Microsoft's July 2026 Patch Tuesday delivers security updates for a record-breaking 570 vulnerabilities, including two actively exploited zero-days and one publicly disclosed zero-day. With 59 Critical-rated flaws and 48 remote code execution vulnerabilities, this is the largest Patch Tuesday in recent memory and demands immediate attention from every Windows administrator and developer.
Vulnerability Details
Release Date: July 14, 2026
Total Flaws Patched: 570 (Microsoft-only, excluding Chromium/Edge fixes)
Critical Severity: 59
Remote Code Execution: 48
Elevation of Privilege: 140+
Zero-Days Addressed: 3 (2 exploited in attacks, 1 publicly disclosed)
Microsoft classifies a zero-day as a vulnerability that is either publicly disclosed or actively exploited while no official fix exists. This month's three zero-days represent the highest count since June 2026's six zero-days.
Actively Exploited Zero-Days
CVE-2026-50647 — Active Directory Federation Services Elevation of Privilege
CVSS: Not yet scored (Critical per Microsoft)
Attack Vector: Local
Exploitation Status: Actively exploited in the wild
An insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. Microsoft credited Jeremy Kingston and Scott Clark of the Microsoft Detection and Response Team (DART), indicating the flaw was discovered during active incident response investigations.
Impact: Attackers with initial foothold can escalate to AD FS administrative privileges, potentially compromising federation trust relationships and token signing certificates.
CVE-2026-55052 — Microsoft SharePoint Server Elevation of Privilege
CVSS: Not yet scored (Critical per Microsoft)
Attack Vector: Network
Exploitation Status: Actively exploited in the wild
Missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. Microsoft credits Jayson Frost (Mandiant Incident Response), Genwei Jiang (Google Cloud), FLARE OTF, and an anonymous researcher.
Mitigation: Enable Antimalware Scan Interface (AMSI) on the server and set Request Body Scan mode to Full.
Publicly Disclosed Zero-Day
CVE-2026-50661 — Windows BitLocker Security Feature Bypass
CVSS: Important (bypass, not RCE)
Attack Vector: Physical
Exploitation Status: Publicly disclosed, proof-of-concept available
A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data. Microsoft attributed the flaw to an anonymous researcher.
Impact: Full disk encryption bypass with physical access. No remote exploitation vector.
Impact Assessment
Who Needs to Act Immediately
| Environment | Priority | Reason |
|---|---|---|
| Domain Controllers with AD FS | Critical | CVE-2026-50647 actively exploited, federation compromise |
| SharePoint On-Premises Farms | Critical | CVE-2026-55052 network-exploitable, no auth required |
| All Windows Servers/Clients | High | 59 Critical flaws, 48 RCE across kernel, RDP, DNS, DHCP, SMB |
| Developer Workstations (VS Code, GitHub Copilot) | High | CVE-2026-50510 (Copilot RCE), CVE-2026-41109 (Copilot/VS Code bypass) |
| SQL Server Instances | High | CVE-2026-54118, CVE-2026-55002 (Critical RCE) |
| Exchange On-Premises | High | 5 Critical RCE/EoP flaws in July release |
Attack Surface Highlights
- Remote Code Execution (48): Windows Kernel, Hyper-V, RDP Client, DNS Server, DHCP Client/Server, Office (Word/Excel/PowerPoint), SQL Server, Visual Studio Code, GitHub Copilot
- Elevation of Privilege (140+): Windows Kernel (20+ CVEs), NTFS, Win32k, DWM, Print Spooler, Cloud Files, App Installer, Hyper-V
- Security Feature Bypass (8+): BitLocker, Kernel-mode Stack Protection, Code Integrity (ci.dll), Key Guard, Cryptographic Services, DNS Client, HTTP.sys
Affected Systems
The July 2026 updates apply to all supported Windows versions:
- Windows 11: 22H2, 23H2, 24H2
- Windows 10: 21H2, 22H2 (Enterprise/Education), LTSC 2021
- Windows Server: 2025, 2022, 2019, 2016
- Office: Microsoft 365 Apps, Office 2024, 2021, 2019, 2016
- Development Tools: Visual Studio 2022, VS Code, GitHub Copilot extensions
- Server Apps: SQL Server 2019/2022, Exchange 2019, SharePoint 2019
Note: The 570 count excludes 468 Chromium/Edge flaws fixed by Google this month, plus fixes for Mariner, Azure OpenAI, Azure Synapse, M365 Copilot, Exchange Online, Edge Android, and Entra Provisioning Service released earlier in July.
