Introduction
Microsoft patches record 622 flaws in its largest Patch Tuesday release so far, and attackers are already exploiting two of them in active campaigns.
The July 2026 Patch Tuesday release covers 622 Microsoft CVEs. Two exploited zero-days stand out immediately: CVE-2026-56164 in on-premises SharePoint Server and CVE-2026-56155 in Active Directory Federation Services.
This release also lands during a major shift in Microsoft vulnerability management. Microsoft has warned customers to expect larger security updates as AI helps defenders find more flaws earlier. Its MDASH, or Multi-Model Agentic Scanning Harness, has already helped identify vulnerabilities across the Windows networking and authentication stack.
The patch load is not the only problem. This release also advances Kerberos RC4 hardening, adds urgency around SharePoint Server lifecycle risk, and includes a SharePoint JWT authentication bypass that Rapid7 chained with a separate RCE issue.
This article explains what to patch first, why CVSS-only triage fails at this scale, how the Kerberos RC4 change can break service accounts, and how security teams should prioritize the Microsoft July 2026 Patch Tuesday release.
For related enterprise patching context, see Digital Warfare’s Chrome security update analysis
Why Microsoft Patches Record 622 Flaws Now
Microsoft patches record 622 flaws as AI-assisted vulnerability discovery changes the speed of software security.
Microsoft said on July 9 that customers should expect a higher volume of security updates in each release as AI helps defenders identify more issues earlier. That means larger Patch Tuesday releases may become normal rather than unusual.
This shift helps defenders because it brings more issues into the open and gives organizations fixes. However, it also creates pressure. Security teams must absorb more CVEs, test more patches, and decide faster which systems need urgent action.
Attackers also benefit from speed. Once a patch ships, they can compare the new build against the old one, identify the changed code, and develop working exploits before slow patch programs finish testing.
That makes delayed patching more dangerous. The old habit of waiting a week before action no longer fits a release this large.
The Two Zero-Days to Patch Before Everything Else
The first priority is not the vulnerability with the highest score. It is the vulnerability already under attack.
The July release includes two actively exploited elevation-of-privilege flaws in critical enterprise infrastructure. One affects SharePoint Server. The other affects AD FS.
Both matter because they sit near sensitive business functions. SharePoint stores enterprise data and collaboration content. AD FS supports identity and token issuance across connected services.
Security teams should patch both before lower-priority issues, even if some other CVEs carry higher numerical scores.
CVE-2026-56164: SharePoint Server Under Active Attack
CVE-2026-56164 affects on-premises Microsoft Office SharePoint Server. NVD describes it as missing authentication for a critical function that allows an unauthorized attacker to elevate privileges over the network.
This makes the vulnerability urgent. It does not require valid credentials, and it affects a platform that often stores sensitive business documents, workflows, and internal collaboration data.
Microsoft confirmed exploitation in the wild. That means organizations should not wait for normal maintenance windows if their SharePoint servers are exposed or business critical.
Administrators should patch supported SharePoint environments, review access logs, enable available hardening controls, and check for unusual activity on SharePoint servers.
Digital Warfare previously covered related Microsoft browser patching pressure in 7 Critical Microsoft Edge Risks Every Team Must Patch Now
CVE-2026-56155: AD FS Privilege Escalation Under Active Attack
CVE-2026-56155 affects Active Directory Federation Services. NVD describes it as insufficient granularity of access control in AD FS that allows an authorized attacker to elevate privileges locally.
The local classification can make the issue look less urgent than it is. AD FS plays a central role in identity infrastructure. It supports authentication flows and token trust relationships across enterprise environments.
Microsoft’s guidance explains that AD FS relies on the Distributed Key Manager container to store symmetric keys used to protect token-signing and token-encryption certificate private keys. If access controls around that material are overly permissive, attackers can gain dangerous access to identity trust material.
That makes this flaw a priority for every organization that still depends on AD FS.
Security teams should patch AD FS servers, review DKM container permissions, inspect privileged access activity, and monitor for signs of token abuse.
