Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Microsoft Patch Tuesday. Show all posts
Windows Update
July 2026 Update KB5099414 KB5101650 Microsoft Patch Tuesday Microsoft Security Patches Vulnerabilities and Exploits Windows 11 Windows 11 Security Update Windows Update

Windows 11 KB5101650 and KB5099414 Updates Released With Security Fixes and New Features


 

A cumulative update for Windows 11 based on Patch Tuesday July 2026 is now available, with KB5101650 for versions 25H2 and 24H2 and KB5099414 for version 23H2. As well as addressing 571 security vulnerabilities, the mandatory updates also improve the usability, accessibility, and performance of the operating system. 

Using the Microsoft Update Catalog or by navigating to Settings > Windows Update and selecting Check for updates, users may download the updates manually, following installation. As a result of the installation, Windows 11 build numbers have been updated to 26200.8875 (25H2), 26100.8875 (24H2), and 22631.7376 (23H). It is noteworthy to note the wider rollout of Point-in-Time Restore, which allows users to restore their systems to a previous state in a more efficient manner. 

Aside from new features, Microsoft has introduced several security-focused improvements as part of the July Patch Tuesday release, as well as enhanced controls for enterprise administrators. As a result of improved device targeting in the update, more eligible systems will be able to receive updated Secure Boot certificates automatically via Windows Update, thus expanding Secure Boot certificate deployment. 

Moreover, Microsoft has also upgraded the built-in curl command-line utility to version 8.21.0, which provides additional security features. In addition to reducing unnecessary notifications and taskbar badges, this update also disables automatic opening on hover, and provides more customization options for Widgets. There are several additional improvements to File Explorer, including quicker launch times, improved responsiveness, enhanced support for complex file paths, and new quick actions such as Open File Location and Ask Copilot for work and school accounts. 

Several additional features have been added to enhance accessibility, including a Screen Tint feature which reduces eye strain and improved Magnifier controls that provide the ability to set precise zoom levels for the Magnifier. 

A number of languages are now supported by Voice Access and Voice Typing, including French, German, and Spanish. These languages now support real-time grammar, punctuation, and recognition enhancements, enhancing dictation accuracy. In addition to improving connectivity and hardware reliability, the release also enhances Bluetooth performance by improving device pairing time, microphone synchronization, voice calls that are more reliable, and LE Audio accessory stability.

With networking enhancements, Wi-Fi crashes are reduced, VPN compatibility is improved, virtualization networks are strengthened, and network settings are preserved during operating system upgrades. The security of Remote Desktop (RDP) has also been enhanced by supporting SHA-2 certificate thumbprints for trusted RDP publishers, while maintaining SHA-1 only for backward compatibility. 

In order to reduce phishing risks and prepare for eventually terminating SHA-1 support, organizations are encouraged to migrate to stronger SHA-256 certificates and update Group Policy settings for Remote Desktop files. Furthermore, the cumulative update resolves a compatibility issue that was caused by the June 2026 security update, which prevented third-party applications using OLE Automation from launching Microsoft Office or opening Office files. 

A further step to strengthen network security was taken by Microsoft by implementing stricter registration requirements for Transport Driver Interfaces (TDI). This may affect applications that rely on unregistered third-party TDI transports. Additionally, improved HD Audio reliability, stability of the Start menu, graphics performance on multiple monitors, Windows Subsystem for Linux (WSL) network improvements, improved printer installation that uses the Internet Printing Protocol (IPP) by default, and enhanced touchpad customization options are also included. 

Microsoft has reported no known issues with this month's Patch Tuesday update, which makes it a relatively stable release in comparison with previous Patch Tuesday releases. Considering the large number of security fixes included, users are encouraged to install the updates immediately to ensure protection against recently disclosed vulnerabilities. Also included in this update is a minor modification to the handling of keyboard shortcuts in Windows by altering how hotkey cleanup is conducted. 

There is a possibility that, in rare cases, certain built-in Windows experiences may temporarily cease to respond to specific keyboard shortcuts after installation. Restarting the affected application should typically resolve the issue, and users may also report persistent problems through the Feedback Hub.

Patch Tuesday updates in July 2026 reinforce Microsoft's ongoing commitment to enhancing the security, stability, and user experience of Windows 11. Hundreds of vulnerabilities have been addressed along with new features and reliability enhancements. Users and organizations are encouraged to install the updates as soon as possible to ensure optimal protection.

