Microsoft's July 2026 Patch Tuesday has landed with record-breaking numbers: 570 vulnerabilities fixed across the Microsoft ecosystem, including three zero-day vulnerabilities — two actively exploited in the wild and one publicly disclosed. This surpasses last month's already massive 200-flaw release and marks the largest single Patch Tuesday in Microsoft's history.

The Numbers at a Glance

Metric	Count
Total CVEs Patched	570
Critical Severity	59
Remote Code Execution	48 (of the Critical)
Zero-Days	3
Actively Exploited	2
Publicly Disclosed	1
Products Affected	Windows, Office, SharePoint, Exchange, .NET, Azure, Defender, Dynamics, and more

The 570 count reflects only vulnerabilities released today by Microsoft. It excludes an additional 468 Microsoft Edge/Chromium flaws patched by Google this month, plus fixes for Mariner, Azure OpenAI, Azure Synapse, M365 Copilot, Exchange Online, and Entra Provisioning Service released earlier in July.

The Three Zero-Days You Must Patch Immediately

1. AD FS Elevation of Privilege (Actively Exploited)

CVE-2026-56155 — Active Directory Federation Services Elevation of Privilege Vulnerability

"Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally."

Microsoft credits Jeremy Kingston and Scott Clark of the Microsoft Detection and Response Team (DART), indicating this was discovered during active incident response. An authenticated attacker with access to an AD FS server can escalate to administrative privileges. No exploitation details have been disclosed, but DART involvement signals real-world attacks.

Affected: Windows Server 2016, 2019, 2022 (AD FS role) Mitigation: Apply the July 2026 security update immediately. Review AD FS audit logs for anomalous privilege escalation events (Event ID 4728, 4732, 4756).

2. SharePoint Server Privilege Escalation (Actively Exploited)

CVE-2026-XXXXX — Microsoft Office SharePoint Missing Authentication for Critical Function

"Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network."

This is a pre-authentication vulnerability — no valid credentials required. Microsoft credits Jayson Frost (Mandiant Incident Response), Genwei Jiang (Google Cloud), FLARE OTF, and an anonymous researcher. The diverse attribution suggests multiple independent discoveries or a coordinated disclosure.

Mitigation per Microsoft: Enable the Antimalware Scan Interface (AMSI) on the SharePoint server and set Request Body Scan mode to Full. This provides a detection layer while you deploy the patch.

Affected: SharePoint Server 2016, 2019, Subscription Edition Exploitation: Active in the wild — patch immediately.

3. Windows BitLocker Bypass (Publicly Disclosed)

CVE-2026-XXXXX — Windows BitLocker Device Encryption Bypass

"A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data."

This requires physical access — a lower-risk scenario for most server environments but critical for lost/stolen laptops. Attributed to an anonymous researcher.

Affected: Windows 10, 11, Server 2016/2019/2022 with BitLocker Mitigation: Deploy the update; enforce BIOS/UEFI passwords and TPM-only protectors where possible.

Critical Product Families: What Developers and Admins Need to Know

Windows Kernel & Core OS (90+ CVEs)

The Windows kernel, Win32k, NTFS, ReFS, and CLFS collectively received dozens of fixes. Highlights:

• CVE-2026-50491 — Code Integrity DLL (ci.dll) Elevation of Privilege
• CVE-2026-49164 / CVE-2026-49178 — Active Directory Domain Services RCE (Critical)
• CVE-2026-58634/58633/50692 — Desktop Window Manager EoP trio
• CVE-2026-50386/50448/50461/49789/49184 — NTFS/ReFS RCE and EoP cluster

Microsoft Office (15+ CVEs, 4 Critical RCE)

Office continues to be a prime target. Four Critical RCEs in this release alone:

• CVE-2026-55129 — Microsoft Office RCE
• CVE-2026-55049 — Microsoft Office RCE
• CVE-2026-55045 — Microsoft Office RCE
• CVE-2026-55125 — Microsoft Office RCE (Important)

Plus numerous Information Disclosure flaws that aid reconnaissance.

Microsoft Exchange Server (4 CVEs)

• CVE-2026-55005 — Exchange RCE (Important)
• CVE-2026-55008 — Exchange Spoofing (Critical)
• CVE-2026-55006/55009 — Exchange EoP (Important)

Exchange servers exposed to the internet should be patched first.

.NET & ASP.NET Core (12+ CVEs)

Developers running .NET 6/7/8 or .NET Framework 4.8 should update immediately:

• CVE-2026-50646 — .NET Framework RCE (Important)
• CVE-2026-47304 — .NET Security Feature Bypass
• CVE-2026-45646 / 50506 — OData DoS in ASP.NET Core
• CVE-2026-47300/47303 — ASP.NET Core EoP

Run dotnet workload update and rebuild containers from updated base images.