For related Active Directory threat context, see Digital Warfare’s Active Directory Faces a Dangerous New AI Script Threat.
The Third Zero-Day: BitLocker Bypass
CVE-2026-50661 is the third zero-day in the July release.
Microsoft publicly disclosed the issue, but the available reporting indicates it was not confirmed as actively exploited at release time. It affects BitLocker and requires physical access to the device.
That makes it important but not the first emergency patch for most organizations. Physical-access requirements reduce the likelihood of broad remote exploitation.
Security teams should still patch it in the normal cycle, especially for laptops, executive devices, regulated systems, and devices exposed to travel or theft risk.
The SharePoint JWT Bypass Chain Coming in August
Rapid7 disclosed CVE-2026-55040, a SharePoint JWT token authentication bypass.
The issue matters because Rapid7 chained it with a separate RCE vulnerability to achieve unauthenticated remote code execution against a vulnerable SharePoint server. Microsoft fixed the JWT bypass in July, while the RCE component was planned for a later update.
That means the July patch still matters. Breaking the authentication bypass breaks the practical exploit chain.
Organizations running SharePoint should patch CVE-2026-55040 quickly, then plan to apply the follow-up SharePoint RCE fix as soon as Microsoft releases it.
This is another example of why medium-severity labels can hide high operational risk when attackers can chain vulnerabilities.
The Kerberos RC4 Change That Can Break Service Accounts
The July update also advances Microsoft’s Kerberos RC4 hardening.
This matters because some organizations still have service accounts that request RC4 Kerberos tickets. After hardening changes land, those accounts can fail authentication if they have not been prepared for AES.
The right sequence matters.
First, identify service accounts still requesting RC4. Then rotate passwords for flagged service accounts so Windows can generate fresh AES keys. After that, deploy the update and monitor authentication logs.
Skipping this sequence can create an operational outage. It may look like a security incident at first, but the root cause can be legacy Kerberos behavior.
Security teams should coordinate identity, infrastructure, and application owners before broad Windows patch deployment.
Timeline: July 2026 Microsoft Patch Tuesday
January 2026 marked the start of Microsoft’s Kerberos RC4 hardening sequence and related audit preparation.
In May 2026, Microsoft publicly detailed MDASH and said its agentic security system helped researchers find 16 new vulnerabilities across Windows networking and authentication components.
On July 9, 2026, Microsoft warned that customers should expect higher volumes of security updates as AI helps defenders discover more issues earlier.
On July 14, 2026, Microsoft released the July Patch Tuesday update with 622 CVEs, three zero-days, and two vulnerabilities confirmed as exploited.
SharePoint Server 2019 also reached the end of its documented support lifecycle on July 14, 2026, according to Microsoft’s lifecycle page.
Rapid7 also disclosed the SharePoint JWT authentication bypass chain in July, with the RCE component handled separately.
What Each Product Family Contains
Windows carries the largest share of this release. It includes AD FS CVE-2026-56155 and BitLocker CVE-2026-50661, along with a large set of platform vulnerabilities.
Office carries a significant volume of CVEs, but security teams should distinguish unique vulnerabilities from duplicate product tracks.
Microsoft Edge includes both Chromium-related updates and Microsoft-specific browser issues.
Developer Tools include flaws across Visual Studio, VS Code, and related developer platforms.
SharePoint Server requires urgent attention because it includes CVE-2026-56164 and CVE-2026-55040.
SQL Server, Defender, Exchange, Azure, and other Microsoft products also need review, especially where assets are internet-facing or business-critical.
Why CVSS-Only Triage Fails This Month
CVSS scores help, but they cannot drive the whole response.
A 622-CVE release creates too much noise. Many vulnerabilities carry high or critical ratings, and teams cannot patch every asset at once.
The two exploited zero-days prove the point. Their real-world risk comes from active exploitation and asset importance, not only the score.
Security teams should triage using four factors.
First, patch vulnerabilities that Microsoft marks as exploited. Second, prioritize internet-facing and identity systems. Third, use EPSS and threat intelligence to identify likely exploitation. Fourth, factor in business criticality.
