesday

July 2026

On the second Tuesday of each month Microsoft, Adobe, SAP, Siemens and Schneider Electric publish in bulk; Oracle on the third Tuesday of January, April, July and October. Records published that day, from our own database, sorted by action score: KEV and mature exploits first.

How it is computed: CNA stamp + publication date (two-day window, UTC). No claim of a one-to-one match with the vendor bulletin; out-of-band updates land on other days.

891 records · 5 KEV

Affecting your stack

This month's records that match the products and versions in your stack.

Microsoft · July 14

400 · 5 KEV · 31 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
87Now	CVE-2026-55040Weaponized	Microsoft SharePoint Server Security Feature Bypass Vulnerabilitymicrosoft · sharepoint server · CWE-1390 Pre-auth Auth bypass	Critical9.1	KEV	69.5%	Jul 14, 2026
74This week	CVE-2026-58644Weaponized	Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	15.9%	Jul 14, 2026
70This week	CVE-2026-50522Weaponized	Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	3.0%	Jul 14, 2026
69This week	CVE-2026-56164Weaponized	Microsoft SharePoint Server Elevation of Privilege Vulnerabilitymicrosoft · sharepoint server · CWE-306 Pre-auth Auth bypass	Critical9.8	KEV	1.0%	Jul 14, 2026
61This week	CVE-2026-56155Weaponized	Active Directory Federation Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-1220 Local privilege escalation	High7.8	KEV	0.3%	Jul 14, 2026
39Monitor	CVE-2026-42990No exploit	SQL Server ODBC driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 Pre-auth Memory safety	Critical9.8	—	1.0%	Jul 14, 2026
39Monitor	CVE-2026-47304No exploit	.NET Security Feature Bypass Vulnerabilitymicrosoft · .net framework · CWE-345 Pre-auth	Critical9.8	—	0.3%	Jul 14, 2026
39Monitor	CVE-2026-49164No exploit	Windows Active Directory Domain Services Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	0.8%	Jul 14, 2026
39Monitor	CVE-2026-49172No exploit	Windows FTP Service Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Jul 14, 2026
39Monitor	CVE-2026-49181No exploit	Windows DHCP Client Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-191 Pre-auth Memory safety	Critical9.8	—	1.2%	Jul 14, 2026
39Monitor	CVE-2026-50330No exploit	Windows Remote Desktop Client Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 Pre-auth Memory safety	Critical9.8	—	1.3%	Jul 14, 2026
39Monitor	CVE-2026-50439No exploit	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	0.8%	Jul 14, 2026

CVE-2026-55040
87Now
Microsoft SharePoint Server Security Feature Bypass Vulnerability
CriticalCVSS 9.1KEVWeaponizedEPSS 70%
- Pre-auth
- Auth bypass
microsoft · sharepoint serverJul 14, 2026
CVE-2026-58644
74This week
Microsoft SharePoint Remote Code Execution Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 16%
- pre-auth RCE
- Deserialization
microsoft · sharepoint serverJul 14, 2026
CVE-2026-50522
70This week
Microsoft SharePoint Remote Code Execution Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 3%
- pre-auth RCE
- Deserialization
microsoft · sharepoint serverJul 14, 2026
CVE-2026-56164
69This week
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 1%
- Pre-auth
- Auth bypass
microsoft · sharepoint serverJul 14, 2026
CVE-2026-56155
61This week
Active Directory Federation Services Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 0%
- Local privilege escalation
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-42990
39Monitor
SQL Server ODBC driver Elevation of Privilege Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Memory safety
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-47304
39Monitor
.NET Security Feature Bypass Vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
microsoft · .net frameworkJul 14, 2026
CVE-2026-49164
39Monitor
Windows Active Directory Domain Services Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-49172
39Monitor
Windows FTP Service Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-49181
39Monitor
Windows DHCP Client Elevation of Privilege Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Memory safety
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-50330
39Monitor
Windows Remote Desktop Client Elevation of Privilege Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Memory safety
microsoft · windows 10 1607Jul 14, 2026
CVE-2026-50439
39Monitor
Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Jul 14, 2026

