MicrosoftCVE-2026-55144

Microsoft Windows CryptoAPI: tampering

High7.1CVE-2026-55144 · Published Jul 14, 2026 · updated Jul 21, 2026

Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows 11 Version 24H2 Product	>= 10.0.26100.0, < 10.0.26100.8875	10.0.26100.8875
Windows 11 Version 25H2 Product	>= 10.0.26200.0, < 10.0.26200.8875	10.0.26200.8875
Windows 11 version 26H1 Product	>= 10.0.28000.0, < 10.0.28000.2525	10.0.28000.2525
Windows Server 2022 Product	>= 10.0.20348.0, < 10.0.20348.5386	10.0.20348.5386
Windows Server 2025 Product	>= 10.0.26100.0, < 10.0.26100.33158	10.0.26100.33158
Windows Server 2025 (Server Core installation) Product	>= 10.0.26100.0, < 10.0.26100.33158	10.0.26100.33158

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-325

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Jul 14	Secret exfiltration vulnerability HighJul 14 CVE-2026-472821.128.1	High	1.128.1
Jul 14	Workspace Trust Security Feature Bypass Vulnerability HighJul 14 CVE-2026-571011.128.1	High	1.128.1
Jul 14	Remote Code Execution Vulnerability HighJul 14 CVE-2026-571021.128.1	High	1.128.1
Jul 14	Microsoft .NET 8.0: unsafe deserialization High7.8Jul 14 CVE-2026-506498.0.29+9 more	High7.8	8.0.29+9 more
Jul 14	Microsoft .NET 8.0: code injection High7.8Jul 14 CVE-2026-506508.0.29+10 more	High7.8	8.0.29+10 more
Jul 14	Microsoft .NET 10.0: resource exhaustion High7.5Jul 14 CVE-2026-5065110.0.10+5 more	High7.5	10.0.10+5 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.