高危保安警報 (A26-07-21): Microsoft 產品多個漏洞 (2026年7月)

描述:

Microsoft 發布了安全性更新，以應對影響數個 Microsoft 產品或元件的多個漏洞。有關安全性更新的列表，請參考以下網址:
https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul

有報告指權限提升漏洞 (CVE-2026-56155 及 CVE-2026-56164) 正受到攻擊。用戶應立即為受影響的系統安裝修補程式，以降低網絡攻擊的風險。

受影響的系統:

• Windows 10、11、11 版本 26H1
• Windows Server 2012、2012 R2、2016、2019、2022、2025
• Microsoft Office 2016、2019、LTSC 2021、LTSC 2024、LTSC for Mac 2021、LTSC for Mac 2024、Office 365 for Mac
• Office Online Server
• Microsoft Excel 2016
• Microsoft Word 2016
• Microsoft 365 Apps for Enterprise
• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition
• Microsoft SQL Server 2025
• Microsoft Visual Studio 2022、2026
• 安裝了 .NET 8.0、9.0 的 Linux、Mac OS、Windows
• 安裝了 .NET 10.0 的 Linux、Mac OS
• Microsoft .NET Framework 3.5、4.6.2、4.7、4.7.1、4.7.2、4.8、4.8.1
• Visual Studio Code
• Microsoft Copilot
• Microsoft Defender for Endpoint (Mac)

有關受影響系統的詳細資料，請參閱供應商網站的相應安全公告。

影響:

成功利用漏洞可以導致受影響的系統發生遠端執行程式碼、服務被拒絕、權限提升、泄漏資訊、繞過保安限制、仿冒詐騙或篡改，視乎攻擊者利用哪個漏洞而定。

建議:

受影響產品的修補程式可在 Windows Update 或 Microsoft Update Catalog 獲取。受影響系統的用戶應遵從產品供應商的建議，立即採取行動以降低風險。

進一步資訊:

• https://msrc.microsoft.com/update-guide/releaseNote/2026-Jul
• https://www.hkcert.org/tc/security-bulletin/microsoft-monthly-security-update-july-2026
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41109
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47642
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48580
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49178
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49183 (to CVE-2026-49184)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49787 (to CVE-2026-49788)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49796
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49798
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49800
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49803
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49805
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50297
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50299 (to CVE-2026-50302)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50304 (to CVE-2026-50305)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50310 (to CVE-2026-50314)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50317
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50321 (to CVE-2026-50323)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50326
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50329 (to CVE-2026-50330)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50332
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50334
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50336
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50339
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50341
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50343
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50345
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50347
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50352
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50355 (to CVE-2026-50357)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50359
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50363 (to CVE-2026-50364)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50370 (to CVE-2026-50373)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50375 (to CVE-2026-50376)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50378
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50380
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50382
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50384 (to CVE-2026-50385)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50394
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50401
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50405
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50407 (to CVE-2026-50408)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50411
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50413 (to CVE-2026-50414)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50417 (to CVE-2026-50418)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50422
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50427
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50430 (to CVE-2026-50433)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50437
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50440
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50445
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50447 (to CVE-2026-50449)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50452 (to CVE-2026-50453)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50456
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50458 (to CVE-2026-50459)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50461
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50463
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50467 (to CVE-2026-50469)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50471
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50477 (to CVE-2026-50478)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50482
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50484
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50489
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50493 (to CVE-2026-50495)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50498 (to CVE-2026-50500)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50502
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50505
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526 (to CVE-2026-50528)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646 (to CVE-2026-50649)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50657 (to CVE-2026-50659)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50661
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50665
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50667 (to CVE-2026-50670)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50681
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50684 (to CVE-2026-50686)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50688 (to CVE-2026-50690)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54115 (to CVE-2026-54116)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54124 (to CVE-2026-54125)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54128
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54131
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55018
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55022 (to CVE-2026-55023)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55025
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55033
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55037
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55039
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55041 (to CVE-2026-55042)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55044
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55046
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55050
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55053 (to CVE-2026-55055)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55057 (to CVE-2026-55058)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55121
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55130 (to CVE-2026-55131)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55137 (to CVE-2026-55138)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55145
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55898
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55949
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56156 (to CVE-2026-56157)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56173
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56182
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56184
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56189 (to CVE-2026-56190)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56192
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56648 (to CVE-2026-56650)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57084
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57087
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57090
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57093 (to CVE-2026-57096)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57982
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58538
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58541
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58594
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58628 (to CVE-2026-58629)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58638