Microsoft's July 2026 Patch Tuesday: Record-Breaking 622 Flaws, Two Actively Exploited Zero-Days Addressed

Unprecedented Volume of Patches and Active Exploits

Microsoft's July 2026 Patch Tuesday delivered an unprecedented number of security updates, addressing a record 622 vulnerabilities across its products. This monumental release, which included 57 critical-severity flaws, notably fixed two zero-day vulnerabilities (CVE-2026-56155 and CVE-2026-56164) that are actively being exploited in the wild. The patches were released on July 14, 2026.

This significant increase in vulnerability discoveries is partly attributed to the growing role of Artificial Intelligence (AI) in finding and analyzing software defects. Microsoft stated that the pace of vulnerability discovery is accelerating due to advancements in AI. However, this also means attackers can more quickly devise exploits for known flaws.

Details of Actively Exploited Zero-Days

The two zero-day vulnerabilities under active exploitation pose serious threats:

• CVE-2026-56155: An elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS). This flaw could allow an authorized local attacker to elevate their privileges and gain administrative capabilities. Discovered by the Microsoft Detection and Response Team, this suggests the flaw surfaced during incident-response work.
• CVE-2026-56164: An elevation-of-privilege vulnerability affecting Microsoft SharePoint Server. This critical flaw allows an unauthenticated attacker to escalate privileges over the network without requiring any user interaction or credentials. It was reported by researchers from Mandiant Incident Response, Google Cloud, FLARE OTF, and an anonymous researcher.

In addition to these, Microsoft also addressed CVE-2026-50661, a publicly disclosed BitLocker security-feature bypass that requires physical access to the device to exploit, though Microsoft is not aware of active exploitation for this particular flaw.

Impact and Protection Measures

The active exploitation of these zero-day vulnerabilities means that organizations running unpatched versions of AD FS and SharePoint Server are at immediate risk of privilege escalation. Successful exploitation could lead to full system compromise, unauthorized data access, or further lateral movement within affected networks.

To protect against these critical threats, organizations and users must prioritize the following actions: 1. Immediate Patching: Apply the July 2026 Patch Tuesday updates without delay. Administrators running Active Directory Federation Services and on-premises SharePoint Server should consider these patches the most urgent. 2. Network Monitoring: Enhance monitoring for unusual activity, especially on systems running AD FS and SharePoint. Look for signs of unauthorized access attempts or suspicious privilege escalation. 3. Principle of Least Privilege: Ensure that users and services operate with the minimum necessary permissions to perform their tasks. This can limit the impact of successful privilege escalation attacks. 4. Multi-Factor Authentication (MFA): Implement and enforce MFA for all accounts, particularly those with administrative privileges, to add an extra layer of security against credential theft. 5. Regular Audits: Conduct regular security audits and penetration testing to identify and remediate potential vulnerabilities before attackers can exploit them. For AD FS specifically, review Microsoft's CVE-2026-56155 hardening recommendations which involve the access control list for the Distributed Key Manager container.

The sheer volume of vulnerabilities addressed this month highlights the ever-evolving threat landscape and the critical importance of timely patching and robust security practices.