July 2026 Patch Tuesday briefing

Executive briefing

Executive Summary

Three vulnerabilities are being actively exploited this month—two in SharePoint and one in AD FS—creating an immediate, enterprise-wide risk for identity compromise and rapid server takeover. If you run on-prem SharePoint or rely on AD FS for authentication, treat July as a “patch-now” cycle with clear attacker momentum and short CISA deadlines.

Microsoft released 571 CVEs in July (up sharply from 204 in June). The volume jump, combined with multiple in-the-wild exploits and 5 total CISA KEV items, makes this an elevated-risk month rather than routine. The patch set is heavily weighted toward Windows/ESU and privilege escalation, which is exactly the mix attackers use to turn a single foothold into domain-wide impact.

Bottom line: Prioritize on-prem SharePoint and AD FS immediately—active exploitation plus KEV deadlines means delay translates directly into breach risk.

Key Risks

CVE-2026-58644 — SharePoint Remote Code Execution (server takeover)

Actively exploited / CISA KEV deadline: 2026-07-19. This is a “run code on the SharePoint server” bug: an attacker can send crafted requests to a vulnerable SharePoint instance and execute commands as the SharePoint service, enabling webshell deployment, data theft from SharePoint content, and a launch point for lateral movement into the rest of the environment.

What the attacker needs: Remote access to the SharePoint server over the network with no user interaction—no phishing click required. If SharePoint is internet-facing (or reachable from a compromised internal host), exploitation can be fast and repeatable. Why it matters: SharePoint often stores sensitive documents and integrates with identity and workflow systems; compromise commonly becomes a stepping stone to ransomware and broader domain compromise.

CVE-2026-56164 — SharePoint Elevation of Privilege (unauthenticated privilege gain)

Actively exploited / CISA KEV deadline: 2026-07-17. This vulnerability allows an attacker to gain higher privileges in SharePoint than they should have—effectively turning a low/no-privilege position into the ability to perform privileged actions. In real terms, this can mean modifying content, changing configurations, or setting up persistence that supports follow-on exploitation.

What the attacker needs: Remote access to the SharePoint service with no user interaction. Because exploitation is happening in the wild, assume attackers will chain this with other SharePoint weaknesses to move from “access” to “control.” Why it matters: Privilege escalation inside SharePoint accelerates breach progression—especially when SharePoint is used as an internal portal for broad user populations and sensitive data.

CVE-2026-56155 — AD FS Elevation of Privilege (identity system compromise)

Actively exploited / CISA KEV deadline: 2026-07-28. AD FS sits at the center of authentication for many enterprises. This flaw enables an attacker to elevate privileges within the AD FS context, which can translate into stronger control over authentication flows and potentially abuse of trust relationships—turning an initial foothold into broader access.

What the attacker needs: Some existing authenticated access (for example, a compromised user account or a foothold on a system that can interact with AD FS). No end-user click is required once the attacker has that access. Why it matters: Identity-layer compromise is high leverage—attackers can pivot to cloud apps, VPN access, and internal resources, often bypassing traditional endpoint controls.

CVE-2026-50518 — Windows DHCP Server Remote Code Execution (infrastructure-level takeover)

A successful exploit can allow an attacker to run code on a Windows DHCP Server—an infrastructure role that is widely trusted and often highly connected. In a real attack, this can become a rapid path to network-wide disruption (loss of IP assignment) or a privileged beachhead for lateral movement.

What the attacker needs: Network reachability to the DHCP service; no user interaction is required. This is most concerning in flat networks, shared VLANs, or environments where server-to-server traffic is broadly permitted. Why it matters: Compromise of core network services can quickly cascade into outages, incident response paralysis, and accelerated ransomware spread.

CVE-2026-50447 — Windows Message Queuing (MSMQ) Remote Code Execution (server compromise)

MSMQ is still present in many environments (sometimes unintentionally). This vulnerability can allow an attacker to execute code on a server running the service by sending malicious traffic to it—turning an exposed or reachable queue endpoint into a remote entry point.

