# Microsoft's Massive July Patch Tuesday Breaks Records With 622 Vulnerabilities—Including Two Active Zero-Days
## The Threat
Microsoft released patches for a record-shattering 622 vulnerabilities during July 2026 Patch Tuesday, marking the largest monthly vulnerability disclosure from the company in a single calendar month. Among the critical fixes are two zero-day flaws that are actively being exploited in the wild—a privilege escalation vulnerability in Active Directory Federation Services and a network-accessible remote code execution bug in SharePoint Server that requires no authentication to trigger.
The two exploited zero-days represent an immediate threat to enterprises worldwide. CVE-2026-56155 affects AD FS and allows local attackers to escalate privileges to administrator level—a foothold that could grant adversaries complete control over an organization's identity infrastructure. Meanwhile, CVE-2026-56164 in SharePoint Server is particularly dangerous because it bypasses authentication entirely, meaning attackers can trigger privilege escalation from the network without needing valid credentials. These dual exposures suggest that threat actors have been actively hunting Microsoft infrastructure and successfully weaponizing these flaws before Microsoft could release patches.
Adding to the urgency, CVE-2026-50661, a BitLocker security feature bypass, was publicly disclosed before the patch Tuesday release. This flaw opens the door to physical attackers who can extract encryption keys or bypass disk protection on systems believed to be securely encrypted. While physical attacks require on-site access, the disclosure compounds the risk landscape for organizations that have relied on BitLocker as a perimeter defense.
## Severity and Impact
| CVE ID | Product | CVSS Score | Attack Vector | Authentication | Severity |
|--------|---------|------------|----------------|-----------------|----------|
| CVE-2026-56155 | Active Directory Federation Services | 8.8 | Local | Required | Critical |
| CVE-2026-56164 | SharePoint Server | 9.8 | Network | Not Required | Critical |
| CVE-2026-50661 | BitLocker | 6.8 | Physical | Not Required | High |
| CVE-2026-57092 | Windows VMSwitch | 9.9 | Network | Not Required | Critical |
| CVE-2026-50522 | SharePoint Server | 9.8 | Network | Not Required | Critical |
| CVE-2026-55008 | Exchange Server | 8.6 | Network | Not Required | Critical |
| CVE-2026-56190 | Remote Desktop Protocol | 9.1 | Network | Not Required | Critical |
| CVE-2026-50518 | Windows DHCP Server | 9.1 | Network | Not Required | Critical |
| CVE-2026-56188 | Windows Server Network Driver | 9.1 | Network | Not Required | Critical |
| CVE-2026-55010 | Minecraft Bedrock Dedicated Server | 8.8 | Network | Not Required | Critical |
Vulnerability Distribution:
## Affected Products
Core Infrastructure & Identity:
Productivity & Collaboration:
Systems & Servers:
Security & Management:
Other Services:
## Mitigations
Immediate Actions:
1. Prioritize critical patches: Prioritize deployment of patches for CVE-2026-56155 (AD FS), CVE-2026-56164 (SharePoint), CVE-2026-57092 (VMSwitch), and CVE-2026-50522 (SharePoint) across your environment.
2. Apply patches to AD infrastructure: Active Directory is a prime attack target—deploy AD FS patches immediately to reduce identity compromise risk.
3. Test in staging first: With 622 patches, extensive testing is essential before production rollout to avoid service disruptions.
4. Review network segmentation: For critical systems like SharePoint and Exchange, ensure proper network segmentation limits attack surface.
Short-term Workarounds:
1. Disable unnecessary services: If SharePoint or AD FS are not actively used, consider disabling them until patches are validated.
2. Restrict RDP access: Limit Remote Desktop Protocol access to trusted networks and use VPN-only access where possible.
3. Monitor for exploitation: Enable enhanced logging on AD, Exchange, and network drivers to detect active exploitation attempts.
4. BitLocker physical security: For systems running affected BitLocker versions, enhance physical security controls on servers.
Long-term Hardening:
1. Implement Zero Trust architecture: Reduce reliance on implicit trust within identity systems by enforcing continuous authentication.
2. Monitor for breach indicators: Review logs for exploitation patterns tied to the exploited zero-days.
3. Update patch management cadence: Establish a faster patching cycle for infrastructure critical systems given the accelerating vulnerability discovery rate.
4. Inventory exposure: Conduct a thorough audit of externally facing SharePoint, Exchange, and RDP instances.
## References
## HackWire Analysis
The July 2026 Patch Tuesday represents a fundamental shift in how vulnerabilities are discovered and disclosed at scale. Microsoft's revelation that it is using AI-powered multi-model agentic scanning harness (MDASH) to surface bugs faster is both a technological achievement and a warning sign for the entire industry. The company's executive VP explicitly noted that "vulnerability discovery is not treated as a separate activity, but as part of how we build, review, and improve Windows before new features or updates are released." This signals that AI-assisted vulnerability scanning is moving from a research lab exercise to a core part of the Windows development pipeline.
The consequences are already visible: 622 vulnerabilities in a single month is not just an administrative headache for IT teams—it represents a new security reality where defenders must process and deploy patches at velocities far exceeding historical norms. The two actively exploited zero-days suggest that threat actors are operating at similar velocity. The fact that AD FS and SharePoint zero-days were exploited before patching indicates that attackers may be using their own AI-assisted fuzzing or reverse-engineering tools to identify high-impact flaws at comparable speed.
Organizations should treat this as a dry run for the post-patch-Tuesday world. Enterprises that struggle to deploy 622 patches within the first week will face increasing risk as attackers weaponize the first 72 hours post-disclosure. The year-to-date CVE count already exceeds previous full-year totals, and we're only partway through 2026. This pattern suggests that vulnerability saturation is now the baseline condition, not the exception.
The deeper concern is defender asymmetry: AI can generate more vulnerabilities faster than traditional manual auditing can discover them, but deploying patches still requires human coordination, testing, and validation. Every organization should stress-test its patching infrastructure now, before the next massive batch arrives.
— HackWire Editorial
## Related Coverage