Microsoft Defender & Security Tools (5 CVEs)

Ironically, the security stack itself had Critical RCEs:

• CVE-2026-55012 — Microsoft Defender RCE (Critical)
• CVE-2026-55011 — Microsoft Defender RCE (Critical)
• CVE-2026-50657/50658/56178 — Defender for Endpoint on Mac EoP/InfoDisclosure

GitHub Copilot & Visual Studio (3 CVEs)

Supply-chain relevance for developers:

• CVE-2026-50510 — GitHub Copilot RCE (Important)
• CVE-2026-41109 — Copilot/VS Code Security Feature Bypass
• CVE-2026-47282 — Copilot/VS Code Information Disclosure

Update VS Code extensions and GitHub Copilot to latest versions.

AI-Powered Vulnerability Discovery: The New Normal

Microsoft disclosed last week that it now uses an AI-powered vulnerability discovery system to scan the Windows codebase. This explains the dramatic increase in Patch Tuesday volume — June had 200 flaws, July has 570. Microsoft expects this trend to continue as AI finds more classes of bugs (buffer overflows, use-after-free, logic errors) at scale.

For defenders, this means: Patch Tuesday is only going to get bigger. Automate your patch management, prioritize by exploitability (KEV catalog, CISA alerts), and assume the "quiet months" are over.

Practical Patching Priority Order

If you cannot patch everything today, follow this sequence:

1. Internet-facing SharePoint / Exchange — Actively exploited zero-days
2. AD FS servers — Actively exploited, DART-attributed
3. Domain Controllers — AD DS Critical RCEs (CVE-2026-49164)
4. Endpoints with BitLocker — Physical access bypass
5. Developer workstations — VS Code, Copilot, .NET SDKs
6. Remaining Windows servers/workstations — Kernel, Win32k, NTFS fixes
7. Office apps — Deploy via Microsoft 365 Apps admin center
8. Edge/Chromium — 468 flaws via Google's channel (auto-updates handle this)

Detection & Threat Hunting Queries

AD FS Anomalous Privilege Escalation (KQL for Sentinel/Defender)

SharePoint Unauthenticated Access Attempts

BitLocker Configuration Drift

Frequently Asked Questions

Does this Patch Tuesday include the CrowdStrike-related kernel changes?

No. The July 2026 Patch Tuesday is separate from the Windows Resiliency Initiative changes Microsoft announced after the July 2024 CrowdStrike incident. Those changes (VBS enforcement, kernel driver signing policy) are rolling out via feature updates, not security updates.

Are the 468 Edge/Chromium flaws included in the 570 count?

No. Microsoft explicitly excludes Chromium-engine fixes from its Patch Tuesday tally. Those 468 CVEs were patched by Google and flow to Edge via the Stable channel automatically. Verify edge://settings/help shows version 138.0.3350.x or later.

What about Windows Server 2012 R2 / 2008 R2?

Both are end-of-life (Extended Security Updates ended October 2023). No patches are available. Isolate or replace these systems immediately.

Can I delay patching non-internet-facing servers?

For the two actively exploited zero-days (AD FS, SharePoint): No. Lateral movement from a compromised perimeter host is the primary attack path. For the other 568 CVEs: risk-based prioritization is acceptable, but aim for 30-day deployment per CISA guidance.

How do I verify the updates installed correctly?

Run Get-HotFix | Where-Object {$_.HotFixID -like 'KB50*'} on Windows, or check Settings > Windows Update > Update history. For Office, use the Microsoft 365 Apps admin center > Products > Apps > Update history.

Key Takeaways

• 570 CVEs is a new record — AI-driven discovery is accelerating vulnerability throughput
• Two actively exploited zero-days (AD FS, SharePoint) demand immediate patching
• SharePoint pre-auth EoP is the highest-risk flaw — internet-facing farms are under active attack
• 48 Critical RCEs span Windows kernel, Office, Exchange, .NET, Defender — broad attack surface
• BitLocker bypass matters for mobile device fleets; enforce TPM-only protectors
• Developer tooling (Copilot, VS Code, .NET) received fixes — update build agents and dev containers
• Automate or drown — manual patch management cannot scale at this velocity

Conclusion

Microsoft's July 2026 Patch Tuesday isn't just another monthly update — it's a signal that the vulnerability landscape has fundamentally shifted. With AI uncovering flaws at unprecedented rates, the 570-CVE baseline may become the new normal. Organizations that treat patching as a quarterly project will fall behind; those that automate, prioritize by exploitation evidence, and maintain real-time asset inventories will stay ahead.

Patch the two exploited zero-days today. Schedule the rest this week. Automate the cycle for next month.

---

Sources:

• Microsoft Security Update Guide - July 2026
• BleepingComputer: Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days
• Orca Security: Microsoft's Record 622-CVE July 2026 Patch Tuesday Ships an Actively Exploited SharePoint Zero-Day
• CISA Known Exploited Vulnerabilities Catalog