Microsoft’s Largest Patch Tuesday Ever Delivers a Record Vulnerability Load

Microsoft’s July 2026 Patch Tuesday is unprecedented by any measure. The company shipped fixes for a record vulnerability load that lands somewhere between 569 and 622 CVEs depending on how each vendor counts Windows-specific versus product-wide flaws, with Microsoft’s own tally reaching 622 across 154 security updates. Either figure roughly triples the previous record of 198 CVEs set only a month earlier in June, and the year-to-date total already exceeds every full-year total from the past two decades. The sheer volume is remarkable, yet defenders should resist the temptation to focus on the numbers alone.

Only two vulnerabilities deserve immediate emergency attention, because both are already being exploited in active attacks. They affect two of the most security-sensitive components in many enterprise environments, Microsoft SharePoint Server and Active Directory Federation Services. Both have already been added to CISA’s Known Exploited Vulnerabilities catalog with tight federal remediation deadlines, a detail that removes any ambiguity about how urgently they should be treated.

The release also highlights another emerging reality. As Microsoft increasingly relies on AI-assisted vulnerability discovery, Patch Tuesday is growing larger while attackers become faster at reverse-engineering patches into working exploits. Organizations that still wait days, or even weeks, before deploying updates are finding that their traditional testing windows are shrinking rapidly.

Two Actively Exploited Zero-Days Should Be Every Administrator’s First Priority

Unlike many Patch Tuesday releases dominated by high-scoring remote code execution vulnerabilities, July’s most dangerous flaws are privilege-escalation vulnerabilities. That distinction matters. Privilege escalation bugs often receive lower CVSS scores than remote code execution vulnerabilities, yet when they affect identity infrastructure or enterprise collaboration platforms, their operational impact can be significantly greater.

CVE-2026-56164, the SharePoint Server Zero-Day

The most urgent issue is CVE-2026-56164, an actively exploited elevation-of-privilege vulnerability affecting on-premises Microsoft SharePoint Server. Microsoft confirms the flaw stems from missing authentication for a critical function, allowing an unauthenticated attacker to remotely elevate privileges over the network without requiring credentials or user interaction. Microsoft assigns it a modest CVSS score of 5.3 and a Moderate severity rating, a number that could easily push it behind dozens of Critical and Important vulnerabilities in an automated patch queue. That would be a serious mistake. The Zero Day Initiative and multiple independent analysts have stressed the same point this month, which is that an unauthenticated, network-reachable flaw under active exploitation deserves emergency treatment regardless of its base score.

The vulnerability was credited to incident responders at Google Mandiant, Google Cloud’s Genwei Jiang, the FLARE team, and an anonymous researcher, a credit list that reads like the aftermath of a live incident and strongly suggests attackers were already abusing the weakness before a fix became available. Microsoft has not disclosed technical details of the exploit or attributed the attacks to a specific threat actor, but organizations running self-hosted SharePoint should treat this as an emergency patch. CISA has set a federal remediation deadline of July 17, 2026.

The timing is particularly significant because SharePoint Server 2016 and SharePoint Server 2019 reach the end of extended support with this release. Unlike Windows Server and SQL Server, neither version offers an Extended Security Update program, leaving unpatched systems permanently exposed. Affected products include SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

Microsoft also recommends enabling AMSI integration and setting the Request Body Scan mode to Full on SharePoint servers to reduce attack surface. That recommendation follows a year in which SharePoint remained one of the industry’s favorite targets after the widespread ToolShell exploitation campaigns that compromised thousands of Internet-facing servers throughout 2025.

CVE-2026-56155, the AD FS Privilege Escalation

The second actively exploited vulnerability, CVE-2026-56155, affects Active Directory Federation Services and carries a CVSS score of 7.8 with an Important severity rating. Unlike the SharePoint flaw, exploitation requires an already authenticated user with local access and low privileges. Microsoft attributes it to insufficient granularity of access control on AD FS and classifies it as a local elevation-of-privilege vulnerability.

