Microsoft's July security update addresses 622 vulnerabilities across its products, including a critical flaw in Microsoft 365 Copilot that could let an attacker gain higher-level access than they should have.
- What it is: Microsoft's monthly security update (Patch Tuesday) for July 2026, covering 57 critical and 511 important vulnerabilities across Windows, Microsoft 365, Exchange Online, and other products.
- Who is affected: Businesses using Microsoft 365, including Copilot and Exchange Online.
- What the risk is: Two flaws stand out for business users: a critical elevation-of-privilege bug in Microsoft 365 Copilot (CVE-2026-41106, rated 9.3) and a critical flaw in Exchange Online (CVE-2026-54998, rated 8.8). Both could let an attacker gain access beyond what they should have.
- What action is needed: Cloud services such as Microsoft 365 Copilot and Exchange Online are patched automatically by Microsoft, so no action is required for those. Windows devices should have updates installed as soon as they are available.
We recommend confirming with your IT provider that update management is in place across all your devices so nothing falls through the cracks.