Live Windows Security Brief for July 30, 2026: Microsoft Updates and Identity Risk

CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CISA Known Exploited Vulnerabilities | July 22, 2026 | Known Exploited | Microsoft SharePoint

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

Why it matters: Microsoft SharePoint is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

CISA remediation date: 2026-07-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-54366: CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that…

NIST National Vulnerability Database | July 30, 2026 | HIGH | CVSS 8.7

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file…

Why it matters: CVE-2026-54366 is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original NIST National Vulnerability Database record

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

NIST NVD and Microsoft | July 15, 2026 | CRITICAL | CVSS 9.9 | Microsoft Windows VMSwitch

Microsoft describes a network-reachable VMSwitch use-after-free that lets an authorized attacker elevate privileges. The Microsoft CNA rates it 9.9 Critical.

Why it matters: Microsoft Windows VMSwitch is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original NIST NVD and Microsoft record