Microsoft dropped its July 2026 Patch Tuesday update today, addressing 127 CVEs across Windows, Office, SharePoint, SQL Server, Visual Studio, and .NET. That number would be notable in any other year. In 2026, it is being described as a relative slowdown — June’s release set an all-time record with 206 CVEs. But “slowdown” does not capture what is actually in this month’s bundle: a fully wormable remote code execution vulnerability rated 9.8, the permanent end of Kerberos RC4 fallback support, an emergency patch from last week still being missed on unmanaged machines, and a security researcher who had threatened to release exploits today. The converging pressure is not typical.
CVE-2025-47981: The Vulnerability That Cannot Wait
The headline fix is CVE-2025-47981, a heap-based buffer overflow in the Windows SPNEGO Extended Negotiation (NEGOEX) security mechanism. The CVSS score is 9.8. No credentials are required. No user interaction is needed. The attack vector is the network. The vulnerability is wormable — meaning a single compromised host can autonomously spread to adjacent machines without any human involvement.
SPNEGO is the authentication negotiation layer that sits underneath Kerberos and NTLM. It is present and enabled by default on every supported Windows version from Windows 10 version 1607 and Windows Server 2008 R2 onward. That means the blast radius is essentially every Windows machine in existence that hasn’t yet received today’s update.
Saeed Abbasi, senior manager of security research at Qualys Threat Research Unit, was direct in his assessment: “A single unauthenticated NEGOEX packet can drop attacker-controlled code straight into LSASS, running as SYSTEM. No clicks, no creds needed — exactly the recipe that turns bugs into network worms. This isn’t just a bug — it’s a loaded gun pointed at your organization.” He recommended patching within 48 hours, prioritizing internet-facing assets, VPN endpoints, and anything connected to Active Directory.
Ben Harris, CEO of WatchTowr, went further: “Early analysis is suggesting that this vulnerability may be wormable — the sort of vulnerability that could be leveraged in self-propagating malware and make many revisit trauma from the WannaCry incident. Defenders need to drop everything, patch rapidly, and hunt down exposed systems.”
There is no known workaround. The only fix is applying the July 2026 cumulative update. Organizations that cannot patch immediately should, at minimum, disable “Allow PKU2U authentication requests” via Group Policy and block inbound traffic on ports 135, 445, and 5985 at the network edge.
Kerberos RC4 Is Gone — But Your Prep Work Matters Now
The July 14 cumulative update does something else significant: it permanently removes the RC4DefaultDisablementPhase rollback control from all supported Windows Server domain controllers. Since January 2026, Microsoft has been hardening Kerberos RC4 support incrementally, with organizations able to revert via a registry rollback key if legacy systems broke. That safety net disappears today.
Any service account that still relies on RC4 for Kerberos ticket requests may fail authentication the moment this update lands. The diagnosis is straightforward: Windows has logged RC4 usage events since January 2026 — nine specific audit events in the Windows System Event Viewer. The fix is equally clear: change the password on affected service accounts, which forces Windows to generate AES keys automatically.
The accounts most likely to cause problems at 2 AM are the ones least visible in normal monitoring: printers, third-party network appliances, and legacy systems that were never migrated off RC4 because they “just worked.” Those are the devices that now represent a real authentication outage risk. The time to audit them was before today. If that work hasn’t been done, it needs to happen in parallel with deployment — not after it.
Nightmare-Eclipse and the July 14 Threat
Adding an unusual layer of urgency to this month’s release is security researcher Nightmare-Eclipse, who has been in an escalating public conflict with Microsoft since April 2026. In that time, the researcher has publicly dropped six Windows zero-days: RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma. Microsoft reported the researcher to law enforcement. The researcher responded by threatening a “bone shattering” exploit dump timed to today, July 14 — the same day as Patch Tuesday.
As of yesterday, the threat was partially walked back. The researcher cited exhaustion from work on RoguePlanet (CVE-2026-50656), a Windows Defender privilege escalation flaw that was publicly disclosed last week and received an emergency out-of-band patch from Microsoft on July 9. The July 14 threat was not formally canceled.
The practical advice is simple: apply the July cumulative update as early as possible today, verify the July 9 emergency patch for RoguePlanet is in place across managed endpoints, and keep the Microsoft Security Response Center (MSRC) active in a browser tab. If new CVEs drop through an out-of-band release today, they will appear at msrc.microsoft.com within minutes.
Visual Studio, .NET, and Seven Developer CVEs
This month’s release includes seven Visual Studio CVEs alongside additional .NET SDK vulnerabilities. Developer workstations running Visual Studio on Windows are directly in scope. Windows Update on a workstation takes roughly fifteen minutes. The alternative — carrying known vulnerabilities in a development environment indefinitely — is not a defensible posture for most organizations.
The CVE Volume Problem Is Structural, Not Cyclical
July’s 127 CVEs is being framed in some coverage as a “return to normal.” That framing is misleading. The pre-2026 monthly average for Microsoft CVEs was well below 100. June 2026 set an all-time record at 206. July, at 127, is above every single pre-2026 monthly average. Microsoft has told customers directly to expect continued volume growth, citing AI-assisted vulnerability discovery as the driver.
Automated fuzzing, AI-powered static analysis, and variant hunting tools are now finding bugs faster than engineering teams can remediate them. FIRST, the vulnerability coordination body, forecasts 66,000 CVEs industry-wide for 2026. Microsoft alone is on track to patch over 1,000 vulnerabilities this year.
At this scale, the traditional approach of assessing every CVE individually against a CVSS threshold breaks down. A CVSS “High” or “Critical” classification sounds like an action signal — until you realize it describes 58% of all published CVEs. Treating 58% of the vulnerability universe as a priority is not a security program; it is noise.
The more practical approach is EPSS — the Exploit Prediction Scoring System — combined with CISA’s Known Exploited Vulnerabilities (KEV) catalog. EPSS calculates the probability a CVE will be exploited in the wild within the next 30 days. Research from FIRST shows that using a threshold of 0.088 captures 82% of CVEs that actually get exploited, while requiring action on just 7.3% of all published CVEs. The open-source CVE_Prioritizer tool automates the EPSS-plus-KEV workflow for teams that want to operationalize the approach.
This month’s EPSS triage is straightforward: CVE-2025-47981 is unconditional because it is wormable and will be weaponized within days of this release. CVE-2026-50656 (RoguePlanet) is also unconditional — the emergency patch has been available since July 9 and must be verified in place. The other 125 CVEs can flow through normal cumulative update deployment channels.
What to Do Today
The checklist for July 14 is short but not optional:
Audit Kerberos RC4 usage in the Windows System Event Viewer using the nine audit events added in January 2026. Change passwords on any service accounts flagged, which auto-generates AES keys. Apply the July cumulative update — this covers CVE-2025-47981 and the other 126 CVEs in the release. Verify the July 9 emergency patch for RoguePlanet (CVE-2026-50656) is confirmed installed across all endpoints. Update Visual Studio and .NET SDK installations on developer workstations. Monitor MSRC and security feeds throughout the day for any unscheduled out-of-band releases.
Three threats converged on a single Tuesday. None of them are optional, and none of them benefit from delay.
Sources: Microsoft MSRC, Qualys Threat Research Unit, WatchTowr, Silverfort, Help Net Security, Computer Weekly, ByteIota