What the attacker needs: Remote network access to the MSMQ service; no user click required. Why it matters: MSMQ compromise is a classic “quiet” server takeover vector—often missed in inventories—useful for persistence, lateral movement, and staging ransomware.

Threat Landscape

This month’s release is dominated by Windows/ESU and a heavy concentration of elevation-of-privilege issues, a pattern that aligns with real attacker playbooks: land a foothold, escalate privileges, then move laterally. The standout signal is SharePoint: multiple high-impact SharePoint issues are both actively exploited and tracked in KEV, indicating sustained attacker focus on on-prem collaboration infrastructure.

Compared to June (no exploited CVEs), July shows a clear shift: exploitation is already underway at Patch Tuesday time, and the KEV deadlines are tight. Expect rapid weaponization and chaining—especially where SharePoint exposure, weak segmentation, or over-permissive service connectivity exists.

Recommended Actions

1. Patch immediately: SharePoint (on-prem) — prioritize KEV items first.
   Owners: Collaboration/SharePoint team + Windows Server team.
   Target CVEs: CVE-2026-56164 (due 2026-07-17) and CVE-2026-58644 (due 2026-07-19), then CVE-2026-50522 (due 2026-07-25) and CVE-2026-55040 (due 2026-08-21).
   Execution note: Treat internet-facing SharePoint as emergency change; validate patch completion and restart requirements.

2. Patch and harden AD FS with urgency.
   Owners: Identity/IAM team + Windows Server team.
   Target CVE: CVE-2026-56155 (due 2026-07-28).
   Operational control: Tighten administrative access paths to AD FS, review privileged group membership, and increase monitoring for unusual authentication behavior immediately after patching.

3. Reduce exposure of high-risk Windows services: DHCP Server and MSMQ.
   Owners: Infrastructure/Network team + Windows Server team.
   Target CVEs: CVE-2026-50518 and CVE-2026-50447.
   Immediate mitigation: Restrict inbound access to these services to only required subnets/hosts; remove/disable MSMQ where not explicitly needed.

4. Prioritize patching for “remote, no-click” server roles across Windows/ESU.
   Owners: Endpoint/Server engineering + Vulnerability management.
   Focus areas: Remote code execution affecting server-facing components (e.g., RDP, FTP, network drivers) where exploitation does not require user interaction. This reduces the chance that a single exposed service becomes the initial breach vector.

5. Assume SharePoint compromise is possible and verify detection/response readiness.
   Owners: SOC/IR team.
   Actions: Hunt for signs of SharePoint webshells and suspicious process execution on SharePoint servers; ensure rapid isolation playbooks are ready for collaboration servers to prevent lateral movement and ransomware staging.

Technical briefing

Technical Summary

July 2026 Patch Tuesday is a major volume spike: 571 CVEs total (19 Critical / 408 High / 141 Medium / 2 Low / 1 N/A) versus 204 last month (June 2026), with Criticals more than doubling (19 vs 9). Microsoft also flags 3 CVEs as actively exploited in the wild and 1 publicly disclosed issue. CISA KEV includes 5 CVEs this month, driven primarily by SharePoint and identity infrastructure exposure.

The dominant themes are server-side, network-reachable RCE (notably SharePoint, DHCP, MSMQ, FTP, RDP) and a heavy skew toward Elevation of Privilege (250 CVEs; 44% of the release), consistent with post-compromise attacker behavior: land initial access, then rapidly escalate privileges and expand control. What makes this month notable is the concentration of high-impact SharePoint vulnerabilities (including active exploitation and multiple KEV entries) that can plausibly be chained into unauthenticated compromise → privilege gain → persistence in enterprise collaboration environments.

Key finding: Microsoft SharePoint is the highest-risk patching surface this month due to an actively exploited unauthenticated RCE plus a separate actively exploited EoP and additional KEV-listed SharePoint weaknesses that enable rapid, scalable server takeover.

Critical & Exploited Vulnerabilities

CVE-2026-58644 — Microsoft SharePoint Remote Code Execution Vulnerability

This is a Critical SharePoint RCE with CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) mapped to CWE-502 (Deserialization of Untrusted Data). The vector describes a worst-case enterprise scenario: network-reachable, no authentication, no user interaction—i.e., a remote attacker can send crafted requests to a vulnerable SharePoint endpoint and achieve code execution on the server. Actively exploited and in CISA KEV with deadline: 2026-07-19, this should be treated as an internet-scale exploitation candidate, especially where SharePoint is exposed directly or via reverse proxies/VPN concentrators.