On paper, that sounds less alarming. In practice, AD FS occupies one of the most trusted positions inside enterprise infrastructure. It signs the authentication tokens used throughout an organization’s identity ecosystem, so any compromise of that server potentially enables attackers to manipulate authentication flows, extend privileges, or maintain long-term persistence within the environment. It is exactly the kind of bug an intruder who is already inside a network uses to move sideways and upward, which is why the modest access requirement does little to reduce the real-world danger.

Microsoft’s Detection and Response Team discovered the vulnerability during incident response operations, further reinforcing that this is not a theoretical issue. Alongside the patch, Microsoft has begun hardening the Access Control List on the AD FS Distributed Key Manager container. CISA has set a federal remediation deadline of July 28, 2026.

Both zero-days now appear in CISA’s Known Exploited Vulnerabilities catalog, so organizations no longer face any judgment call about whether exploitation is real. The catalog listing, combined with Microsoft’s own exploited flag, makes prioritization straightforward for these two flaws even inside a release of this size.

A Publicly Disclosed BitLocker Bug and a Dangerous SharePoint Chain

Microsoft also patched a third zero-day, CVE-2026-50661, affecting BitLocker, with a CVSS score of 6.1. Unlike the first two vulnerabilities, this one was publicly disclosed but shows no evidence of active exploitation. Because a successful attack requires physical access to the target device, it presents considerably lower operational risk than the SharePoint and AD FS issues. Several researchers believe it is the fix for the bypass nicknamed GreatXML, and it continues a concerning trend of BitLocker bypass research following attacks such as Bitskrieg and YellowKey disclosed earlier this year.

Rapid7 Breaks a SharePoint Attack Chain

SharePoint administrators should also pay attention to CVE-2026-55040, a security-feature bypass in SharePoint’s authentication path discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer and published in coordination with Microsoft after Rapid7’s Pwn2Own Berlin research. The severity score depends on who you ask, with Rapid7 and Microsoft assessing it as medium at 5.3 while the Zero Day Initiative reads the release as Critical at 9.1.

The disagreement over scoring matters less than what the flaw enables. Rapid7 demonstrated chaining this bypass with a separate SharePoint remote code execution vulnerability to achieve unauthenticated compromise of a vulnerable server. Microsoft has already fixed the authentication bypass, but the remote code execution component of the chain remains embargoed and is not expected until August’s Patch Tuesday. Breaking one link effectively neutralizes the complete attack path, which makes July’s update substantially more valuable than its numerical severity score suggests.

It is worth noting that these are not the only SharePoint concerns this month. The release also fixes two unauthenticated remote code execution vulnerabilities, CVE-2026-50522 and CVE-2026-58644, each rated CVSS 9.8, which combine with the exploited zero-day to make on-premises SharePoint arguably the single most urgent patch unit in the entire release.

The Highest-Severity Flaw Sits Outside the Exploited Trio

While the exploited zero-days dominate the triage conversation, the month’s highest CVSS score belongs to CVE-2026-57092, a Windows VMSwitch elevation-of-privilege vulnerability rated 9.9. It is a use-after-free flaw that allows a low-privileged attacker inside a guest virtual machine to escalate all the way to full host compromise across the virtualization boundary. Organizations running Hyper-V with VMSwitch, which is nearly all of them, should test and deploy this fix quickly, since a guest-to-host escape places the virtualization host ahead of the guests it carries.

Kerberos RC4 Finally Reaches End of Life

Beyond vulnerability fixes, July also completes Microsoft’s multi-year effort to eliminate RC4 encryption from Kerberos authentication. The update permanently removes the RC4 rollback option that administrators have relied upon since Microsoft’s staged deprecation began in January. After installation, RC4 authentication will function only for accounts explicitly configured to allow it.

Organizations that still maintain legacy service accounts using RC4 should expect authentication failures immediately after deployment unless preparation has already been completed. Microsoft recommends a straightforward sequence. Administrators should first audit RC4 usage using the Kerberos audit events introduced earlier this year, then rotate passwords for affected service accounts so that Windows generates AES encryption keys, and only then apply the July updates once remediation is complete.

