July 2026 Third-Party Vulnerabilities and Patches 

July 2026 was the most active month we have recorded so far, passing the previous high set in June. During the month, we identified 1,539 unique vulnerabilities across 108 applications, and vendors released 160 patched versions to fix them. This keeps up the steep upward trend we have seen all through 2026. June had already stood out as an outlier at 1,302 vulnerabilities, and July pushed the number even higher, about 18% more month over month. What changed was the shape of the increase. In June the vulnerability count jumped sharply while the number of affected applications stayed fairly flat. In July the count rose more gently, but the range of affected applications grew a lot, going from 83 to 108, even though the number of released patches stayed almost the same. 

Just like in recent months, most of this activity comes from the large, coordinated security releases that Chromium-based browsers ship. Browser-related products made up roughly 70 percent of all the vulnerabilities we saw during the month, or 1,074 out of 1,539. Google Chrome, Microsoft Edge, and Brave each shipped a single version that fixed somewhere between 330 and 385 vulnerabilities, with Chrome 150 and 151, Edge 150 and 151, and Brave 1.93 being the biggest updates. Because Chromium fixes flow down into the browsers built on top of it, including Microsoft Edge, Brave, Opera, and Vivaldi, one upstream release can spread hundreds of the same fixes across several products and release channels. So these numbers say more about how Chromium coordinates its patching than about hundreds of separate findings. What really sets July apart is how widely the vulnerabilities were spread. Browsers still drove most of the raw count, but this month the activity reached across a much wider part of the catalog, which is why the number of affected applications climbed by roughly 30%. 

Notable vulnerabilities in July third-party patches 

The vulnerabilities below stand out either because a working exploit already exists or because they carry an elevated EPSS score above 0.1. Both of these raise the odds of real-world abuse and shorten the time you have to patch safely, so they are the ones worth prioritizing this month. 

CVE-2026-63077 is a critical unauthenticated remote code execution vulnerability in JetBrains TeamCity, which appears directly in the Application Workspace catalog. The flaw is in the agent polling protocol and lets an attacker run arbitrary code on the server without any authentication, which in practice can mean full control of the build environment. It carries a CVSS score of 9.8, a known exploit already exists, and it has been added to CISA’s Known Exploited Vulnerabilities catalog. The issue affects TeamCity versions before 2026.1.3 and 2025.11.7. Because build servers often hold credentials and can push code straight into production, this one deserves immediate attention. More information is available in the JetBrains security advisory and CISA’s KEV entry. 

Two related vulnerabilities in the Apache HTTP Server reach the catalog through VisualSVN Server, which bundles Apache httpd to serve repositories over HTTP. CVE-2026-23918 is a high severity double free in HTTP/2 request handling that can lead to remote code execution or denial of service. It stands out because it has a public exploit and an elevated EPSS score of about 0.50, one of the highest we saw this month. CVE-2026-49975 is a closely related HTTP/2 issue in the same server that lets a remote attacker trigger a denial of service through memory allocation and compression bomb techniques. It does not yet have a public exploit, but its EPSS score of roughly 0.28 is still high enough to take seriously. Both are a good reminder of how a flaw in a widely reused component can quietly affect a higher-level product that most people would not immediately connect to Apache. Anyone running VisualSVN Server should update to a build that ships the patched Apache version. Further details are available in the Apache HTTP Server advisories and the matching NVD entries: NVD – CVE-2026-23918 and NVD – CVE-2026-49975. 

CVE-2026-58289 is a critical type confusion vulnerability in Chromium based Microsoft Edge that allows a remote attacker to execute code over the network. Microsoft has confirmed that a known exploit exists. As with any Chromium issue, the same weakness can reach other browsers built on the same engine until each one ships its own update, so the practical advice is to make sure Edge and any related browsers are fully up to date. More information can be found on MSRC. 

Finally, CVE-2026-11645 makes a return appearance. This is the out of bounds read and write vulnerability in Chrome’s V8 JavaScript engine that we covered last month, and it allows arbitrary code execution through a crafted web page. It is still listed in CISA’s KEV catalog and a working exploit exists. It surfaces again this month because it now shows up through Burp Suite, which embeds a Chromium-based browser for its built-in testing tools. Its EPSS score remains low at about 0.02, but the confirmed real-world exploitation is the reason it still earns a mention. More information on CISA’s KEV article. 

Browser security updates in July 2026 

Browser updates were once again the biggest driver of vulnerability activity in July, following the same pattern we have seen throughout the year. The table below breaks the counts down by browser. Microsoft Edge led the way with 777 vulnerabilities addressed across six updates, followed by Google Chrome and Brave Browser, which each fixed 435 vulnerabilities over six releases. Vivaldi added another 142 across two updates. Because all four of these browsers are built on Chromium, most of these fixes trace back to the same upstream security releases, so the counts are better read as one coordinated patching effort than as separate findings. Mozilla-based browsers were much quieter by comparison. Mozilla Firefox fixed 62 vulnerabilities across two updates, and its 115 and 140 branches each handled 32 more. Waterfox, which is also built on Firefox, remediated another 32. Put together, these browser numbers make up the large majority of everything disclosed this month, which is why a single busy month for Chromium can move our totals so sharply. 

Microsoft product updates included in July 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft Edge for Business 
• Microsoft Edge Beta 
• Microsoft 365 Apps 
• Microsoft Visual Studio Code 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft Visio 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft .NET Runtime 9.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft .NET Runtime 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 

Detailed list of July third-party patches