Microsoft · Security update · July 14, 2026

KB5100985: July 2026 security update

KB5100985, released July 14, 2026, fixes 11 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0402
90th percentile

Priority of the 11 CVEs

Patch now 0 Urgent 0 High 10 Routine 1

Applies to

Product
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 3.5 on Windows Server 2012 R2 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
High CVE-2026-50646 .NET Framework Remote Code Execution 7.8 0.0402 Exploitation Less Likely
High CVE-2026-50649 .NET Remote Code Execution 7.8 0.0402 Exploitation Less Likely
High CVE-2026-50652 Azure Active Directory Denial of Service 7.5 0.0173 Exploitation Less Likely
High CVE-2026-47302 .NET Denial of Service 7.5 0.0117 Exploitation Less Likely
High CVE-2026-50525 .NET Denial of Service 7.5 0.0117 Exploitation Less Likely
High CVE-2026-50527 .NET Framework Denial of Service 7.5 0.0117 Exploitation Less Likely
High CVE-2026-50648 .NET Framework Denial of Service 7.5 0.0117 Exploitation Less Likely
High CVE-2026-50653 Azure Active Directory Denial of Service 7.5 0.0117 Exploitation Less Likely
High CVE-2026-50650 .NET Framework Elevation of Privilege 7.8 0.0046 Exploitation Less Likely
High CVE-2026-47304 .NET Security Feature Bypass 9.8 0.0029 Exploitation Less Likely
Routine CVE-2026-50659 .NET Spoofing 6.5 0.0074 Exploitation Less Likely
Showing 1 to 11 of 11 1