Patch Tuesday - July 2026
2026-07-15T07:23:43Z•83702e176aa51a2e88357f20b8163a0a823e1da166acbb7bd43355999300bb49
authentication-bypasscisa-kevflowisejwtmetasploitmicrosoftpatch-tuesdayrapid7-labsrceremote-code-executionsharepointvulnerability-researchzero-day
What happened
Rapid7 reports on July 2026 Patch Tuesday (622 vulnerabilities total, 416 Windows) and highlights a critical SharePoint authentication bypass (CVE-2026-55040) discovered by Rapid7 Labs that allows unauthenticated attackers to bypass JWT validation and perform actions as site users/administrators (CVSSv3.1 9.1). The SharePoint bypass is part of a two-bug chain that leads to unauthenticated RCE (RCE component expected to be patched in August 2026). Rapid7 also notes Metasploit updates including an exploit module for Flowise CSV Agent unauthenticated RCE (CVE-2026-41264) and other new modules (Pé
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 83702e176aa51a2e88357f20b8163a0a823e1da166acbb7bd43355999300bb49
- Enrichment time
- 2026-07-15T07:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.