Microsoft has released its largest Patch Tuesday update ever, addressing 622 security vulnerabilities across its products. Among the fixes are two critical patches for vulnerabilities that attackers are already exploiting in the wild.
According to Microsoft’s Security Update Guide, the July release more than triples the previous monthly record of roughly 200 CVEs reported in June.
Security teams should prioritize two vulnerabilities immediately:
- CVE-2026-56164 — An elevation-of-privilege flaw affecting on-premises SharePoint Server
- CVE-2026-56155 — An elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS)
Although neither vulnerability is classified as a remote code execution flaw, both affect high-value enterprise infrastructure: the systems responsible for storing business documents and managing identity authentication.
Two Actively Exploited Vulnerabilities Need Immediate Attention
SharePoint Server Zero-Day — CVE-2026-56164
The most urgent issue affects Microsoft SharePoint Server.
Microsoft says CVE-2026-56164 is being actively exploited and allows an unauthenticated attacker to elevate privileges remotely over a network connection.
The vulnerability requires:
- No authentication
- No user interaction
- Remote access to the vulnerable server
Microsoft credited security researchers from Mandiant incident response and Google’s FLARE team for discovering the flaw, suggesting the issue was identified during active incident investigations.
Microsoft has not disclosed details about the attackers or the exact exploitation methods.
Organizations running self-hosted SharePoint should prioritize this update, especially because SharePoint Server 2016 and 2019 reach the end of extended support on the same day as this release.
Unlike some Microsoft products, these SharePoint versions do not have an Extended Security Updates (ESU) option available as a fallback.
Microsoft also recommends enabling AMSI in Full Mode on SharePoint servers as an additional defense measure.
SharePoint has remained a popular target for attackers, especially following previous exploitation campaigns involving vulnerable servers.
Active Directory Federation Services Zero-Day — CVE-2026-56155
The second actively exploited vulnerability affects Active Directory Federation Services (AD FS).
CVE-2026-56155 allows an authenticated attacker to gain elevated privileges locally due to weak access controls.
Microsoft credited its Detection and Response Team (DART) with discovering the issue.
While the flaw is classified as local privilege escalation, its impact can be significant because AD FS plays a central role in enterprise identity systems.
AD FS servers issue authentication tokens trusted by other services throughout an organization. Compromising such a system could provide attackers with access far beyond the affected machine.
Microsoft has not revealed the exact privileges gained through exploitation or how attackers are using the vulnerability.
Do Not Wait for a CISA Warning
As of the release date, neither CVE-2026-56164 nor CVE-2026-56155 appeared on CISA’s Known Exploited Vulnerabilities (KEV) catalog.
However, Microsoft has already confirmed active exploitation.
Security teams should not delay patching while waiting for additional listings. Microsoft’s exploited status is already sufficient reason to prioritize remediation.
Third Vulnerability Disclosed: BitLocker Bypass
A third notable vulnerability, CVE-2026-50661, was publicly disclosed but is not currently being exploited.
The issue affects BitLocker and requires physical access to the device.
Although it should still be patched, it is not considered an immediate remote threat.
The vulnerability continues a series of BitLocker-related bypass issues discovered earlier this year.
SharePoint Authentication Bypass Could Lead to Future RCE
Another significant SharePoint vulnerability addressed in this release is CVE-2026-55040, disclosed by Rapid7 Labs during its Pwn2Own Berlin research.
The flaw involves a JWT authentication bypass.
Rapid7 rated the issue at medium severity, while Zero Day Initiative (ZDI) assessed it as critical.
Researchers demonstrated that the authentication bypass could be combined with another remote code execution vulnerability to achieve unauthenticated RCE against vulnerable SharePoint servers.
The associated RCE vulnerability is not included in this month’s patch release and is expected to be addressed in August.
For now, fixing the authentication bypass breaks the attack chain.
Kerberos RC4 Support Finally Restricted
This Patch Tuesday also marks the completion of Microsoft’s long-running effort to eliminate outdated Kerberos RC4 encryption.
The update removes the RC4DefaultDisablementPhase rollback option, which administrators previously used to temporarily maintain compatibility.
After this change:
- RC4 authentication will only work for explicitly configured accounts.
- Legacy services relying on RC4 may experience authentication failures.
- Service accounts without modern encryption keys may stop working.
Microsoft recommends administrators:
- Review RC4 audit events.
- Identify affected service accounts.
- Reset passwords to generate AES keys.
- Deploy the security update.
Password rotation alone will not fix systems that are intentionally configured to require RC4.
Record Update Volume Across Microsoft Products
The July Patch Tuesday release affects nearly every major Microsoft product family.
| Product Family | CVEs | Key Issues |
|---|---|---|
| Windows | 416 | Includes AD FS zero-day and BitLocker bypass |
| Office | 82 | Includes Office 2016-related updates |
| Microsoft Edge | 46 | Includes Microsoft-specific fixes beyond Chromium updates |
| Developer Tools | 27 | Includes Visual Studio, VS Code, and GitHub Copilot issues |
| SharePoint Server | 17 | Includes exploited zero-day and authentication bypass |
| Azure | 11 | No urgent issues highlighted |
| SQL Server | 8 | Includes two RCE vulnerabilities |
| Defender | 5 | Includes critical RCE issues |
| Exchange Server | 5 | Includes high-impact Outlook Web Access XSS issue |
Microsoft counted 622 unique CVEs, while ZDI independently counted 621 vulnerabilities.
Why This Record-Breaking Release Matters
Microsoft warned customers ahead of time that security updates would increase in volume as artificial intelligence helps identify more vulnerabilities.
The company has been expanding automated security research efforts, including AI-assisted vulnerability discovery systems.
However, faster vulnerability discovery also creates challenges for defenders.
Once patches are released, attackers can analyze the differences between vulnerable and fixed software versions to develop exploits more quickly.
This reduces the traditional advantage organizations had from delaying updates for testing.
CVSS Scores Are Not Enough for Prioritization
This month’s release highlights why organizations should not rely only on severity scores.
Both actively exploited vulnerabilities are privilege escalation issues rather than high-profile remote code execution flaws.
Yet they affect critical enterprise systems and are already being used by attackers.
Security teams should prioritize vulnerabilities based on:
- Active exploitation status
- CISA KEV listings
- EPSS risk scores
- Vendor exploitation warnings
- Business impact
With Microsoft patch volumes continuing to grow, organizations need faster and more intelligence-driven vulnerability management processes.