Read more »
zero-day vulnerabilities
Microsoft July Patch Tuesday Microsoft Patch Tuesday Microsoft security updates Vulnerabilities and Exploits zero-day vulnerabilities

Microsoft Issues Record 622 Security Fixes in July Patch Tuesday, Urges Immediate Action on Two Exploited Zero-Day Flaws

 

Microsoft has rolled out its largest-ever Patch Tuesday update, addressing 622 vulnerabilities across its software ecosystem. The July release significantly surpasses June's update, which fixed around 200 vulnerabilities, making it the company's most extensive security update to date.

Among the fixes are two zero-day vulnerabilities that Microsoft confirmed are already being actively exploited. The flaws impact on-premises SharePoint Server and Active Directory Federation Services (AD FS), making them the highest-priority patches for organizations.

The first flaw, CVE-2026-56164, affects Microsoft SharePoint Server. According to Microsoft, attackers can exploit the vulnerability remotely to gain elevated privileges without requiring authentication, user interaction, or valid credentials. The company credited Mandiant's incident response team and Google's FLARE team for identifying the issue during active attacks, although it has not disclosed details about the threat actors or attack techniques involved.

Organizations running self-hosted SharePoint servers are advised to deploy the update immediately. Microsoft also noted that enabling Antimalware Scan Interface (AMSI) in Full Mode provides additional protection against exploitation. The timing is particularly significant as SharePoint Server 2016 and 2019 have reached the end of extended support, with no Extended Security Updates (ESU) program available for either version.

The second exploited vulnerability, CVE-2026-56155, impacts Active Directory Federation Services (AD FS). The flaw enables an authenticated attacker to elevate privileges locally due to weak access controls. Microsoft's Detection and Response Team (DART) discovered the issue. While Microsoft has not revealed how attackers are leveraging the flaw or the privileges it grants, AD FS plays a critical role in enterprise authentication by issuing security tokens across trusted environments, making the vulnerability particularly important.

Although neither of the two vulnerabilities has been added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of writing, Microsoft has already classified both as actively exploited. Security experts recommend organizations prioritize these patches without waiting for a KEV listing.

Microsoft also fixed CVE-2026-50661, a publicly disclosed vulnerability affecting BitLocker. The issue allows attackers with physical access to bypass BitLocker protections. Since the flaw cannot be exploited remotely, it is considered less urgent than the actively exploited zero-days but should still be addressed as part of routine patch management.

Another notable update addresses CVE-2026-55040, a SharePoint JWT authentication bypass vulnerability disclosed by Rapid7 Labs. Researchers demonstrated that the flaw could be chained with a separate remote code execution (RCE) vulnerability to achieve unauthenticated code execution on vulnerable servers. Microsoft has confirmed that the authentication bypass is fixed in July, while the associated RCE vulnerability is scheduled to receive a patch in August.

Kerberos RC4 Hardening Completed

The July release also marks the completion of Microsoft's long-running effort to phase out RC4 encryption within Kerberos authentication. The update removes the rollback mechanism that administrators had been using since January.

After installing the update, RC4 authentication will only function for accounts specifically configured to allow it. Organizations are advised to audit service accounts using Microsoft's RC4 audit events and rotate passwords where necessary so that modern AES encryption keys are generated before deploying the update. Failure to prepare legacy systems could lead to authentication failures after patching.

AI-Driven Security Research Expands Patch Volume

Microsoft previously indicated that customers should expect larger Patch Tuesday releases as artificial intelligence improves vulnerability discovery. In a July 9 announcement, the company said it anticipated a "higher volume of security updates included in each security release" due to AI-assisted security research.

The company highlighted its MDASH multi-model agentic scanning platform, which previously identified multiple vulnerabilities in earlier Patch Tuesday releases. However, Microsoft has not disclosed how many of July's 622 vulnerabilities were discovered using the system.

Faster Patching Becoming Increasingly Important

Security experts warn that the growing number of vulnerabilities makes traditional severity-based prioritization less effective. Once patches become publicly available, attackers can rapidly analyze them to develop exploits, significantly reducing the time organizations have to respond.

Rather than relying solely on CVSS scores, experts recommend prioritizing vulnerabilities based on active exploitation indicators, including Microsoft's exploited status, CISA's Known Exploited Vulnerabilities catalog, and Exploit Prediction Scoring System (EPSS) data.

Microsoft's July Patch Tuesday demonstrates how AI-driven vulnerability discovery is accelerating both defensive and offensive security efforts, making timely patch deployment increasingly critical for organizations.
Read more »
Subscribe to: Posts (Atom)