Daily digest
Tuesday 14 July 2026
A heavy day: 652 new CVEs, well above the recent average of about 96. Severity skewed high: 32 critical and 441 high, 73% of the total. 24 arrived with exploitation evidence or public exploit code already attached. CISA added 2 CVEs to the Known Exploited Vulnerabilities catalog. microsoft was the most-affected vendor with 570.
Added to CISA KEV
Confirmed exploitation in the wild — federal remediation deadlines attach to these.
CVE-2026-56155High· 7.8CISA KEV0dayPoCActive Directory Federation Services Elevation of Privilege Vulnerability
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CVE-2026-56164Medium· 5.3CISA KEV0dayPoCMicrosoft SharePoint Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
New this day, ranked by depth score
The 12 that matter most of the 652 published.
CVE-2026-58644Critical· 9.8CISA KEVPoCDeserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522Critical· 9.8CISA KEVPoCMicrosoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-55040Critical· 9.1CISA KEVPoCMicrosoft SharePoint Server Security Feature Bypass Vulnerability
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-56155High· 7.8CISA KEV0dayPoCActive Directory Federation Services Elevation of Privilege Vulnerability
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CVE-2026-54121High· 8.8PoCActive Directory Certificate Services Elevation of Privilege Vulnerability
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
CVE-2026-50369High· 8.8PoCWindows Remote Desktop Services Elevation of Privilege Vulnerability
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
CVE-2026-47301High· 8.8PoCConfiguration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
CVE-2026-54107High· 8.8PoCWindows Win32k Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
CVE-2026-50131High· 8.6PoCFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges
CVE-2026-54992High· 8.4PoCMicrosoft Message Queuing Queue Manager Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
CVE-2026-50338High· 8.2PoCAzure Spring Apps Elevation of Privilege Vulnerability
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.
CVE-2026-58635High· 7.8PoCImproper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
Improper neutralization of special elements used in a command ('command injection') in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2026-8037OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command en…epss93
Most-affected vendors
By CVEs published in the period.