This change is unlikely to create a security incident, but it can certainly create an operational one. Environments that skip the audit phase may discover broken services immediately after patch deployment.

Why Did July Suddenly Become Microsoft’s Biggest Patch Tuesday?

Historically, July has been among Microsoft’s quieter Patch Tuesday releases. This year was very different. The increase was not entirely unexpected, because several days before release Microsoft warned customers that future Patch Tuesdays would contain substantially larger numbers of vulnerabilities as artificial intelligence becomes integrated into internal security research. Microsoft vice president of engineering Tom Gallagher first signaled the shift in May, cautioning that customers would see a higher volume of security updates in each release.

One driver is MDASH, Microsoft’s multi-model agentic vulnerability discovery harness, which is being used to identify vulnerabilities faster than manual research allows. Microsoft has not disclosed how many of July’s fixes originated from AI-assisted discovery, but the concentration of flaws tells its own story. The bulk of the release lands in Windows, which accounts for roughly 416 CVEs, followed by Office, Microsoft Edge, developer tools including Visual Studio and GitHub Copilot, and SharePoint Server. Analysts also noted an unusually large cluster of filesystem-driver bugs, with roughly fourteen NTFS and seven ReFS remote code execution flaws suggesting a shared root cause.

Microsoft has simplified its Security Update Guide in step with this growth. The guide no longer enumerates individual CVEs at all, presenting instead a summary table of vulnerability counts by product family alongside a slimmer Notable CVEs section, a change that itself illustrates the industry-wide trend of exploding vulnerability counts.

AI Is Changing Both Defense and Offense

Artificial intelligence is helping vendors discover vulnerabilities faster, but it also helps attackers analyze patches faster. Once Microsoft publishes a fix, adversaries increasingly use automated binary comparison techniques to identify exactly what changed, reconstruct the underlying vulnerability, and develop exploits before many organizations complete compatibility testing. The traditional practice of waiting several days before deployment continues to lose effectiveness, and security teams increasingly refer to the day immediately following Patch Tuesday as Exploit Wednesday to reflect how quickly proof-of-concept exploits can emerge.

As patch releases climb into the hundreds of vulnerabilities, CVSS scores alone also become far less useful for prioritization. This month’s two most dangerous vulnerabilities demonstrate the problem perfectly. Neither carries a spectacular 9.8 rating, and neither is a classic remote code execution flaw, yet both are already being exploited in real environments because they target high-value infrastructure that attackers routinely seek to compromise.

Effective patch prioritization now requires combining multiple signals, including Microsoft’s exploitation indicators, CISA’s KEV catalog, EPSS probabilities, asset criticality, and evidence of active attacks, rather than relying exclusively on severity scores. Industry voices this month went further still, with several researchers arguing that the monthly patch cycle itself was designed for a world where vulnerability discovery happened at human speed, and calling for a shift toward continuous, adaptive patching.

Why File-Based Prevention Still Matters

Although Patch Tuesday focuses on fixing vulnerabilities after discovery, most successful compromises still require an initial delivery mechanism. SharePoint attacks frequently begin after adversaries obtain an initial foothold through phishing emails, malicious Office documents, archive files, ISO images, or other weaponized content that establishes persistence before privilege escalation occurs. Once attackers gain access, vulnerabilities like the SharePoint and AD FS zero-days become powerful tools for expanding control across the environment.

This is where Content Analysis, Disarm and Reconstruction technologies such as FileDNA CADR complement traditional patch management. Instead of relying solely on vulnerability remediation after software is installed, CADR analyzes incoming files, removes embedded active content, scripts, exploit-bearing structures, and malicious payloads, then reconstructs a clean version before it reaches users or internal collaboration platforms.

Patching remains essential because software flaws will always exist. Reducing the number of weaponized files that ever enter the enterprise, however, significantly decreases the opportunities attackers have to establish the foothold required to exploit newly disclosed vulnerabilities. In an era where AI is accelerating both vulnerability discovery and exploit development, combining rapid patching with upstream file sanitization gives organizations a stronger and more resilient defensive posture.

References