Microsoft’s July 2026 Patch Tuesday is the largest in the company’s history, addressing a record-breaking 570 vulnerabilities across Windows, Office, SharePoint, Active Directory, SQL Server, Exchange, and more. Two of those vulnerabilities, CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in Microsoft SharePoint Server, were actively exploited in attacks before today’s patches were available. A third zero-day, CVE-2026-50661, a Windows BitLocker security feature bypass, was publicly disclosed before being patched. Microsoft attributed the explosion in patch volume to the deployment of an AI-powered vulnerability discovery system across its Windows codebase, after warning last week that patch volumes would increase as a result. The 570 count excludes a further 468 Microsoft Edge and Chromium flaws patched by Google this month and ported to Edge. The directive is clear: this is not a Patch Tuesday to defer.

Facts

Field	Detail
Total CVEs patched	570 (record-breaking; excludes 468 Edge/Chromium flaws patched separately)
Critical CVEs	59 (48 RCE, 9 Elevation of Privilege, 1 Security Bypass, 1 Spoofing)
Zero-days	3 total: CVE-2026-56155 (AD FS EoP, exploited), CVE-2026-56164 (SharePoint EoP, exploited), CVE-2026-50661 (BitLocker bypass, publicly disclosed)
Largest CVE categories	254 Elevation of Privilege; 145 Remote Code Execution; 102 Information Disclosure; 35 Denial of Service
Why the volume	Microsoft’s new AI-powered vulnerability discovery system applied to Windows codebase, flagged internally before attackers could exploit
CISA action	CVE-2026-58644 (SharePoint RCE, CVSS 9.8) added to KEV catalog July 17, 2026; federal agencies must patch by July 19, 2026
Other major vendors	Adobe, Cisco, Fortinet, Ivanti, NVIDIA, Progress, SAP, VMware, Zimbra all released updates this cycle

Table 1: July 2026 Patch Tuesday Fast Facts.

The Three Zero-Days

CVE-2026-56155: Active Directory Federation Services Elevation of Privilege (Exploited)

Microsoft has patched an actively exploited privilege escalation vulnerability in Active Directory Federation Services (AD FS). The flaw is classified as insufficient granularity of access control in AD FS, allowing an authorized attacker to elevate privileges locally. Microsoft credited discovery to Jeremy Kingston and Scott Clark of Microsoft’s Detection and Response Team (DART), the company’s internal incident response unit, indicating the vulnerability was likely uncovered during investigation of active attacks rather than through external research. Microsoft has not disclosed how the flaw was being exploited or who the threat actors were.

AD FS is a critical authentication component in enterprise environments, providing single sign-on capabilities across Microsoft and third-party applications. An attacker who already has an authorized foothold in an environment and can exploit this flaw gains administrative-level privileges, enabling lateral movement, credential theft, and persistence at significantly higher access levels. Organisations running AD FS on-premises should treat this as the highest-priority patch in this month’s release.

CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege (Exploited)

Microsoft patched an actively exploited vulnerability in SharePoint Server described as missing authentication for a critical function, allowing an unauthorized remote attacker to elevate privileges over a network. Microsoft credited the flaw to Jayson Frost of Mandiant Incident Response, Genwei Jiang of Google Cloud FLARE OTF, and an anonymous researcher, confirming this was found through incident response engagement rather than lab research.

SharePoint Server is a primary document management and collaboration platform in enterprise environments and a frequent target for both ransomware operators and espionage actors seeking internal documents and credentials. Microsoft has advised that enabling Antimalware Scan Interface (AMSI) on the server and setting the Request Body Scan mode to Full can mitigate this flaw where immediate patching is not possible, but this is a temporary measure.

CVE-2026-50661: Windows BitLocker Security Feature Bypass (Publicly Disclosed)

A publicly disclosed BitLocker bypass allows an attacker with physical access to a device to access encrypted data on the storage drive, defeating the device encryption feature. This vulnerability does not require network access and cannot be exploited remotely, but it is significant for any organisation relying on BitLocker for device encryption of mobile devices, particularly laptops that may be lost or seized. Microsoft attributed the flaw to an anonymous researcher.