Operationally, SharePoint RCE is rarely “just” a webshell event. Expect attackers to use initial execution to drop a webshell, harvest SharePoint service account context, pivot into domain authentication material (tokens/keys/config), and then move laterally to file servers, SQL backends, and identity systems. This CVE also aligns cleanly with this month’s SharePoint EoP and security feature bypass issues, enabling an attacker who lands code execution to quickly expand privileges and persistence within the farm.

Detection coverage: 1 Nuclei template.

CVE-2026-56164 — Microsoft SharePoint Server Elevation of Privilege Vulnerability

Although rated Medium by severity, this CVE is Actively exploited and in CISA KEV with deadline: 2026-07-17, making it operationally Tier-1. The score is CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and the weakness is CWE-306 (Missing Authentication for Critical Function). The vector indicates remote, unauthenticated access with low complexity and no user interaction, but the impact is primarily integrity (limited privilege gain/ability to perform actions otherwise restricted).

In real-world terms, this is the kind of vulnerability attackers use to turn footholds into control: bypassing an auth gate on a “critical function” can enable role/permission manipulation, configuration changes, or execution pathways that are not intended to be reachable anonymously. In SharePoint environments, even “limited” integrity impact can be enough to plant malicious components, alter pages/workflows, or set up a path to subsequent code execution—especially when paired with a deserialization RCE like CVE-2026-58644 or other SharePoint weaknesses in this release.

Detection coverage: 2 GitHub PoCs available.

CVE-2026-50522, CVE-2026-55040 — SharePoint unauthenticated RCE + Security Feature Bypass (KEV-listed pattern)

These two KEV-listed SharePoint issues represent a high-risk pattern: unauthenticated server compromise plus a security control failure that can make exploitation more reliable or post-exploitation harder to contain.

• CVE-2026-50522 is Critical with CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-502 (Deserialization of Untrusted Data). It is CISA KEV with deadline: 2026-07-25. The prerequisites match an attacker scanning for exposed SharePoint and sending a crafted payload to trigger deserialization and achieve remote code execution as the SharePoint application context.
• CVE-2026-55040 is Critical with CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and CWE-1390 (Weak Authentication). It is CISA KEV with deadline: 2026-08-21. In practice, “weak authentication” in SharePoint server components often translates to bypassable trust boundaries—conditions where attackers can impersonate, replay, or otherwise satisfy authentication checks without legitimate credentials.

From an attacker’s perspective, these are complementary: the RCE provides execution, while the bypass can enable broader reach across endpoints, credential-less access to privileged actions, or reduced friction for persistence and lateral movement within the SharePoint farm. Treat SharePoint farms as high-value pivot infrastructure: once compromised, they frequently provide access to sensitive documents, internal portals, and service-to-service trust relationships.

Detection coverage: CVE-2026-55040 has 1 Nuclei template.

CVE-2026-56155 — Active Directory Federation Services Elevation of Privilege Vulnerability

This is a High severity but Actively exploited identity-layer vulnerability with CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CWE-1220 (Insufficient Granularity of Access Control). The vector indicates local access with low privileges is required—this is not an initial access bug by itself. Instead, it’s a classic post-compromise privilege escalation path: once an attacker has any foothold on an ADFS host (or a context that can execute locally with low privileges), they can elevate to a level that enables token/signing abuse, configuration tampering, or broader control over federated authentication flows.

In real-world attack chains, ADFS is a strategic target because it can be leveraged to mint or manipulate claims/tokens, enabling stealthy access to downstream services that trust federation. This CVE’s exploitation in the wild suggests adversaries are already using it to turn partial access into identity dominance, which can outlast endpoint remediation if federation trust and token-signing material are impacted. It is in CISA KEV with deadline: 2026-07-28.