Mitigation & Patching
Immediate Actions (Within 24 Hours)
- Apply July 2026 Cumulative Updates to all domain controllers running AD FS
- Patch SharePoint Servers — prioritize CVE-2026-55052 (network-exploitable, no auth)
- Enable AMSI Full Request Body Scan on SharePoint as interim mitigation
- Deploy BitLocker Group Policy to enforce pre-boot authentication where physical security is uncertain
Standard Patch Cycle (Within 7 Days)
Developer-Specific Actions
- VS Code / GitHub Copilot users: Update to VS Code 1.92+ and latest Copilot extension (addresses CVE-2026-50510, CVE-2026-41109, CVE-2026-47282)
- SQL Server developers: Apply CU for SQL 2019/2022 (CVE-2026-54118 RCE)
- Container hosts: Update Hyper-V host (CVE-2026-50485, CVE-2026-54129 Critical EoP)
Workarounds Where Patching Is Delayed
| CVE | Workaround |
|---|---|
| CVE-2026-50647 (AD FS) | Restrict AD FS admin access, monitor Event ID 500/501 for token signing cert changes |
| CVE-2026-55052 (SharePoint) | Enable AMSI Full Request Body Scan; restrict SharePoint to trusted networks |
| CVE-2026-50661 (BitLocker) | Require TPM + PIN at boot; disable sleep/hibernate (use shutdown only) |
Detection
Event Logs to Monitor
| CVE | Event ID | Source | Description |
|---|---|---|---|
| CVE-2026-50647 | 500, 501 | AD FS Admin | Token signing certificate changes, federation trust modifications |
| CVE-2026-55052 | 8306, 8307 | SharePoint | Unauthenticated admin operations, privilege escalation |
| CVE-2026-50661 | 24582, 24583 | BitLocker | Suspend/resume events, recovery key access |
Defender for Endpoint Queries
Network Indicators
- Unexpected RDP connections to Domain Controllers (port 3389)
- SMB traffic to SharePoint servers from non-admin subnets
- LDAP queries targeting AD FS service accounts from unusual sources
Frequently Asked Questions
Q: Does this Patch Tuesday include the CrowdStrike-related kernel changes?
A: No. The July 2026 updates are independent of the July 2024 CrowdStrike incident. Microsoft's AI-driven vulnerability discovery (announced June 2026) contributed to the elevated flaw count.
Q: Are Azure cloud services affected?
A: Azure OpenAI, Azure Synapse, M365 Copilot, Exchange Online, and Entra Provisioning Service received fixes earlier in July. The 570 count covers on-premises/Windows client only.
Q: Should I delay patching to avoid the "Patch Tuesday blues"?
A: With two actively exploited zero-days (AD FS, SharePoint), the risk of delay exceeds the risk of patching. Test in staging first, but deploy to DCs and SharePoint within 24 hours.
Q: What about the 468 Edge/Chromium flaws?
A: Those are fixed via the Edge Stable channel update (126.0.x). Ensure Edge auto-update is enabled or deploy via Intune/WSUS.
Q: Does CVE-2026-50661 (BitLocker) affect TPM 2.0 systems?
A: Yes. The bypass works on any system where an attacker has physical access, regardless of TPM version. Mitigation: require PIN at pre-boot.
Q: Are there known exploits in the wild for the other 57 Critical flaws?
A: As of July 14, Microsoft reports only the two AD FS and SharePoint zero-days are confirmed exploited. However, 48 RCE flaws significantly raise the likelihood of exploit development in coming weeks.
Key Takeaways
- Largest Patch Tuesday in years — 570 flaws signals Microsoft's AI-powered vulnerability discovery is surfacing more issues pre-exploitation
- Two network-exploitable zero-days — AD FS (local) and SharePoint (remote) demand emergency patching
- Developer tooling in scope — GitHub Copilot, VS Code, Visual Studio all received Critical RCE fixes
- Physical security matters — BitLocker bypass (CVE-2026-50661) reminds us encryption is only as strong as physical access controls
- Test, then deploy fast — With active exploitation confirmed, the 24-hour window for DCs and SharePoint is non-negotiable
Conclusion
July 2026 Patch Tuesday is not routine. The combination of record flaw count, dual actively exploited zero-days, and Critical RCE in developer tools makes this a "drop everything and patch" event for Windows environments. Prioritize AD FS domain controllers, SharePoint farms, and developer workstations today. Schedule the remaining 500+ fixes within your standard 7-day cycle, but do not delay the Critical path.
Sources: Microsoft Security Update Guide July 2026, BleepingComputer: Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days, Microsoft Zero-Day Classification
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.