Microsoft has rolled out its largest-ever Patch Tuesday update, addressing 622 vulnerabilities across its software ecosystem. The July release significantly surpasses June's update, which fixed around 200 vulnerabilities, making it the company's most extensive security update to date.
Among the fixes are two zero-day vulnerabilities that Microsoft confirmed are already being actively exploited. The flaws impact on-premises SharePoint Server and Active Directory Federation Services (AD FS), making them the highest-priority patches for organizations.
The first flaw, CVE-2026-56164, affects Microsoft SharePoint Server. According to Microsoft, attackers can exploit the vulnerability remotely to gain elevated privileges without requiring authentication, user interaction, or valid credentials. The company credited Mandiant's incident response team and Google's FLARE team for identifying the issue during active attacks, although it has not disclosed details about the threat actors or attack techniques involved.
Organizations running self-hosted SharePoint servers are advised to deploy the update immediately. Microsoft also noted that enabling Antimalware Scan Interface (AMSI) in Full Mode provides additional protection against exploitation. The timing is particularly significant as SharePoint Server 2016 and 2019 have reached the end of extended support, with no Extended Security Updates (ESU) program available for either version.
The second exploited vulnerability, CVE-2026-56155, impacts Active Directory Federation Services (AD FS). The flaw enables an authenticated attacker to elevate privileges locally due to weak access controls. Microsoft's Detection and Response Team (DART) discovered the issue. While Microsoft has not revealed how attackers are leveraging the flaw or the privileges it grants, AD FS plays a critical role in enterprise authentication by issuing security tokens across trusted environments, making the vulnerability particularly important.
Although neither of the two vulnerabilities has been added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog at the time of writing, Microsoft has already classified both as actively exploited. Security experts recommend organizations prioritize these patches without waiting for a KEV listing.
Microsoft also fixed CVE-2026-50661, a publicly disclosed vulnerability affecting BitLocker. The issue allows attackers with physical access to bypass BitLocker protections. Since the flaw cannot be exploited remotely, it is considered less urgent than the actively exploited zero-days but should still be addressed as part of routine patch management.
Another notable update addresses CVE-2026-55040, a SharePoint JWT authentication bypass vulnerability disclosed by Rapid7 Labs. Researchers demonstrated that the flaw could be chained with a separate remote code execution (RCE) vulnerability to achieve unauthenticated code execution on vulnerable servers. Microsoft has confirmed that the authentication bypass is fixed in July, while the associated RCE vulnerability is scheduled to receive a patch in August.
Kerberos RC4 Hardening Completed
The July release also marks the completion of Microsoft's long-running effort to phase out RC4 encryption within Kerberos authentication. The update removes the rollback mechanism that administrators had been using since January.
After installing the update, RC4 authentication will only function for accounts specifically configured to allow it. Organizations are advised to audit service accounts using Microsoft's RC4 audit events and rotate passwords where necessary so that modern AES encryption keys are generated before deploying the update. Failure to prepare legacy systems could lead to authentication failures after patching.
AI-Driven Security Research Expands Patch Volume
Microsoft previously indicated that customers should expect larger Patch Tuesday releases as artificial intelligence improves vulnerability discovery. In a July 9 announcement, the company said it anticipated a "higher volume of security updates included in each security release" due to AI-assisted security research.
The company highlighted its MDASH multi-model agentic scanning platform, which previously identified multiple vulnerabilities in earlier Patch Tuesday releases. However, Microsoft has not disclosed how many of July's 622 vulnerabilities were discovered using the system.
Faster Patching Becoming Increasingly Important
Security experts warn that the growing number of vulnerabilities makes traditional severity-based prioritization less effective. Once patches become publicly available, attackers can rapidly analyze them to develop exploits, significantly reducing the time organizations have to respond.
Rather than relying solely on CVSS scores, experts recommend prioritizing vulnerabilities based on active exploitation indicators, including Microsoft's exploited status, CISA's Known Exploited Vulnerabilities catalog, and Exploit Prediction Scoring System (EPSS) data.
Microsoft's July Patch Tuesday demonstrates how AI-driven vulnerability discovery is accelerating both defensive and offensive security efforts, making timely patch deployment increasingly critical for organizations.