+388 moreAll records of the vendor

Adobe · July 14

88 · 0 KEV · 13 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-48318No exploit	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)adobe · coldfusion · CWE-22 Path traversal	Critical9.9	—	1.1%	Jul 14, 2026
39Monitor	CVE-2026-48322No exploit	ColdFusion \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · coldfusion · CWE-94 RCE	Critical9.9	—	1.2%	Jul 14, 2026
38Monitor	CVE-2026-48259No exploit	Adobe Experience Manager \| Server-Side Request Forgery (SSRF) (CWE-918)adobe · experience manager · CWE-918 RCE SSRF	Critical9.6	—	0.9%	Jul 14, 2026
38Monitor	CVE-2026-48284No exploit	ColdFusion \| Improper Input Validation (CWE-20)adobe · coldfusion · CWE-20 pre-auth RCE	Critical9.6	—	0.5%	Jul 14, 2026
38Monitor	CVE-2026-48359No exploit	Adobe Experience Manager \| Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)adobe · experience manager · CWE-611 RCE XXE	Critical9.6	—	1.0%	Jul 14, 2026
37Monitor	CVE-2026-48321No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.4%	Jul 14, 2026
37Monitor	CVE-2026-48325No exploit	ColdFusion \| Missing Authentication for Critical Function (CWE-306)adobe · coldfusion · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.6%	Jul 14, 2026
37Monitor	CVE-2026-48334No exploit	Illustrator \| Improper Input Validation (CWE-20)adobe · illustrator · CWE-20 pre-auth RCE	Critical9.3	—	1.0%	Jul 14, 2026
37Monitor	CVE-2026-48356Proof of concept	Adobe Commerce \| Unrestricted Upload of File with Dangerous Type (CWE-434)adobe · commerce · CWE-434 pre-auth RCE File upload	Critical9.3	—	1.0%	Jul 14, 2026
36Monitor	CVE-2026-48319No exploit	ColdFusion \| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)adobe · coldfusion · CWE-22 RCE Path traversal	Critical9.1	—	1.4%	Jul 14, 2026
36Monitor	CVE-2026-48324No exploit	ColdFusion \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)adobe · coldfusion · CWE-89 RCE SQL injection	Critical9.1	—	1.1%	Jul 14, 2026
36Monitor	CVE-2026-48327No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 RCE Broken access control (IDOR)	Critical9.0	—	0.4%	Jul 14, 2026

CVE-2026-48318
39Monitor
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CriticalCVSS 9.9No exploitEPSS 1%
- Path traversal
adobe · coldfusionJul 14, 2026
CVE-2026-48322
39Monitor
ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
adobe · coldfusionJul 14, 2026
CVE-2026-48259
38Monitor
Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
CriticalCVSS 9.6No exploitEPSS 1%
- RCE
- SSRF
adobe · experience managerJul 14, 2026
CVE-2026-48284
38Monitor
ColdFusion | Improper Input Validation (CWE-20)
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
adobe · coldfusionJul 14, 2026
CVE-2026-48359
38Monitor
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
CriticalCVSS 9.6No exploitEPSS 1%
- RCE
- XXE
adobe · experience managerJul 14, 2026
CVE-2026-48321
37Monitor
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
adobe · coldfusionJul 14, 2026
CVE-2026-48325
37Monitor
ColdFusion | Missing Authentication for Critical Function (CWE-306)
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
adobe · coldfusionJul 14, 2026
CVE-2026-48334
37Monitor
Illustrator | Improper Input Validation (CWE-20)
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
adobe · illustratorJul 14, 2026
CVE-2026-48356
37Monitor
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
CriticalCVSS 9.3Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
adobe · commerceJul 14, 2026
CVE-2026-48319
36Monitor
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Path traversal
adobe · coldfusionJul 14, 2026
CVE-2026-48324
36Monitor
ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- SQL injection
adobe · coldfusionJul 14, 2026
CVE-2026-48327
36Monitor
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.0No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
adobe · coldfusionJul 14, 2026

+76 moreAll records of the vendor

SAP · July 14

0 · 0 KEV · 0 critical

No records in this window.

