Microsoft July 2026 Patch Tuesday is not just another monthly update cycle. It is the largest single security release in the company's history, addressing 622 unique CVEs across Windows, Office, SharePoint, Exchange, SQL Server, Azure, and developer tools. For context, that is more than triple June's previous record of ~200 flaws. Two of the vulnerabilities are already being exploited in the wild, and Microsoft explicitly attributes the surge to AI-powered vulnerability discovery.

If you manage Windows infrastructure, this is the release that rewrites your patching playbook.

What Happened

On July 14, 2026, Microsoft released its monthly security update bundle. The Security Update Guide lists 622 CVEs. Zero Day Initiative (ZDI), counting independently, tallied 621. The discrepancy comes from how Office 2016 CVEs are tracked, but the scale is unambiguous: this is an unprecedented volume of fixes in a single month.

The release covers:

• Windows: 416 CVEs
• Office: 82 CVEs (listed twice for Office 2016, inflating some outlet counts to ~700)
• Microsoft Edge: 46 CVEs (21 Microsoft-original, 25 Chromium upstream)
• Developer Tools: 27 CVEs across Visual Studio, VS Code, GitHub Copilot
• SharePoint Server: 17 CVEs
• Azure: 11 CVEs
• SQL Server: 8 CVEs
• Microsoft Defender: 5 CVEs
• Exchange Server: 5 CVEs

Of the 622, nearly 60 are rated Critical (remote code execution), and over 250 are Elevation of Privilege. ZDI counts 95 RCEs across the release.

The Two Zero-Days You Must Patch First

Microsoft flags two vulnerabilities as exploited in the wild. Neither is a classic remote code execution with a 9.8 CVSS. Both are elevation-of-privilege flaws in identity and collaboration infrastructure, which makes them more dangerous in practice than their scores suggest.

CVE-2026-56164: SharePoint Server Unauthenticated Privilege Escalation

• CVSS: 7.2 (Microsoft) / 9.1 (ZDI) — a four-point spread that tells you severity ratings are unreliable this month
• Impact: Unauthenticated attacker escalates privileges over the network, no user interaction required
• Products: SharePoint Server 2016, 2019 (Subscription Edition)
• Credit: Mandiant incident responders + Google FLARE team — indicating discovery during active incident response
• Mitigation: Enabling AMSI in Full Mode on the server blunts the attack vector

Critical context: SharePoint Server 2016 and 2019 reach end of extended support today. There is no paid ESU program for SharePoint like there is for Windows Server or SQL Server. If you are on these versions, you are now running unpatched, exploited software with no vendor lifeline. The ToolShell chain in 2025 proved SharePoint is a persistent target; this zero-day confirms it remains one.

CVE-2026-56155: Active Directory Federation Services Privilege Escalation

• CVSS: Not yet widely published; Microsoft rates it Important, exploited
• Impact: Authenticated attacker elevates privileges locally via weak access controls
• Products: AD FS on Windows Server
• Credit: Microsoft DART (Detection and Response Team) — again, found during real-world incident response
• Why it matters: AD FS is the token-signing authority for your federated identity fabric. A local privilege escalation on the federation server is a domain-compromise pathway.

Neither CVE appears on CISA's KEV catalog as of publication. Microsoft's own exploitability flag is the authoritative signal here. Do not wait for a KEV listing to prioritize these.

The Third Zero-Day: Publicly Disclosed, Not Exploited

CVE-2026-50661: BitLocker Security Feature Bypass

• CVSS: Not Critical (requires physical access)
• Impact: Attacker with physical device access bypasses BitLocker encryption
• Context: Part of a BitLocker bypass lineage including BitKrieg and YellowKey from earlier in 2026
• Priority: Patch it, but it does not jump the queue ahead of the two exploited flaws above

The SharePoint Chain That Isn't Fixed Yet

Rapid7 disclosed CVE-2026-55040, a JWT authentication bypass in SharePoint Server, as part of their Pwn2Own Berlin entry. Rapid7 scores it 5.3 (Medium); ZDI reads the same release as Critical 9.1. The bypass chains with a separate RCE that Microsoft says will be fixed in August 2026.

This creates an unusual situation: July's patch breaks the authentication link in the chain, but the execution primitive remains unpatched for another month. If you run SharePoint Server, you are in a holding pattern — the chain is disrupted, but the underlying RCE surface persists.

The RC4 Kerberos Hardening That Will Break Logins

This release finalizes Microsoft's multi-year Kerberos RC4 deprecation. The RC4DefaultDisablementPhase rollback switch — the escape hatch admins have used since January — is removed.

After this update, RC4 works only for accounts explicitly configured to allow it. Any service account still requesting RC4 Kerberos tickets will fail authentication immediately.

