Microsoft shipped its largest Patch Tuesday on record today. The July 2026 release patches an unprecedented 622 CVEs across Windows, Office, Edge, SharePoint, Azure, SQL Server, and more. Two of those fixes close zero-day vulnerabilities that attackers are already exploiting in the wild.
What Happened: Microsoft Fixes Record 622 Flaws as Attackers Exploit SharePoint and AD FS Zero-Days
Microsoft’s July 2026 Patch Tuesday is the largest in the company’s history. The Security Update Guide lists 622 CVEs fixed today alone, more than triple June’s already elevated count of roughly 200 flaws. Among them are two actively exploited elevation-of-privilege vulnerabilities: one in on-premises SharePoint Server and another in Active Directory Federation Services (AD FS).
The SharePoint flaw, tracked as CVE-2026-56164, allows an unauthenticated attacker to escalate privileges over the network without credentials or user interaction. Microsoft credited Mandiant’s incident responders and Google’s FLARE team for the discovery, a strong signal that the bug was found during active incident response.
The second zero-day, CVE-2026-56155, affects AD FS. It allows an already-authenticated attacker to elevate privileges locally through weak access controls. Microsoft’s own Detection and Response Team (DART) discovered this flaw during an active engagement.
Technical Details of the July 2026 Patch Tuesday Zero-Days
SharePoint Server: Unauthenticated Privilege Escalation (CVE-2026-56164)
CVE-2026-56164 stems from missing authentication for a critical function in Microsoft Office SharePoint Server. An unauthorized attacker can exploit this flaw remotely to gain elevated privileges over the network. Microsoft has not disclosed how the vulnerability was exploited in the wild, but the credited researchers point to active attacker use.
Furthermore, Microsoft noted that enabling the Antimalware Scan Interface (AMSI) on the server and setting Request Body Scan mode to Full can help mitigate this attack. SharePoint has remained a high-value target since the ToolShell chain tore through unpatched servers in 2025, and attackers continue to find new ways to abuse it.
Today’s patch also includes fixes for 17 other SharePoint Server vulnerabilities, including a critical remote code execution bug, CVE-2026-50522, rated 9.8. Additionally, Rapid7 Labs disclosed CVE-2026-55040, a JWT authentication bypass they built for Pwn2Own Berlin. The remote code execution half of that chain is scheduled for an August fix.
Active Directory Federation Services: Local Privilege Escalation (CVE-2026-56155)
CVE-2026-56155 exists in Active Directory Federation Services due to insufficient granularity of access controls. An authorized attacker who already has access can exploit this flaw locally to gain administrative privileges. AD FS is the identity system that issues tokens for the rest of the enterprise. Consequently, a privilege escalation on this host can cascade across the entire trust boundary.
Neither CVE-2026-56164 nor CVE-2026-56155 appears on CISA’s Known Exploited Vulnerabilities catalog yet. However, Microsoft’s own exploitability assessment already marks both as actively exploited. Therefore, waiting for a KEV listing before patching is a dangerous delay.
Publicly Disclosed BitLocker Bypass (CVE-2026-50661)
A third zero-day was publicly disclosed but is not under active attack: CVE-2026-50661, another BitLocker bypass that requires physical access to the target device. An attacker with physical access could exploit this flaw to access encrypted data. While not a remote threat, it continues a string of BitLocker bypasses seen throughout 2026 and should be patched during normal maintenance windows.
Business and Operational Impact
The record size of this Patch Tuesday carries operational consequences beyond the zero-days themselves. Organizations must plan for an unusually large testing and deployment cycle across a massive surface area of affected products.
- Windows: 416 CVEs fixed, including the AD FS zero-day and the BitLocker bypass.
- Office: 82 CVEs fixed (Microsoft also lists these under a separate Office 2016 track).
- Microsoft Edge: 46 CVEs fixed, with ZDI counting 21 as Microsoft’s own rather than Chromium re-listings.
- Developer Tools: 27 CVEs across Visual Studio, VS Code, and GitHub Copilot, mostly injection and path traversal flaws.
- Azure: 11 CVEs fixed.
- SQL Server: 8 CVEs, including a pair of remote code execution flaws rated 8.8.
- Defender: 5 CVEs, including two Critical remote code execution bugs.
- Exchange Server: 5 CVEs, including a stored cross-site scripting flaw in Outlook Web Access rated 9.6.
Moreover, this update removes the RC4DefaultDisablementPhase rollback switch that admins have used since January. After this patch, RC4 Kerberos tickets will fail unless accounts are explicitly configured to allow them. Service accounts without AES keys will break authentication immediately upon update.
Mitigation and Recommendations
Immediate Actions for Defenders
- Patch CVE-2026-56164 first. If you run self-hosted SharePoint Server, apply the July updates immediately. This flaw requires no credentials and no user interaction.
- Patch CVE-2026-56155 second. Update AD FS servers next. An authenticated attacker with local access can escalate to administrative privileges.
- Enable AMSI Full Mode on SharePoint. Turn on Antimalware Scan Interface and set Request Body Scan mode to Full for additional mitigation against CVE-2026-56164.
- Audit RC4 usage before patching Windows. Review RC4 audit events added in January. Rotate passwords on flagged service accounts so Windows generates AES keys before applying the update.
- Plan for the August SharePoint RCE fix. Rapid7’s JWT bypass chain has an unpatched remote code execution component coming in August. Test your patching pipeline now.
Additional Considerations
Also, organizations running SharePoint Server 2016 or 2019 should note that today marks the end of extended support for both versions. Unlike Windows Server or SQL Server, neither has a paid Extended Security Updates program available. Migration planning should begin immediately if not already underway.
For the BitLocker bypass, patch during your next scheduled maintenance window. It requires physical access and is not a remote emergency. However, if your threat model includes insider or physical-access scenarios, prioritize accordingly.
Bottom line: Prioritize the two actively exploited zero-days in SharePoint Server and AD FS before anything else. Patch Windows broadly, but audit RC4 Kerberos usage first to avoid authentication failures. The sheer volume of fixes this month demands careful sequencing and testing.
Incident Summary
| CVE ID / Incident: | CVE-2026-56164 (SharePoint Server) and CVE-2026-56155 (AD FS) |
| Affected Systems: | Microsoft Office SharePoint Server, Active Directory Federation Services, Windows |
| Disclosure Date: | July 15, 2026 |
| Patch Status: | Patches available via July 2026 Patch Tuesday |
References
- BleepingComputer, “Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days,” July 15, 2026, https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/, accessed July 15, 2026.
- The Hacker News, “Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack,” July 15, 2026, https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html, accessed July 15, 2026.
- Microsoft Security Response Center, “CVE-2026-56164,” July 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164, accessed July 15, 2026.
- Microsoft Security Response Center, “CVE-2026-56155,” July 2026, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155, accessed July 15, 2026.
- Rapid7, “CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass,” July 14, 2026, https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/, accessed July 15, 2026.