CVE-2026-57092 — Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

This Critical EoP is scored CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with CWE-416 (Use After Free). The combination of AV:N and PR:L is a red flag for virtualized and multi-tenant server environments: an attacker with some authenticated foothold (low privileges) can potentially trigger the flaw over the network and cross a scope boundary (S:C)—consistent with scenarios where a guest/tenant or low-privileged actor can impact higher-privileged contexts.

Practically, defenders should think of this as a virtualization-adjacent privilege escalation that can be used after initial access to break containment, elevate privileges on hosts involved in virtual switching, or pivot into broader infrastructure control. In environments where Hyper-V networking is central (clusters, SDN-like designs, dense virtualization), this class of bug can turn a single compromised workload into a platform compromise.

CVE-2026-49798 — Windows Kernel Elevation of Privilege Vulnerability

This is a Critical kernel EoP with CVSS 9.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and CWE-416 (Use After Free). The vector indicates local exploitation with no privileges required—meaning any code execution on a host (even as a low-integrity context) can potentially be converted into SYSTEM-level control, with a scope change suggesting impact beyond the initial security boundary.

In real-world intrusions, kernel EoP is a staple for converting commodity initial access (phishing, drive-by, stolen creds) into full host takeover, disabling EDR components, dumping credentials, and establishing durable persistence. While not flagged as exploited here, the combination of kernel UAF + high impact makes it a strong candidate for rapid weaponization by threat actors who already have reliable userland execution.

CVE-2026-50518, CVE-2026-56159 — Windows DHCP Server RCE (unauthenticated, wormable-adjacent)

These DHCP Server issues are Critical with CVSS 9.8 and identical worst-case vectors (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), both tied to CWE-122 (Heap-based Buffer Overflow). DHCP is a high-risk service because it is often reachable on internal networks by default and processes attacker-controlled network traffic. An attacker with access to a network segment where the DHCP server listens could send crafted DHCP messages to trigger memory corruption and achieve remote code execution on a server that is frequently highly trusted and often co-located with other infrastructure roles.

From an attacker’s perspective, DHCP server compromise is valuable for network-wide manipulation (traffic steering, rogue configuration distribution, persistence via infrastructure), and it can be used to rapidly expand access inside flat networks. While not explicitly marked as exploited, the prerequisites are minimal and the target role is high-value—prioritize in environments where DHCP servers are widely reachable or where segmentation is weak.

CVE-2026-50447 — Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability

This Critical MSMQ RCE is CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with CWE-122 (Heap-based Buffer Overflow). MSMQ is frequently overlooked but can be present on legacy application servers and line-of-business systems. The vector indicates unauthenticated network exploitation, which makes this a strong candidate for internal lateral movement: once an attacker gains a foothold on any internal host, they can scan for MSMQ endpoints and attempt to execute code remotely without credentials.

In practice, MSMQ RCEs are often used to move laterally into application tiers that have access to databases, service accounts, and sensitive queues. If MSMQ is exposed beyond intended boundaries (misconfigured firewall rules, inherited server images), it can also become an external entry point.

CVE-2026-49172 — Windows FTP Service Remote Code Execution Vulnerability

This is a Critical FTP service RCE with CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 (Heap-based Buffer Overflow). FTP services are commonly internet-exposed in legacy workflows and are frequently targeted for credential stuffing and brute force; an unauthenticated RCE shifts the risk from “data exposure” to full server compromise. Attackers can weaponize this by scanning for FTP banners/ports, sending crafted protocol interactions, and gaining execution—then using the host as a staging point for credential theft and lateral movement.

Where FTP is used for partner integrations, compromise can also enable supply-chain style abuse (tampering with transferred files, inserting malicious payloads into inbound/outbound workflows).

CVE-2026-56188 — Windows Server Network driver Remote Code Execution Vulnerability

This Critical RCE is CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-362 (Race Condition). Network driver flaws are particularly dangerous because they can be triggered by raw network traffic and may be reachable across broad server fleets. Race conditions can be harder to exploit reliably, but when weaponized they can provide pre-auth RCE against servers that are otherwise well-hardened at the application layer.