Required sequence:

1. Audit first: Use the RC4 audit events Microsoft added in January (Event ID 4768/4769 with encryption type 0x17)
2. Rotate passwords on flagged service accounts — this forces Windows to generate AES keys
3. Then patch

Skipping the audit-and-rotate step will page you at 2 AM with broken service logins. This is not a vulnerability; it is a forced migration with a hard deadline.

Why a "Quiet" Month Set a Record

July is historically one of Microsoft's lightest Patch Tuesday months. The 2026 release defies that pattern entirely. Microsoft's July 9 blog post by EVP Pavan Davuluri provides the explanation: AI is accelerating vulnerability discovery.

The company's MDASH (Multi-model DASh) agentic scanning system found 16 of May's Patch Tuesday bugs autonomously. Microsoft has not disclosed how many of July's 622 came from the AI pipeline, but the correlation is clear: automated discovery at scale produces automated disclosure at scale.

This cuts both ways. The same automation that helps Microsoft find bugs faster also helps attackers reverse-engineer patches and weaponize them before defenders can test. The "wait a week" cushion that many shops relied on is evaporating. Exploit Wednesday is becoming Exploit Tuesday.

Triage Guidance: Sort by Exploitation, Not CVSS

With 600+ CVEs, CVSS-based triage is useless. Critical no longer sorts anything. Use this priority order:

Priority	Signal	Action
P0	Microsoft exploited flag + KEV + incident responder credit	Patch immediately; emergency change window
P1	Microsoft exploited flag (even without KEV)	Patch within 24-48 hours
P2	Publicly disclosed (CVE-2026-50661, CVE-2026-55040)	Patch within 72 hours
P3	Critical RCE in internet-facing roles (VMSwitch CVE-2026-57092 at 9.9, DHCP RCEs, Exchange OWA XSS at 9.6)	Patch in next maintenance window
P4	Everything else	Standard cycle

Key CVEs to pull out for P3:

• CVE-2026-57092: VMSwitch RCE, CVSS 9.9 — Hyper-V host compromise via crafted packets
• CVE-2026-54117/54118: SQL Server RCE pair, 8.8 each
• CVE-2026-55008: Exchange OWA Stored XSS, 9.6 (filed under Spoofing, undersold)
• CVE-2026-50522: SharePoint RCE pair, 9.8
• CVE-2026-48561: Microsoft Copilot RCE via Edge Android, 9.6 — malicious site crafts prompts to Copilot

The Industry Context: Everyone Is Shipping More, Faster

Microsoft is not alone. Chris Goettl at Ivanti notes that Adobe moved to twice-monthly bulletins (2nd and 4th Tuesdays), also citing AI. Cisco, Mozilla, and Oracle have increased cadence. Google's June 2026 Android batch topped 900 fixes.

The ecosystem-wide acceleration means defenders face a compounding workload. If your patch process assumes a manageable monthly batch, that assumption is broken.

Practical Steps for This Week

1. Inventory SharePoint Server versions — if you have 2016/2019, plan migration now; no ESU exists
2. Run the RC4 audit — query for encryption type 0x17 in Kerberos events before deploying July patches
3. Patch the two exploited zero-days first — CVE-2026-56164 and CVE-2026-56155
4. Pull the VMSwitch (CVE-2026-57092) and Copilot (CVE-2026-48561) fixes into your next Hyper-V / Edge maintenance window
5. Track the SharePoint RCE chain — August Patch Tuesday closes the execution half; do not forget
6. Update your triage playbook — add "Microsoft exploited flag" as a primary sort key alongside KEV and EPSS

What This Means for the Rest of 2026

Microsoft's Davuluri was explicit: "a higher volume of security updates included in each security release" is the new normal. If July is 622, October could approach 800. The tooling, staffing, and testing processes that worked for 150-CVE months will not scale linearly.

Invest in:

• Automated patch testing in staging environments that mirror production
• Exploitability-aware prioritization (KEV, EPSS, Microsoft's exploited flag, vendor incident-response credits)
• Faster staging environments

The era of "Patch Tuesday is manageable" is over. The era of "Patch Tuesday requires automation and ruthless prioritization" has begun.

---

Sources:

• Microsoft Security Update Guide, July 2026 release
• Zero Day Initiative: "The July 2026 Security Update Review" (July 14, 2026)
• The Hacker News: "Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack" (July 15, 2026)
• Krebs on Security: "Microsoft Patches a Record 570 Security Flaws" (July 15, 2026)
• Rapid7: "CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (Fixed)" (July 14, 2026)
• Microsoft Windows Experience Blog: "Evolving Windows Vulnerability Management to Meet the Speed of AI-Powered Discovery" (July 9, 2026)