Live Windows Security Brief for July 31, 2026: Microsoft Updates and Identity Risk

Live Windows and Microsoft security coverage for Patch Tuesday, identity systems, SharePoint, Exchange, endpoints, servers, and privilege exposure.

Microsoft estate view

Microsoft remediation should connect the Security Update Guide and active-exploitation signals to the specific products and builds deployed across endpoints, servers, identity platforms, and collaboration infrastructure.

For July 31, 2026, the lead development is CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability. Start by confirming where Microsoft SharePoint is deployed, who owns it, and whether the affected path is reachable. The remaining items below add the product-specific context needed to turn the headline into an owned security decision.

Windows and identity developments

CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CISA Known Exploited Vulnerabilities | July 22, 2026 | Known Exploited | Microsoft SharePoint

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

Why it matters: Microsoft SharePoint is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

CISA remediation date: 2026-07-25. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

NIST NVD and Microsoft | July 15, 2026 | CRITICAL | CVSS 9.9 | Microsoft Windows VMSwitch

Microsoft describes a network-reachable VMSwitch use-after-free that lets an authorized attacker elevate privileges. The Microsoft CNA rates it 9.9 Critical.

Why it matters: Microsoft Windows VMSwitch is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original NIST NVD and Microsoft record

CVE-2026-65590: N8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox…

NIST National Vulnerability Database | July 22, 2026 | CRITICAL | CVSS 9.8

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only…

Why it matters: CVE-2026-65590 is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original NIST National Vulnerability Database record

CVE-2026-54365: CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows…

NIST National Vulnerability Database | July 30, 2026 | HIGH | CVSS 8.7

Continue reading the full briefing.

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints to trigger InternalImportAdUserByUPN(), causing GladinetCloudMonitor.exe to invoke the NetUserAdd Windows API with…

Why it matters: CVE-2026-54365 is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original NIST National Vulnerability Database record

What’s new in Microsoft Security: July 2026

Microsoft Security Blog | July 30, 2026

This month’s updates help security and IT teams secure their AI environments, use AI to defend, and strengthen the foundations that AI-powered operations depend on. The post What’s new in Microsoft Security: July 2026 appeared first on Microsoft Security Blog.

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original Microsoft Security Blog record

Tame Dependabot: Group your updates, slow the cadence, keep security fast

GitHub Security Blog | July 29, 2026

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.

Why it matters: GitHub Security Blog participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original GitHub Security Blog record

Better security starts with better questions

Microsoft Security Blog | July 29, 2026

Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems. The post Better security starts with better questions appeared first on Microsoft Security Blog.

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original Microsoft Security Blog record

CVE-2026-65595: N8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to…

NIST National Vulnerability Database | July 22, 2026 | HIGH | CVSS 8.9

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token…

Why it matters: CVE-2026-65595 is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original NIST National Vulnerability Database record

Deployment plan

Connect each advisory to supported builds and deployed server roles. Identity and internet-facing systems should move before routine endpoint waves, with restart and EDR health verified afterward.

Match Microsoft and CISA records to Windows builds and server products in inventory.
Prioritize identity, SharePoint, Exchange, remote access, and domain-privileged systems.
Test monthly updates, install promptly, and validate reboot or service restart completion.
Review EDR health, tamper protection, authentication logs, and privileged group changes.
Give every patch exception a business owner, mitigation, and expiry date.

Endpoint and server checks

Check build numbers, installed updates, restart state, privileged authentication, EDR coverage, and server-role health.

Check supported builds, update installation, restart state, and the current running version.
Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.
Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Windows team takeaway

A successful Windows update cycle protects identity and public server roles first, proves the new build is active, and keeps every exception visible.

References used in this briefing

Microsoft estate view

Windows and identity developments

CVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

CVE-2026-65590: N8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox…

CVE-2026-54365: CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows…

​​​​What’s new in Microsoft Security: July 2026

Tame Dependabot: Group your updates, slow the cadence, keep security fast

​​Better security starts with better questions

CVE-2026-65595: N8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to…

Deployment plan

Endpoint and server checks

Windows team takeaway

Related briefings

Live Windows Security Brief for August 1, 2026: Microsoft Updates and Identity Risk

Live Windows Security Brief for July 30, 2026: Microsoft Updates and Identity Risk

Live Windows Security Brief for July 29, 2026: Microsoft Updates and Identity Risk

Need to add context to this briefing?

What’s new in Microsoft Security: July 2026

Better security starts with better questions