Microsoft has released its largest Patch Tuesday update on record, addressing 622 CVEs across its product portfolio.
The scale of the release is significant on its own, but the most urgent priority is clear: two vulnerabilities are already being exploited in attacks.
Both are elevation-of-privilege flaws affecting high-value enterprise infrastructure:
- CVE-2026-56164 in on-premises SharePoint Server
- CVE-2026-56155 in Active Directory Federation Services
Neither is the highest-scoring remote code execution issue in the release, but both affect systems that are extremely important to enterprise security: collaboration platforms and identity infrastructure.
The Two Zero-Days to Prioritize First
The first exploited vulnerability, CVE-2026-56164, affects SharePoint Server.
Microsoft says the flaw allows an unauthenticated attacker to escalate privileges over the network. That means no valid credentials and no user interaction are required.
For organizations running self-hosted SharePoint, this should be treated as a top-priority patch.
SharePoint remains a high-value target because it often contains sensitive documents, internal workflows, business records, and authentication-related material. Internet-facing SharePoint servers are especially exposed.
Microsoft also notes that enabling AMSI in Full Mode can help reduce the attack risk.
AD FS Flaw Is Also Being Exploited
The second exploited vulnerability, CVE-2026-56155, affects Active Directory Federation Services.
Microsoft describes it as a local elevation-of-privilege issue involving weak access controls. The attacker must already be authenticated, but the system involved makes this vulnerability especially important.
AD FS is trusted by the rest of the environment to issue and validate authentication tokens.
That means a privilege escalation issue on an AD FS server can have consequences far beyond the local machine. Even if the vulnerability is labeled “local,” defenders should not underestimate it.
Identity infrastructure should always be treated as critical infrastructure.
Severity Scores Are Not Enough
This Patch Tuesday is a strong reminder that severity scores should not be the only basis for patch prioritization.
The two exploited vulnerabilities are not necessarily the highest-profile critical bugs in the release. But they are already being used in attacks.
That makes them more urgent than many higher-scoring vulnerabilities that remain theoretical.
Security teams should prioritize using:
- known exploitation status
- exposure to the Internet
- business criticality
- identity or authentication impact
- exploitability in real environments
- vendor guidance
- KEV and threat intelligence signals
This month, “already exploited” matters more than the CVSS number.
Another SharePoint Issue Breaks an Attack Chain
SharePoint also received another notable fix: CVE-2026-55040, a JWT authentication bypass vulnerability.
Rapid7 disclosed the issue after research connected to Pwn2Own Berlin. The vulnerability can reportedly be chained with a separate remote code execution flaw to reach unauthenticated RCE against vulnerable SharePoint servers.
The RCE part of the chain is expected to be fixed later, but the July update breaks the authentication-bypass part.
That makes this patch important even if there is disagreement around the severity score.
In practical terms, defenders should treat SharePoint patching as urgent this month.
BitLocker Bypass Also Disclosed
A third zero-day, CVE-2026-50661, was publicly disclosed but is not currently reported as exploited.
This issue affects BitLocker and requires physical access to the device.
That means it is not a remote emergency for most organizations, but it still needs to be patched as part of normal endpoint hardening.
Physical-access vulnerabilities usually do not jump ahead of actively exploited remote or identity-related flaws, but they matter for high-risk devices, executives, travel laptops, and systems exposed to theft or tampering.
RC4 Kerberos Hardening May Break Logins
This Patch Tuesday also completes another important security change: Microsoft’s Kerberos RC4 hardening.
The July update removes the rollback switch that allowed administrators to delay the RC4 disablement phase.
After this update, RC4 will only work for accounts explicitly configured to allow it.
That can create operational problems.
If legacy service accounts still request RC4 Kerberos tickets, authentication may fail after patching.
Administrators should audit RC4 usage, identify affected service accounts, rotate passwords where needed so AES keys are generated, and fix legacy systems or configurations that still depend on RC4.
This is not the kind of issue that directly causes compromise, but it can cause outages if skipped.
Why This Patch Tuesday Is So Large
July is normally not the biggest month for Microsoft security updates, which makes this release especially notable.
The 622 CVEs span multiple product families, including:
- Windows
- Office
- Microsoft Edge
- Developer Tools
- SharePoint Server
- Azure
- SQL Server
- Defender
- Exchange Server
Windows accounts for the largest share, while SharePoint contains several high-priority issues. Microsoft Edge, Office, SQL Server, Defender, and Exchange also received important fixes.
The scale reflects a changing vulnerability landscape. More automated discovery, more researcher activity, and more AI-assisted analysis are increasing the number of vulnerabilities being reported and patched.
AI Is Changing Patch Management
Microsoft previously warned customers to expect higher volumes of security updates as AI-assisted discovery improves.
That creates pressure for defenders.
More vulnerabilities are being found, but attackers can also reverse-engineer patches faster. Once an update ships, threat actors can compare patched and unpatched versions to identify what changed and develop exploits.
The traditional approach of waiting a week before patching is becoming harder to justify for exposed or high-value systems.
Patch windows are shrinking.
For critical infrastructure, the gap between Patch Tuesday and attacker exploitation may now be measured in days, not weeks.
What Security Teams Should Do Now
Organizations should prioritize action around the exploited vulnerabilities first.
Immediate focus areas should include:
- patch on-premises SharePoint Server urgently
- patch AD FS systems quickly
- enable SharePoint AMSI Full Mode where applicable
- review SharePoint internet exposure
- monitor AD FS servers for suspicious local activity
- audit Kerberos RC4 usage before broad rollout
- patch BitLocker bypasses as part of endpoint maintenance
- review SharePoint logs and IIS activity
- monitor for privilege escalation attempts
- prioritize based on exploitation, not only CVSS
Teams should also revisit patch triage processes. A 600-plus CVE release cannot be handled effectively by severity score alone.
Final Thoughts
Microsoft’s July Patch Tuesday is not only large. It is also strategically important.
Two actively exploited privilege-escalation flaws affect systems that matter deeply to enterprise security: SharePoint and AD FS.
At the same time, SharePoint received another fix that breaks a serious authentication-bypass chain, while Kerberos RC4 hardening introduces operational risk for environments that still depend on legacy authentication.
Patch management is changing. Security teams need faster triage, better prioritization, and stronger focus on real-world exploitation.
In a month with more than 600 CVEs, the most important question is not “Which bug has the highest score?”
It is “Which bug is already being used, and which system gives attackers the most leverage?”
