# Microsoft Ships Record 622 Patches in Largest Patch Tuesday on Record—Two Zero-Days Already Under Active Attack
Microsoft released its largest Patch Tuesday update on record today, delivering security patches for 622 vulnerabilities across its product portfolio. The sheer volume of fixes—more than triple June's previous high of approximately 200—underscores the rapidly escalating threat landscape enterprises face. But numbers alone don't tell the story. Embedded within this deluge are two zero-day vulnerabilities already being weaponized by attackers: one affecting on-premises SharePoint Server and another targeting Active Directory Federation Services (AD FS). These aren't the splashy remote-code execution (RCE) flaws that make headlines; they're privilege escalation bugs in systems that control document access and identity infrastructure—arguably more critical to organizational security than their severity ratings suggest.
## The Threat: Two Active Zero-Days
CVE-2026-56164: SharePoint Server Elevation of Privilege
The first zero-day, CVE-2026-56164, affects Microsoft's on-premises SharePoint Server and represents the more immediately dangerous of the two. Microsoft confirms that attackers are actively exploiting this vulnerability in the wild, with credit for discovery going to both Mandiant's incident responders and Google's FLARE team—a combination that typically indicates discovery within active attack campaigns.
The flaw is an unauthenticated, remote elevation-of-privilege vulnerability. This means an attacker requires no credentials and no user interaction to escalate privileges across the network. Microsoft has not disclosed the specific exploitation vector or attacker identity, but the severity of the technical requirements alone makes this a critical priority for patch deployment.
The timing compounds the urgency. Today marks the final day of extended support for SharePoint Server 2016 and 2019. Unlike Windows Server or SQL Server, neither version qualifies for paid Extended Security Updates (ESU), meaning organizations still running these versions are moving into unsupported territory effective tomorrow. For those unable to patch immediately, Microsoft's advisory recommends enabling AMSI (Antimalware Scan Interface) in Full Mode as a partial mitigation.
CVE-2026-56155: Active Directory Federation Services Privilege Escalation
The second exploited zero-day, CVE-2026-56155, affects AD FS—the service responsible for signing and validating authentication tokens across an organization's identity infrastructure. While Microsoft rates this as a local privilege escalation requiring prior authentication, the criticality lies in its position within the trust chain.
AD FS is the gatekeeper for enterprise single sign-on and federation scenarios. A successful privilege escalation on this system could allow an already-authenticated attacker to gain elevated access to the token-signing infrastructure, potentially enabling lateral movement or deeper compromise of the entire authentication estate. Microsoft's DART (Detection and Response Team) identified this flaw during incident response work, again pointing to real-world exploitation.
## Background and Context: Why These Matter More Than They Appear
SharePoint Server has been a persistent attacker target since the ToolShell vulnerability chain devastated unpatched deployments in 2025. That attention has not diminished; if anything, defenders' difficulty keeping pace with SharePoint's complexity makes it an attractive vector for persistent threats.
AD FS faces a different but equally serious challenge: it's a common attack target in campaigns targeting identity infrastructure, particularly in environments where multi-factor authentication (MFA) implementations are incomplete or bypassed.
Notably, neither CVE appears on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing. However, Microsoft's own exploitability ratings already classify both as actively exploited. This timing gap—where vendor data precedes official KEV listings—means security teams should not wait for formal CISA confirmation to prioritize these patches.
## Secondary Vulnerabilities Worth Attention
CVE-2026-55040: SharePoint JWT Authentication Bypass
A third notable vulnerability disclosed this month is CVE-2026-55040, a JWT (JSON Web Token) authentication bypass in SharePoint that Rapid7 Labs built for their Pwn2Own Berlin entry. This flaw carries unusual scoring uncertainty: Rapid7 rates it at 5.3/Medium, while ZDI's analysis suggests 9.1/Critical—a significant divergence that illustrates how severity metrics can mislead.
More critically, Rapid7 chained this authentication bypass to a separate RCE vulnerability to achieve unauthenticated remote code execution. The RCE half of the chain remains unpatched; Microsoft is scheduled to address it in August. This means the JWT bypass fix in July closes one attack path but leaves the threat model incomplete until August's update.
CVE-2026-50661: BitLocker Bypass
A third zero-day, CVE-2026-50661, is a BitLocker bypass that does not currently face active exploitation. This flaw requires physical device access and should be patched, but it does not jump the remediation queue. It does, however, continue a troubling trend of BitLocker bypasses discovered throughout the first half of 2026, suggesting the encryption mechanism warrants deeper security review.
## Patch Prioritization in Context
The 622-vulnerability month presents a real operational challenge: which patches matter most? Microsoft's severity labels are a starting point, but this month offers clear proof they are not the decisive factor.
## Additional Work: Kerberos RC4 Hardening
Beyond the zero-days, this update completes Microsoft's multi-year Kerberos RC4 hardening initiative. Organizations relying on legacy systems that depend on RC4 for Kerberos authentication may experience login failures or compatibility issues with hardened environments. Testing compatibility in development or staging environments before broad rollout is strongly advised.
---
## HackWire Analysis
The raw numbers—622 patches, triple the previous record—can obscure what's actually happening: Microsoft's vulnerability surface continues to expand faster than security teams can cover it. The two actively exploited zero-days are not remote code executions; they're privilege escalation flaws that require different detection and response profiles than the splashy RCEs that dominate security news. This represents a shift in attacker strategy. Rather than seeking immediate shell access, threat actors are increasingly focused on subtle privilege gains in identity and collaboration infrastructure—systems that, once compromised, offer persistent access and lateral movement paths.
The coincidence of SharePoint Server 2016/2019 reaching end-of-support on the same day as this patch release is not random. It's a deadline that forces a decision: patch an aging system one more time, or accelerate migration to SharePoint Online. For defenders managing large, complex SharePoint deployments, this July patch is a forcing function for longer-term planning.
The severity scoring divergence on CVE-2026-55040 (Medium vs. Critical) is a reminder that CVSS numbers describe technical properties, not business risk. A medium-scored authentication bypass that breaks a critical application's authentication is worth more attention than a critical-scored bug in an optional feature. The responsibility for risk assessment belongs to security teams, not scoring algorithms.
Finally, the emergence of multiple BitLocker bypasses this year warrants heightened scrutiny of full-disk encryption deployments. BitLocker remains an important control, but the increasing pace of bypasses suggests defenders should not rely on it as a sole data protection mechanism, particularly for devices at high risk of physical compromise. — *HackWire Editorial*
---
## Related Coverage