← News
/DISPATCH · 2026-07-25

Microsoft July Patch Tuesday Hits Record: 622 CVEs, 2 In-the-Wild Zero-Days

Microsoft's July Patch Tuesday ships a record 622 CVE patches, including two actively exploited zero-days. SharePoint Server and AD FS flaws landed in CISA's KEV catalog; federal agencies must patch by July 17.

Incident Overview

On July 14, 2026, Microsoft shipped its largest monthly security update of the year, patching 622 vulnerabilities—the highest count in Patch Tuesday history. Two CVEs are confirmed under active exploitation: SharePoint Server authentication bypass (CVE-2026-56164) and Active Directory Federation Services privilege escalation (CVE-2026-56155). CISA added both to the Known Exploited Vulnerabilities (KEV) catalog and set federal civilian agency deadlines of July 17 and July 28 respectively.

In-the-Wild Zero-Day Details

CVE-2026-56164: SharePoint Server Authentication Bypass

Affects SharePoint Server 2016, 2019, and Subscription Edition. Microsoft classified it as CWE-306 (Missing Authentication for Critical Function). Unauthenticated attackers can trigger it remotely over the network and obtain elevated privileges. Microsoft's official CVSS is 5.3 (Medium); CISA and multiple vendors rate real-world risk as Critical—NVD scores it 9.8.

Researchers note CVSS at publication is theoretical and does not auto-update when exploitation is confirmed. That is why a 5.3 label coexists with confirmed in-the-wild attacks. CISA found attackers using the bug to steal IIS machine keys, establish persistence on compromised servers, and drop malware.

CVE-2026-56155: AD FS Privilege Escalation

Lives in Active Directory Federation Services. Microsoft scores it 7.8 (Important). An authenticated local attacker can elevate privileges. AD FS issues and validates login tokens for every connected app in the org. With admin rights, an attacker can forge tokens and impersonate any user in the federated domain, then move laterally with no second-factor check.

Other Critical CVEs

Beyond the two zero-days, this release includes multiple CVSS 9.8 remote code execution bugs:

Impact Assessment

The record patch volume reflects accumulated risk across Microsoft's product line. 622 CVEs span Windows, Office, Exchange Server, SQL Server, Azure, and multiple enterprise apps. For enterprise security teams, CVSS-only prioritization is breaking down—the two exploited bugs both score lower than several unexploited criticals.

Automox put it plainly: medium severity and in-the-wild exploitation are not the same thing. Do not let a 5.3 score drive priority.

Remediation

Immediate Actions

Patch Deployment

Deploy via Windows Update or download the matching build from Microsoft Update Catalog. If you cannot patch immediately:

References