In real-world operations, this class of bug is attractive for adversaries targeting server infrastructure at scale (file servers, domain-adjacent servers, virtualization hosts), especially when they can repeatedly attempt exploitation from inside the network after initial access.

CVE-2026-56190 — Remote Desktop Protocol Remote Code Execution Vulnerability

This is a Critical RDP RCE with CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) tied to CWE-908 (Use of Uninitialized Resource). The prerequisites indicate unauthenticated network exploitation—the most dangerous RDP profile because it enables compromise without valid credentials. If RDP is exposed to the internet (still common despite best practices) this becomes a direct initial access vector; if restricted internally, it becomes a powerful lateral movement tool for attackers already on the network.

Given RDP’s ubiquity, defenders should assume rapid scanning and opportunistic exploitation attempts, particularly against jump hosts, terminal servers, and admin workstations where RDP is enabled.

CVE-2026-54990 — Remote Desktop Client Remote Code Execution Vulnerability

This Critical client-side RCE is CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with CWE-122 (Heap-based Buffer Overflow). While labeled “client,” the vector suggests network reachability without explicit user interaction, consistent with scenarios where a client processes attacker-controlled data during connection negotiation or redirection. In practice, this can be abused via malicious RDP servers, man-in-the-middle positions, or poisoned connection brokers—turning routine admin behavior (connecting to servers) into a compromise path.

This is particularly relevant for IT/admin populations and environments using RDP gateways or third-party brokering where connection metadata can be influenced.

CVE-2026-50380 — Windows GDI+ Remote Code Execution Vulnerability

This Critical RCE is CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and CWE-122 (Heap-based Buffer Overflow). The UI:R requirement indicates a user must open/render attacker-controlled content—most commonly a crafted image embedded in a document, webpage, email, or chat client. The scope change (S:C) increases concern because successful exploitation may cross security boundaries (e.g., from a user context into broader system impact depending on the rendering host process and sandboxing).

Attackers typically weaponize GDI+ issues through phishing (malicious Office docs, HTML emails) or drive-by delivery. In enterprise environments, this is a reliable path to initial code execution on endpoints, which can then be paired with kernel EoP (e.g., CVE-2026-49798) to reach SYSTEM.

CVE-2026-42990 — SQL Server ODBC driver Elevation of Privilege Vulnerability

Despite the title, the scoring and vector indicate a Critical memory corruption leading to full compromise potential: CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with CWE-122 (Heap-based Buffer Overflow). The network vector suggests the vulnerable surface can be reached remotely—commonly via applications or services that accept remote input and pass it into ODBC driver code paths. In practice, this can manifest as an attacker sending crafted requests to an application server that uses the ODBC driver, triggering corruption in the driver layer and achieving code execution in the context of the hosting service.

Real-world risk is highest where ODBC is used in high-privilege service contexts (service accounts with broad database rights) or where the driver is present on middleware tiers that bridge user traffic to databases.

CVE-2026-54117, CVE-2026-54118 — Microsoft SQL Server Remote Code Execution Vulnerabilities

These two Critical SQL Server RCEs are both CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and map to CWE-502 (Deserialization of Untrusted Data). The scenario is straightforward and high impact: a remote attacker can send crafted inputs to a SQL Server-exposed interface or feature that performs unsafe deserialization, resulting in code execution on the database server.

Database server compromise is often a “blast radius multiplier”: attackers gain access to sensitive data, can tamper with records, and can use SQL Server’s connectivity to pivot into application servers and domain resources. Prioritize especially where SQL Server is reachable from untrusted networks or where legacy features/interfaces are enabled.

CVE-2026-55008 — Microsoft Exchange Server Spoofing Vulnerability

This Critical Exchange issue is CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and maps to CWE-79 (XSS). While categorized as spoofing, the vector indicates a user interaction requirement—typically a victim viewing a crafted message or web content in an Exchange-related web interface. With scope change, the practical risk is that an attacker can execute script in a victim’s session context, enabling credential/session theft, mailbox rule manipulation, or actions performed as the user (including privileged admins).

In real-world campaigns, Exchange web-layer issues are frequently used for credential harvesting and persistence (e.g., hidden inbox rules, OAuth consent-like abuse patterns), and can be paired with other access to expand into broader tenant or on-prem infrastructure.

