Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Service Advisory

Due to a worldwide Microsoft Outlook disruption, emails to and from CSA may be delayed. We apologise for the inconvenience.

Cyber Security Agency of Singapore
Monthly Patch

July 2026 Monthly Patch

15 July 2026

Microsoft has released security patches to address multiple vulnerabilities in their software and products.

Microsoft has released security patches to address multiple vulnerabilities in their software and products.

The vulnerabilities that have been classified as Critical in severity are listed in the table below.

For the full list of security patches released by Microsoft, please refer to https://msrc.microsoft.com/update-guide/en-us/releaseNote/2026-Jul (opens in new tab)

Critical Vulnerabilities

CVE Number

CVE Name

Base Score

Reference

CVE-2026-57092

Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

9.9

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57092 (opens in new tab)

CVE-2026-57100

Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

9.9

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57100 (opens in new tab)

CVE-2026-45499

Azure OpenAI Elevation of Privilege Vulnerability

9.9

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45499 (opens in new tab)

CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-38968 (opens in new tab)

CVE-2026-56188

Windows Server Network driver Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56188 (opens in new tab)

CVE-2026-50518

Windows DHCP Server Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50518 (opens in new tab)

CVE-2026-55010

Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55010 (opens in new tab)

CVE-2026-58644

Microsoft SharePoint Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-58644 (opens in new tab)

CVE-2026-50522

Microsoft SharePoint Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50522 (opens in new tab)

CVE-2026-55944

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55944 (opens in new tab)

CVE-2026-56159

DHCP Server Service Remote Code Execution Vulnerability

9.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56159 (opens in new tab)

CVE-2026-50380

Windows GDI+ Remote Code Execution Vulnerability

9.6

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50380 (opens in new tab)

CVE-2026-55008

Microsoft Exchange Server Spoofing Vulnerability

9.6

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55008 (opens in new tab)

CVE-2026-48561

Microsoft Copilot Remote Code Execution Vulnerability

9.6

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-48561 (opens in new tab)

CVE-2026-41106

Microsoft 365 Copilot Elevation of Privilege Vulnerability

9.3

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41106 (opens in new tab)

CVE-2026-9547

SSH improper host validation

9.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-9547 (opens in new tab)

CVE-2026-55040

Microsoft SharePoint Server Security Feature Bypass Vulnerability

9.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55040 (opens in new tab)

CVE-2026-54999

Windows TCP/IP Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54999 (opens in new tab)

CVE-2026-50444

Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50444 (opens in new tab)

CVE-2026-54982

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54982 (opens in new tab)

CVE-2026-58608

Windows Print Spooler Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-58608 (opens in new tab)

CVE-2026-50474

Remote Desktop Client Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50474 (opens in new tab)

CVE-2026-57094

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57094 (opens in new tab)

CVE-2026-57090

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57090 (opens in new tab)

CVE-2026-57087

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-57087 (opens in new tab)

CVE-2026-54118

Microsoft SQL Server Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54118 (opens in new tab)

CVE-2026-54117

Microsoft SQL Server Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54117 (opens in new tab)

CVE-2026-54998

Microsoft Exchange Online Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54998 (opens in new tab)

CVE-2026-50382

DirectX Graphics Kernel Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50382 (opens in new tab)

CVE-2026-50370

DHCP Server Service Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50370 (opens in new tab)

CVE-2026-48564

DHCP Server Service Remote Code Execution Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-48564 (opens in new tab)

CVE-2026-54121

Active Directory Certificate Services Elevation of Privilege Vulnerability

8.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54121 (opens in new tab)

CVE-2026-54128

Windows DHCP Client Remote Code Execution Vulnerability

8.4

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54128 (opens in new tab)

CVE-2026-55045

Microsoft Office Remote Code Execution Vulnerability

8.4

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55045 (opens in new tab)

CVE-2026-54992

Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

8.4

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54992 (opens in new tab)

CVE-2026-50680

Windows Hyper-V Elevation of Privilege Vulnerability

8.2

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50680 (opens in new tab)

CVE-2026-50694

Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50694 (opens in new tab)

CVE-2026-54995

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54995 (opens in new tab)

CVE-2026-49164

Windows Active Directory Domain Services Remote Code Execution Vulnerability

8.1

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-49164 (opens in new tab)

CVE-2026-42982

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-42982 (opens in new tab)

CVE-2026-58542

Windows Media Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-58542 (opens in new tab)

CVE-2026-50327

Windows Media Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50327 (opens in new tab)

CVE-2026-49796

Windows GDI+ Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-49796 (opens in new tab)

CVE-2026-55132

Microsoft Word Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55132 (opens in new tab)

CVE-2026-55127

Microsoft Word Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55127 (opens in new tab)

CVE-2026-55033

Microsoft Word Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55033 (opens in new tab)

CVE-2026-56189

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56189 (opens in new tab)

CVE-2026-50655

Microsoft Windows Media Foundation Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50655 (opens in new tab)

CVE-2026-55123

Microsoft PowerPoint Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55123 (opens in new tab)

CVE-2026-55120

Microsoft PowerPoint Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55120 (opens in new tab)

CVE-2026-55043

Microsoft PowerPoint Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55043 (opens in new tab)

CVE-2026-55140

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55140 (opens in new tab)

CVE-2026-55129

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55129 (opens in new tab)

CVE-2026-55056

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55056 (opens in new tab)

CVE-2026-55049

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55049 (opens in new tab)

CVE-2026-55022

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55022 (opens in new tab)

CVE-2026-55018

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55018 (opens in new tab)

CVE-2026-50467

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50467 (opens in new tab)

CVE-2026-50314

Microsoft Office Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50314 (opens in new tab)

CVE-2026-55012

Microsoft Defender Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55012 (opens in new tab)

CVE-2026-55011

Microsoft Defender Remote Code Execution Vulnerability

7.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-55011 (opens in new tab)

CVE-2026-59873

node-tar: Decompression/parse DoS via unlimited input

7.5

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-59873 (opens in new tab)

CVE-2026-54127

Windows Hyper-V Elevation of Privilege Vulnerability

7.4

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-54127 (opens in new tab)

CVE-2026-50392

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

7.0

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-50392 (opens in new tab)

CVE-2026-26145

Microsoft Azure Synapse Elevation of Privilege Vulnerability

4.8

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-26145 (opens in new tab)

CVE-2026-56000

xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent()

TBD

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56000 (opens in new tab)