Microsoft released security updates addressing 622 vulnerabilities on July 14 2026 marking the largest Patch Tuesday in history. The update cycle includes three zero-day vulnerabilities with two actively exploited in the wild and 59 flaws rated Critical.

Vulnerability Details

CVE-2026-58644 SharePoint Server RCE (CVSS 9.8 Critical)

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. This vulnerability affects SharePoint Server Subscription Edition 2019 and 2016. CISA added this to the Known Exploited Vulnerabilities catalog on July 16 requiring federal agencies to patch by July 19.

CVE-2026-56155 Active Directory Federation Services LPE (CVSS 7.8 High)

Insufficient granularity of access control in AD FS allows an authorized attacker to elevate privileges locally. Credited to Microsoft DART this zero-day was discovered during active incident response. CISA KEV entry added July 14 with patch deadline July 28.

CVE-2026-56164 SharePoint Server Elevation of Privilege (CVSS 7.8 High Microsoft 5.3 Medium)

Missing authentication for critical function in SharePoint allows an unauthorized attacker to elevate privileges over a network. CISA KEV entry added July 14 with patch deadline July 17. Microsoft and NIST CVSS scores diverge significantly.

CVE-2026-48561 Microsoft Copilot RCE (CVSS 9.6 Critical)

Remote code execution in Microsoft Copilot allows an unauthorized attacker to execute code over the network. An attacker could host a malicious website causing Edge for Android to automatically send crafted prompts to Copilot when a user visits the site.

CVE-2026-50661 Windows BitLocker Security Feature Bypass (CVSS 7.1 High)

Security feature bypass in Windows BitLocker could allow attackers with physical access to gain access to encrypted data. Publicly disclosed but not known to be exploited.

Impact Assessment

The 622 vulnerabilities span the entire Microsoft ecosystem:

Product Category	Critical	Important	Total
Windows OS	23	142	165
Office Suite	18	87	105
SharePoint Server	4	12	16
Exchange Server	2	8	10
.NET Framework	3	24	27
Azure Cloud Services	4	15	19
Developer Tools	1	12	13
Other	4	163	167

Notably 468 Edge/Chromium vulnerabilities were fixed by Google this month and excluded from Microsoft's count. The June 2026 Patch Tuesday by comparison addressed 206 flaws.

Affected Systems

All supported Windows versions receive updates including:

• Windows 10 21H2 through 22H2
• Windows 11 21H2 through 24H2
• Windows Server 2016 through 2025
• SharePoint Server Subscription Edition 2019 and 2016
• Exchange Server 2016 and 2019
• Microsoft Office 2016 through Microsoft 365 Apps

Mitigation and Patching

Immediate Actions (Zero-Days)

1. Apply July 2026 cumulative updates immediately for all affected systems
2. Prioritize SharePoint servers due to active exploitation of CVE-2026-58644 and CVE-2026-56164
3. Patch AD FS servers for CVE-2026-56155 within 14 days per CISA directive
4. Enable AMSI integration on SharePoint web applications as mitigation for CVE-2026-56164

Standard Patch Cycle

1. Test updates in staging environment
2. Deploy to critical infrastructure first (domain controllers SharePoint AD FS)
3. Roll out to workstations and remaining servers
4. Verify installation via WSUS SCCM or Intune
5. Monitor for post-patch stability issues

SharePoint Specific Hardening

• Enable Antimalware Scan Interface (AMSI) with Request Body Scan mode set to Full
• Verify IIS machine keys have not been harvested
• Block external access to SharePoint Central Administration
• Restrict farm and database communications
• Review Microsoft SharePoint security hardening guidance

Detection

CVE-2026-58644 Indicators

• Unusual deserialization activity in SharePoint ULS logs
• Unexpected application pool child processes
• IIS machine key access or rotation anomalies

CVE-2026-56155 Indicators

• Suspicious AD FS token issuance patterns
• Privilege escalation events in Security log Event ID 4672
• Unusual service account activity

CVE-2026-48561 Indicators

• Edge for Android anomalous Copilot prompt traffic
• Unexpected network connections to Copilot endpoints

Frequently Asked Questions

Why so many vulnerabilities this month?

Microsoft attributes the record count to AI-assisted vulnerability discovery. Executive VP Pavan Davuluri stated Windows users will see higher update volumes as AI accelerates finding and analysis. Security researchers note this also means attackers can find exploits faster.

Are Edge/Chromium flaws included?

No. The 468 Edge/Chromium vulnerabilities fixed by Google this month are excluded from Microsoft's 622 count. Organizations using Edge must apply browser updates separately.

What about the CVSS discrepancy for CVE-2026-56164?

NIST rates it CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while Microsoft rates it 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The difference stems from impact assessment. CISA treats it as Critical based on active exploitation.

Should I delay patching due to volume?

Given two actively exploited zero-days (CVE-2026-58644 CVE-2026-56155) and a third publicly disclosed (CVE-2026-50661) immediate patching is recommended. However Microsoft and Ivanti suggest waiting a few days for stability reports given the unprecedented patch volume.

How does this compare to previous months?

June 2026: 206 vulnerabilities May 2026: 147 vulnerabilities April 2026: 132 vulnerabilities July 2026: 622 vulnerabilities (3x previous record)

Key Takeaways

• July 2026 Patch Tuesday breaks all records with 622 vulnerabilities fixed
• Three zero-days addressed: two actively exploited (SharePoint RCE AD FS LPE) one publicly disclosed (BitLocker bypass)
• CVE-2026-58644 SharePoint RCE is the highest priority: CVSS 9.8 unauthenticated network RCE actively exploited
• AI-driven discovery is accelerating vulnerability counts industry-wide
• Apply cumulative updates immediately for zero-days test then deploy remaining patches
• SharePoint on-premises servers require urgent attention and hardening

---

Sources:

• Krebs on Security Microsoft Patches a Record 570 Security Flaws
• BleepingComputer Microsoft July 2026 Patch Tuesday Fixes Massive 570 Flaws 3 Zero-Days
• Microsoft Security Update Guide
• CISA Known Exploited Vulnerabilities Catalog
• NVD