Microsoft's record Patch Tuesday fixes 622 flaws, including two exploited zero-days

Microsoft shipped its largest Patch Tuesday on record, fixing 622 vulnerabilities, more than triple June's previous high, and two of them are already being exploited. Both live bugs are privilege-escalation flaws in identity and collaboration infrastructure rather than flashy remote code execution: CVE-2026-56164 in on-premises SharePoint Server lets an unauthenticated attacker escalate over the network, and CVE-2026-56155 in Active Directory Federation Services lets an authenticated attacker gain higher privileges, both found by incident responders inside real attacks. A third zero-day, a BitLocker bypass needing physical access, was publicly disclosed but not exploited. The sheer volume, driven partly by AI-assisted bug finding, makes prioritizing by exploitation status, not severity score, essential this month.

Check

Prioritize the two actively exploited flaws first: patch on-premises SharePoint Server and AD FS immediately, then internet-facing and identity systems, and confirm updates actually installed given the volume.

Affected

Organizations running on-premises SharePoint Server or AD FS are at immediate risk from the exploited zero-days (CVE-2026-56164, CVE-2026-56155); the wider release also affects Windows, Office, Exchange, SQL Server, and more.

Fix

Deploy the July updates, leading with the exploited SharePoint and AD FS flaws, review authentication and privilege-change logs on those systems, and enable AMSI in Full Mode on SharePoint.