CISA KEV Addition: CVE-2026-58644 SharePoint RCE (CVSS 9.8)

Separately from the Patch Tuesday zero-days, CISA added CVE-2026-58644 to its Known Exploited Vulnerabilities catalog on July 17, 2026, requiring all Federal Civilian Executive Branch agencies to apply the fix by July 19, 2026. CVE-2026-58644 is a critical deserialization of untrusted data vulnerability in Microsoft SharePoint Server with a CVSS base score of 9.8. Microsoft’s advisory describes the attack scenario as remotely exploitable over the internet with low attack complexity, meaning an attacker authenticated as at least a Site Owner can write and execute arbitrary code remotely on the SharePoint Server. CISA’s one-day remediation window for federal agencies indicates that exploitation in the wild was confirmed before or around the time of the KEV addition.

Figure 1: July 2026 Patch Tuesday CVE distribution by category. Elevation of Privilege at 254 and Remote Code Execution at 145 dominate the release.

Why the Volume Jumped

Microsoft warned on July 7, 2026, that organisations should expect more Patch Tuesday security updates going forward as it has deployed an AI-powered vulnerability discovery system to identify security flaws across its Windows codebase before attackers can exploit them. June 2026’s Patch Tuesday addressed 200 vulnerabilities. July 2026’s addresses 570. That is a 185 percent increase in one month. If the AI discovery system continues to surface vulnerabilities at this rate, monthly patch volumes could remain significantly elevated through the second half of 2026.

The 468 Microsoft Edge and Chromium flaws fixed this month but excluded from the official Patch Tuesday count represent a separate but related surge. Last month’s Edge total was 360. Both numbers reflect AI-assisted discovery at scale applied to large, complex codebases.

Other Notable CVEs This Cycle

• CVE-2026-48561 Microsoft Copilot Remote Code Execution (Critical): A critical RCE vulnerability in Microsoft Copilot patched this cycle. No exploitation confirmed at time of writing.
• CVE-2026-54128 Windows DHCP Client Remote Code Execution (Critical): A critical RCE in the Windows DHCP client, exploitable without authentication by an attacker on the same network segment. Significant risk for organisations with untrusted network segments or guest WiFi.
• CVE-2026-49164 Active Directory Domain Services Remote Code Execution (Critical): A critical RCE in AD DS. Combined with the AD FS zero-day, this makes Active Directory infrastructure the most urgent patching target in this cycle.
• CVE-2026-55008 Microsoft Exchange Server Spoofing (Critical): A critical spoofing vulnerability in Exchange Server patched this cycle. Exchange remains a high-value target for business email compromise and nation-state espionage.
• CVE-2026-50661 GitHub Copilot and Visual Studio Security Feature Bypass: A security feature bypass affecting GitHub Copilot and Visual Studio Code, relevant for development environments with sensitive codebases.

Recommended Immediate Actions

• Apply July 2026 Patch Tuesday updates on all Windows endpoints and servers, prioritising AD FS, SharePoint Server, and DHCP infrastructure. The two exploited zero-days and the CISA KEV SharePoint RCE make these the highest-urgency targets.
• Enable AMSI on SharePoint Server and set Request Body Scan mode to Full as an immediate mitigation where patching cannot be completed within 24 hours.
• Verify BitLocker encryption policy settings and confirm whether any at-risk devices, particularly mobile laptops, have protections in addition to BitLocker for environments where physical theft is a plausible risk scenario.
• Review the full July 2026 Patch Tuesday report for any CVEs affecting specific products in use, particularly Exchange Server, SQL Server, Microsoft Defender, and the Windows kernel elevation of privilege chain.

Federal agencies in scope of CISA Emergency Directive must patch CVE-2026-58644 in SharePoint Server by July 19, 2026.