CVE-2026-55010 — Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability

This is a Critical server RCE with CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-122 (Heap-based Buffer Overflow). The exploitation scenario is direct: any attacker who can reach the dedicated server over the network can send crafted traffic to trigger memory corruption and execute code. While not a typical enterprise workload, these servers are often internet-exposed, sometimes hosted on repurposed infrastructure, and can become an entry point into broader networks if deployed in poorly segmented environments.

CVE-2026-55944 — Microsoft Dynamics NAV / Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

This Critical Dynamics on-prem RCE is CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-502 (Deserialization of Untrusted Data). The prerequisites indicate unauthenticated network exploitation, which is particularly dangerous for ERP-like systems that often sit close to finance, identity integrations, and sensitive business workflows.

Real-world impact includes not only server takeover but also business process manipulation (fraud-enabling tampering), theft of financial/customer data, and lateral movement via service accounts and integrations commonly present in Dynamics deployments.

CVE-2026-50661 — Windows BitLocker Security Feature Bypass Vulnerability

This is the month’s publicly disclosed issue: a Medium severity BitLocker bypass with CVSS 6.1 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) mapped to CWE-693 (Protection Mechanism Failure). The physical access (AV:P) requirement makes it primarily a risk for lost/stolen devices, lab environments, or insider threat scenarios. The impact profile (high confidentiality/integrity) suggests the bypass can undermine disk protection assumptions, enabling data access or tampering without normal authorization.

For organizations with high laptop loss risk, travel-heavy staff, or sensitive endpoint data, this is a meaningful control failure even without remote exploitability—especially where BitLocker is a cornerstone compensating control.

Threat Category Analysis

Elevation of Privilege (250 — 44% of total)

The release is dominated by EoP, signaling continued focus on post-compromise acceleration: attackers increasingly assume they can land some form of code execution and then need reliable paths to SYSTEM/administrator or to identity control planes. The most operationally important EoPs this month are the actively exploited CVE-2026-56155 (ADFS) and CVE-2026-56164 (SharePoint), plus high-impact criticals like CVE-2026-49798 (Windows kernel) and CVE-2026-57092 (VMSwitch). The distribution suggests defenders should expect chaining: initial access (phish/web) → local privilege escalation → credential dumping → lateral movement.

Remote Code Execution (144 — 25% of total)

RCE remains the second-largest category, with a notable concentration of network-reachable, unauthenticated server RCEs (DHCP, MSMQ, FTP, RDP, SharePoint, SQL Server). This is the profile that enables rapid, scalable compromise in enterprise networks, especially where legacy services are enabled or segmentation is weak. The standout is SharePoint: CVE-2026-58644 is actively exploited, and CVE-2026-50522 is KEV-listed—together creating a high-confidence exploitation focus on collaboration servers.

Information Disclosure (101 — 18% of total)

While not the top driver of immediate compromise, the volume of disclosure bugs supports attacker objectives like credential/token harvesting, environment mapping, and identifying privileged targets. In months where EoP is high, disclosure issues often act as enablers—reducing attacker guesswork and improving reliability of privilege escalation and lateral movement.

Denial of Service (35 — 6% of total)

DoS is a smaller slice but can still be operationally significant for exposed services and edge-facing roles. In practice, DoS vulnerabilities are often used as smokescreens during exploitation waves or to disrupt incident response, but they are less directly tied to durable attacker control than RCE/EoP.

Security Feature Bypass (17 — 3% of total)

Security feature bypasses are low in count but high in strategic value because they undermine compensating controls. This month’s most important is CVE-2026-55040 (SharePoint, KEV) and the publicly disclosed CVE-2026-50661 (BitLocker). These are the types of issues attackers use to make exploitation more reliable or to defeat defensive assumptions (auth boundaries, disk encryption).

Spoofing (16 — 3% of total)

Spoofing issues are fewer but can be high impact when they target email and identity trust. CVE-2026-55008 (Exchange) stands out because web-layer spoofing/XSS can translate into session compromise and privileged action execution, especially in admin