Microsoft July Patch Tuesday Fixes 570 Vulnerabilities: 3 Zero-Days, Critical DHCP Server RCE

Microsoft released July security updates patching a record 570 vulnerabilities, 59 of them Critical. The update includes 3 zero-days, 2 of which were exploited in the wild.

On July 15, 2026, Microsoft released July security updates patching a record 570 vulnerabilities, 59 of them Critical. The update includes 3 zero-days, 2 of which were exploited in the wild. Microsoft said the unprecedented volume is partly due to its recently deployed AI-driven vulnerability discovery system.

Incident Overview

This Patch Tuesday covers multiple critical components across the Microsoft ecosystem. Vulnerability breakdown:

• Privilege Escalation: 254
• Remote Code Execution: 145
• Information Disclosure: 102
• Denial of Service: 35
• Security Feature Bypass: 17
• Spoofing: 16

Critical-severity issues include 48 RCE, 9 privilege escalation, 1 security bypass, and 1 spoofing vulnerability. There are also 468 Microsoft Edge/Chromium-related vulnerabilities.

Technical Details

Zero-Day Vulnerabilities

CVE-2026-56155: Active Directory Federation Services Privilege Escalation

• CVSS: 7.8
• Status: Exploited in the wild
• Description: Insufficient access-control granularity in AD FS allows an authenticated attacker to escalate privileges locally
• CISA deadline: July 28, 2026

CVE-2026-56164: Microsoft SharePoint Server Privilege Escalation

• CVSS: 8.8
• Status: Exploited in the wild, added to CISA KEV
• Description: Missing authentication for a critical function; an unauthenticated attacker can escalate privileges over the network
• CISA deadline: July 17, 2026
• Temporary mitigation: Enable AMSI, set Request Body Scan to Full mode

CVE-2026-50661: Windows BitLocker Security Feature Bypass

• CVSS: 6.1
• Status: Publicly disclosed, not yet exploited
• Description: An attacker with physical access to the device can use a crafted boot medium to bypass BitLocker disk-encryption verification

Key High-Severity Vulnerabilities

| CVE | Component | CVSS | Type |
|-----|-----------|------|------|
| CVE-2026-57092 | Windows VMSwitch | 9.9 | Privilege Escalation |
| CVE-2026-56190 | Remote Desktop Protocol | 9.8 | RCE |
| CVE-2026-50518 | Windows DHCP Server | 9.8 | RCE |
| CVE-2026-50522 | SharePoint Server | 9.8 | RCE |
| CVE-2026-58644 | SharePoint Server | 9.8 | RCE |
| CVE-2026-56188 | Windows Server Network Driver | 9.8 | RCE |
| CVE-2026-55008 | Exchange Server | 9.6 | Spoofing/XSS |

Of particular note:

• CVE-2026-57092: Use-after-free in VMSwitch allows a low-privilege attacker to cross the VM boundary and gain full host control. ZDI noted a similar exploit was demonstrated against ESXi at Pwn2Own Berlin.
• CVE-2026-50518: Heap overflow in Windows DHCP Server; an unauthenticated attacker can execute code over the network. Several other DHCP-related vulnerabilities were also patched this month.
• CVE-2026-50522/CVE-2026-58644: Deserialization RCE in SharePoint Server; Microsoft assesses Exploitation More Likely. A working exploit for CVE-2026-50522 was demonstrated at Pwn2Own Berlin.

Impact Assessment

This Patch Tuesday far exceeds typical volume. 570 vulnerabilities set a new Microsoft record for patches in a single month. Microsoft attributes this to its AI-driven vulnerability discovery system, used to proactively scan the Windows codebase and find bugs ahead of threat actors.

July Patch Tuesday also marks end of support for SharePoint Server 2016 and 2019. Organizations on those versions must migrate immediately to Subscription Edition or another alternative.

Remediation Guidance

Prioritization

• Immediately patch the 2 zero-days already exploited in the wild (CVE-2026-56155 and CVE-2026-56164)
• Prioritize Critical RCE with CVSS ≥ 9.8, especially DHCP Server and SharePoint
• Apply the VMSwitch patch in Hyper-V environments (CVE-2026-57092)
• Ensure Exchange Server has the XSS fix applied (CVE-2026-55008)

Special Notes

• Organizations with internet-facing Remote Desktop servers should patch CVE-2026-56190 immediately
• Prioritize the BitLocker bypass patch for devices that leave the enterprise perimeter
• Check SmartConsole audit logs for Authentication method: application token entries

References

• Microsoft Security Update Guide
• Tenable: Microsoft July 2026 Patch Tuesday Analysis
• Kaspersky: July Patch Tuesday Deep Dive
• Qualys: July 2026 Security Update Review
• Lansweeper: July 2026 Patch Tuesday Report