Cve 2026 50673
The latest Cve 2026 50673 coverage — news, analysis, and updates from the WindowsNews.AI desk.
Patch Excel Immediately: Microsoft’s July 2026 Update Blocks a Remotely Delivered Code Execution Attack
Microsoft's July 2026 security update patches CVE-2026-55031, a remote code execution flaw in Excel that attackers can trigger by having victims open a malicious spreadsheet. Despite a “local” CVSS vector, the attack is remotely deliverable via email, cloud, or messaging. All supported Excel versions—including Microsoft 365, Excel 2016, Office for Mac, and Office Online Server—are affected, and users should install the patch immediately using KB5002886 or their Click-to-Run channel.
July 2026 Office Patch Fixes Heap Overflow That Could Let Attackers Execute Code on Your PC
Microsoft's July 2026 security updates fix a high-severity Office heap overflow (CVE-2026-55125) that could allow attackers to execute code after a user opens a malicious file. The flaw affects Office 2016 through LTSC 2024 and SharePoint Server deployments. Patch now, and use built-in safeguards like Protected View to reduce risk.
Patch Excel Immediately: The July 14 Update Closes a Code Execution Flaw (CVE-2026-55025)
Microsoft's July 14, 2026 Office updates fix a high-severity Excel remote code execution vulnerability (CVE-2026-55025) that allows attackers to take control of a PC via a malicious spreadsheet. The flaw affects all supported Excel versions and requires a user to open a crafted file. Patching immediately is essential, as built-in defenses like Protected View or disabling macros are not foolproof against this type-confusion bug.
Microsoft Fixes Office and SharePoint Bug That Could Expose Sensitive Data — Patch Now
Microsoft's July 14, 2026 security updates address CVE-2026-55023, an out-of-bounds memory read in Office and SharePoint that can locally expose sensitive data when a user opens a malicious file. While rated Medium severity, the flaw's high confidentiality impact and broad reach across subscription and perpetual Office, Mac, and three SharePoint Server generations make prompt patching a priority. Detailed fixed build numbers and actionable steps help home users, IT admins, and SharePoint managers close the hole.
Microsoft’s July 14 Office Update Seals Off a Type-Confusion Flaw That Could Execute Malicious Code
On July 14, 2026, Microsoft released a critical security update addressing CVE-2026-55022, a type confusion vulnerability in Microsoft Office that could enable remote code execution. The flaw impacts multiple Office versions on Windows and macOS, and while no active exploits were reported at launch, the potential for document-based attacks makes immediate patching essential. This article details the technical aspects, affected software, and step-by-step guidance for both home users and enterprise IT to secure their systems.
Microsoft Fixes Excel Data Exposure Flaw—Update Now to Prevent Information Leaks
Microsoft's July 2026 security update fixes an out-of-bounds read vulnerability in Excel (CVE-2026-55046) that could leak sensitive data when users open malicious workbooks. The patch affects Excel on Windows, macOS, and Office Online Server. Home users should update immediately, while IT admins must inventory all Office deployments and apply the relevant KBs to prevent information theft.
Windows 11's New 72-Hour System Rollback: What KB5101650 Does (and Doesn't) Do
KB5101650 delivers Point-in-Time Restore to Windows 11, letting users revert their entire PC to a recent snapshot. While the feature offers a convenient recovery option for recent bad updates or changes, its 72-hour window and local storage mean it complements, rather than replaces, traditional backups. Home users should ensure BitLocker keys are accessible, while IT admins should prepare for manual enablement and post-rollback update runs.
Windows 11’s July update silences Widgets and adds point-in-time restore — what you need to know
Microsoft's July 2025 Patch Tuesday update, KB5101650, delivers point-in-time restore, a 35-day update pause, and a Widgets experience that stops annoying pop-ups. The update for Windows 11 24H2 and 25H2 also includes significant File Explorer reliability fixes, though it's temporarily blocked on some Dell PCs. Users should enable the restore feature carefully and test networking compatibility before deploying broadly.
Why a Vulnerability Disclosure Policy Isn't Enough: CISA and NSA Demand Full Programs
CISA and the NSA have released new guidance urging software vendors to establish comprehensive coordinated vulnerability disclosure programs, not just policy pages. For Windows administrators and enterprise buyers, this means critically evaluating whether vendors can actually triage, fix, and disclose vulnerabilities with proper CVE identifiers. Organizations should review their own internal processes or risk losing researcher trust and leaving customers exposed.
How Attackers Are Using Microsoft’s Own Login Page to Hijack Your 365 Account
A phishing kit called Jalisco is tricking Microsoft 365 users into approving device logins that belong to attackers, bypassing multi-factor authentication without stealing passwords. ReliaQuest researchers also identified a second kit, OmegaLord, that harvests passwords and phone numbers. Administrators can block the attack by disabling the OAuth device code flow with Conditional Access, restricting device registration, and updating incident response playbooks to remove persistent attacker artifacts.
Excel Memory-Disclosure Vulnerability Patched in Microsoft’s July 2026 Updates
Microsoft’s July 14, 2026 Office security updates fix CVE-2026-50408, an Important-rated Excel memory-disclosure vulnerability that can leak data when a user opens a malicious workbook. The out-of-bounds read bug affects nearly all current versions—including Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC, Office for Mac, and Office Online Server—and requires user interaction rather than a zero-click attack. While not under active exploitation, the broad impact and potential for confidential data exposure warrant prompt patching across all platforms, with specific build numbers and KBs provided for each edition.
Microsoft Patches SharePoint Server Spoofing Bug That Could Let Attackers Impersonate Trusted Content
Microsoft’s July 2026 SharePoint Server updates fix CVE-2026-55019, a cross-site scripting spoofing bug that exploits intranet trust. The vulnerability requires an authenticated low-privilege attacker and user interaction, but it can be weaponized for credential theft or social engineering. On-premises administrators must install cumulative patches and complete configuration steps to fully protect their farms.
Microsoft Patches SharePoint XSS Spoofing Flaw in July 2026 Update – Here’s How to Secure Your Farm
Microsoft's July 2026 security update addresses a cross-site scripting vulnerability (CVE-2026-55016) in on-premises SharePoint Servers that could let authenticated attackers spoof content. The flaw affects SharePoint 2016, 2019, and Subscription Edition. While rated Medium severity, its potential for convincing phishing within trusted corporate sites makes prompt patching essential. This article breaks down what changed, who's affected, and the exact steps administrators must take – including Workflow Manager prerequisites and post-install configuration – to fully secure their farms.