Siemens · July 14

3 · 0 KEV · 1 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2026-56451No exploit	A vulnerability has been identified in Opcenter X (All versions < V2604).siemens · opcenter x · CWE-347 Pre-auth Auth bypass Weak crypto	Critical10.0	—	0.5%	Jul 14, 2026
34Monitor	CVE-2025-40945No exploit	A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (Alsiemens · comos v10.4.5 · CWE-426	High8.5	—	0.2%	Jul 14, 2026
24Monitor	CVE-2026-54429No exploit	A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions).siemens · simatic s7-plcsim advanced · CWE-770 Pre-auth Denial of service	Medium6.0	—	0.3%	Jul 14, 2026

CVE-2026-56451
40Plan
A vulnerability has been identified in Opcenter X (All versions < V2604).
CriticalCVSS 10.0No exploitEPSS 0%
siemens · opcenter xJul 14, 2026
CVE-2025-40945
34Monitor
A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1), Designcenter NX (Al
HighCVSS 8.5No exploitEPSS 0%
siemens · comos v10.4.5Jul 14, 2026
CVE-2026-54429
24Monitor
A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions).
MediumCVSS 6.0No exploitEPSS 0%
- Pre-auth
- Denial of service
siemens · simatic s7-plcsim advancedJul 14, 2026

All records of the vendor

Schneider Electric · July 14

0 · 0 KEV · 0 critical

No records in this window.

Oracle (Critical Patch Update) · July 21

400 · 0 KEV · 210 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2026-47056No exploit	Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service).oracle · data integrator · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Jul 21, 2026
40Plan	CVE-2026-60217No exploit	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).oracle · coherence · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Jul 21, 2026
40Plan	CVE-2026-60358No exploit	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).oracle · access manager · CWE-284 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.5%	Jul 21, 2026
40Plan	CVE-2026-60360No exploit	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).oracle · unified directory · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Jul 21, 2026
40Plan	CVE-2026-60365No exploit	Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for oracle · http server · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.4%	Jul 21, 2026
40Plan	CVE-2026-60366No exploit	Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).oracle · platform security for java · CWE-269 Pre-auth	Critical10.0	—	0.5%	Jul 22, 2026
40Plan	CVE-2026-60379No exploit	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).oracle · service delivery platform · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Jul 21, 2026
40Plan	CVE-2026-60389No exploit	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).oracle · service delivery platform · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Jul 21, 2026
40Plan	CVE-2026-60644No exploit	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management).oracle · webcenter content · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.5%	Jul 21, 2026
39Monitor	CVE-2026-35290No exploit	Vulnerability in Oracle Application Testing Suite.oracle · application testing suite · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Jul 21, 2026
39Monitor	CVE-2026-46876No exploit	Vulnerability in Oracle Application Testing Suite.oracle · application testing suite · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Jul 21, 2026
39Monitor	CVE-2026-46924No exploit	Vulnerability in Oracle Application Testing Suite.oracle · application testing suite · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Jul 21, 2026

CVE-2026-47056
40Plan
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Rest Service).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
oracle · data integratorJul 21, 2026
CVE-2026-60217
40Plan
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
oracle · coherenceJul 21, 2026
CVE-2026-60358
40Plan
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
oracle · access managerJul 21, 2026
CVE-2026-60360
40Plan
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
oracle · unified directoryJul 21, 2026
CVE-2026-60365
40Plan
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
oracle · http serverJul 21, 2026
CVE-2026-60366
40Plan
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
oracle · platform security for javaJul 22, 2026
CVE-2026-60379
40Plan
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
oracle · service delivery platformJul 21, 2026
CVE-2026-60389
40Plan
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
oracle · service delivery platformJul 21, 2026
CVE-2026-60644
40Plan
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management).
CriticalCVSS 10.0No exploitEPSS 1%
- Pre-auth
- Auth bypass
oracle · webcenter contentJul 21, 2026
CVE-2026-35290
39Monitor
Vulnerability in Oracle Application Testing Suite.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
oracle · application testing suiteJul 21, 2026
CVE-2026-46876
39Monitor
Vulnerability in Oracle Application Testing Suite.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
oracle · application testing suiteJul 21, 2026
CVE-2026-46924
39Monitor
Vulnerability in Oracle Application Testing Suite.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
oracle · application testing suiteJul 21, 2026

+388 moreAll records of the vendor