Cve 2026 50661
The latest Cve 2026 50661 coverage — news, analysis, and updates from the WindowsNews.AI desk.
Microsoft Fixes Excel Data Exposure Flaw—Update Now to Prevent Information Leaks
Microsoft's July 2026 security update fixes an out-of-bounds read vulnerability in Excel (CVE-2026-55046) that could leak sensitive data when users open malicious workbooks. The patch affects Excel on Windows, macOS, and Office Online Server. Home users should update immediately, while IT admins must inventory all Office deployments and apply the relevant KBs to prevent information theft.
Windows 11's New 72-Hour System Rollback: What KB5101650 Does (and Doesn't) Do
KB5101650 delivers Point-in-Time Restore to Windows 11, letting users revert their entire PC to a recent snapshot. While the feature offers a convenient recovery option for recent bad updates or changes, its 72-hour window and local storage mean it complements, rather than replaces, traditional backups. Home users should ensure BitLocker keys are accessible, while IT admins should prepare for manual enablement and post-rollback update runs.
Windows 11’s July update silences Widgets and adds point-in-time restore — what you need to know
Microsoft's July 2025 Patch Tuesday update, KB5101650, delivers point-in-time restore, a 35-day update pause, and a Widgets experience that stops annoying pop-ups. The update for Windows 11 24H2 and 25H2 also includes significant File Explorer reliability fixes, though it's temporarily blocked on some Dell PCs. Users should enable the restore feature carefully and test networking compatibility before deploying broadly.
Why a Vulnerability Disclosure Policy Isn't Enough: CISA and NSA Demand Full Programs
CISA and the NSA have released new guidance urging software vendors to establish comprehensive coordinated vulnerability disclosure programs, not just policy pages. For Windows administrators and enterprise buyers, this means critically evaluating whether vendors can actually triage, fix, and disclose vulnerabilities with proper CVE identifiers. Organizations should review their own internal processes or risk losing researcher trust and leaving customers exposed.
How Attackers Are Using Microsoft’s Own Login Page to Hijack Your 365 Account
A phishing kit called Jalisco is tricking Microsoft 365 users into approving device logins that belong to attackers, bypassing multi-factor authentication without stealing passwords. ReliaQuest researchers also identified a second kit, OmegaLord, that harvests passwords and phone numbers. Administrators can block the attack by disabling the OAuth device code flow with Conditional Access, restricting device registration, and updating incident response playbooks to remove persistent attacker artifacts.
Excel Memory-Disclosure Vulnerability Patched in Microsoft’s July 2026 Updates
Microsoft’s July 14, 2026 Office security updates fix CVE-2026-50408, an Important-rated Excel memory-disclosure vulnerability that can leak data when a user opens a malicious workbook. The out-of-bounds read bug affects nearly all current versions—including Microsoft 365 Apps, Excel 2016, Office 2019, Office LTSC, Office for Mac, and Office Online Server—and requires user interaction rather than a zero-click attack. While not under active exploitation, the broad impact and potential for confidential data exposure warrant prompt patching across all platforms, with specific build numbers and KBs provided for each edition.
Microsoft Patches SharePoint Server Spoofing Bug That Could Let Attackers Impersonate Trusted Content
Microsoft’s July 2026 SharePoint Server updates fix CVE-2026-55019, a cross-site scripting spoofing bug that exploits intranet trust. The vulnerability requires an authenticated low-privilege attacker and user interaction, but it can be weaponized for credential theft or social engineering. On-premises administrators must install cumulative patches and complete configuration steps to fully protect their farms.
Microsoft Patches SharePoint XSS Spoofing Flaw in July 2026 Update – Here’s How to Secure Your Farm
Microsoft's July 2026 security update addresses a cross-site scripting vulnerability (CVE-2026-55016) in on-premises SharePoint Servers that could let authenticated attackers spoof content. The flaw affects SharePoint 2016, 2019, and Subscription Edition. While rated Medium severity, its potential for convincing phishing within trusted corporate sites makes prompt patching essential. This article breaks down what changed, who's affected, and the exact steps administrators must take – including Workflow Manager prerequisites and post-install configuration – to fully secure their farms.
Microsoft Fixes Office RCE Bug CVE-2026-55017 — Update Now to Block Document-Based Attacks
CVE-2026-55017 is a critical remote code execution vulnerability in Microsoft Office, patched in July 2026. It requires user interaction to open a malicious document. This article explains what the flaw means, how to patch it, and steps to protect your systems.
CVE-2026-50467: How a 'Local' Office Bug Can Let Remote Attackers In
CVE-2026-50467, a patched Microsoft Office vulnerability, is labeled remote code execution despite having a local CVSS attack vector. Microsoft explains that 'remote' refers to the attacker's location while exploitation requires local document processing. This article clarifies the scoring terminology and emphasizes why the flaw still demands urgent patching, especially for users who handle untrusted Office files.
Office RCE Vulnerability CVE-2026-50301 Demands Immediate Update: How to Protect Your PC
Microsoft’s July 14, 2026 security update patches a critical heap overflow in Office (CVE-2026-50301) that enables remote code execution when a user opens a malicious file. All current Office versions are affected, including Office 2016, 2019, LTSC editions, and Microsoft 365 Apps. Immediate patching is essential; the article explains how to verify the fix and harden systems against document-based attacks.
Stop That Spreadsheet: Microsoft Fixes Excel's Memory Leak in July 2026 Update
Microsoft's July 14, 2026, security update closes CVE-2026-48580, an Excel vulnerability that could leak sensitive memory contents when a user opens a malicious spreadsheet. The flaw affects nearly all supported Office versions, from Excel 2016 to Microsoft 365 Apps, and requires immediate patching. There is no workaround, and IT admins should pay special attention to older Excel 2016 installations and often-overlooked Office Online Server.
Excel Security Alert: That 7.8-Rated Memory Bug Is Not a Network Attack, But You Must Patch Now (CVE-2026-47642)
CVE-2026-47642 is a use-after-free vulnerability in Microsoft Excel patched on July 14, 2026, with a CVSS score of 7.8. Though labeled Remote Code Execution, the attack requires local user interaction—typically opening a malicious file. All users and admins should update Office immediately across Windows, macOS, and Office Online Server to prevent potential system compromise.