That approach puts SharePoint and AD FS at the top where they belong.
Enterprise Impact of a 622-CVE Patch Tuesday
Microsoft patches record 622 flaws at a time when many security teams already struggle with patch backlogs.
The operational impact is significant. Teams must test more updates, prioritize more CVEs, coordinate more system owners, and manage more change windows.
The release also shows that AI-assisted discovery can increase defender workload. Finding more bugs is positive, but remediation still depends on people, process, testing, and deployment capacity.
Organizations that rely on slow monthly patch routines need to adjust. Patch management now requires continuous risk triage, faster emergency patch workflows, and clearer ownership of high-value systems.
Digital Warfare covered similar supply chain and developer-tool pressure in 7 Powerful TeamPCP Lessons Every Developer Must Know Now
SharePoint Administrators Face Immediate Pressure
SharePoint administrators should treat this release as urgent.
CVE-2026-56164 is already under attack, and CVE-2026-55040 breaks part of a SharePoint exploit chain disclosed by Rapid7.
SharePoint also stores sensitive content. A compromise can expose documents, internal workflows, business records, employee data, and regulated information.
Administrators should patch immediately, confirm server versions, enable available hardening controls, review authentication logs, and check for unexpected changes.
Organizations running older SharePoint versions should plan migration without delay.
Identity Teams Must Prioritize AD FS
Identity teams should patch AD FS quickly.
CVE-2026-56155 affects a platform that supports enterprise authentication and trust. Weak access controls around AD FS key material can create risk far beyond one server.
Attackers value identity systems because they unlock connected services. A privilege escalation on AD FS can support broader access if defenders miss the early signal.
Teams should patch AD FS, review DKM permissions, monitor privileged activity, and inspect token-related anomalies.
They should also coordinate this work with Kerberos RC4 audit planning.
Real-World Attack Scenarios
In a SharePoint zero-day scenario, an attacker scans for vulnerable on-premises SharePoint servers. They find an unpatched environment, exploit CVE-2026-56164, and gain elevated access. From there, they search document libraries for contracts, credentials, financial data, and sensitive internal files.
In an AD FS escalation scenario, an attacker already has low-privilege access. They exploit CVE-2026-56155 on an AD FS host and gain access to sensitive identity trust material. That access increases the attacker’s ability to move across systems that depend on AD FS.
In a Kerberos outage scenario, an organization deploys Windows patches before auditing RC4. Legacy service accounts continue requesting RC4 tickets, authentication fails, and business services break during a maintenance window.
These scenarios follow the confirmed technical risk areas from Microsoft guidance, public vulnerability details, and Rapid7’s SharePoint disclosure. They do not assume unverified exploitation beyond the reported mechanics.
How to Prioritize Microsoft Patches Record 622 Flaws
Start with SharePoint CVE-2026-56164. It is exploited, network-accessible, and affects sensitive collaboration infrastructure.
Next, patch AD FS CVE-2026-56155. Identity infrastructure should always receive priority when exploitation is confirmed.
Then complete the Kerberos RC4 audit before broad Windows deployment. Identify service accounts still using RC4 and rotate their passwords so AES keys exist.
After that, patch SharePoint CVE-2026-55040 to break the Rapid7 JWT bypass chain.
Finally, patch BitLocker CVE-2026-50661 in the standard cycle, with priority for devices exposed to physical risk.
For structured prioritization support, see Digital Warfare’s vulnerability assessment services
Priority One: Patch SharePoint CVE-2026-56164
Patch all supported on-premises SharePoint servers immediately.
Focus first on internet-facing servers, externally reachable collaboration portals, and systems that store regulated or sensitive business content.
After patching, review logs for suspicious requests, authentication anomalies, privilege changes, unexpected file access, and new administrative behavior.
Teams should also verify SharePoint version status and confirm whether migration planning is required for unsupported environments.
Priority Two: Patch AD FS CVE-2026-56155
Patch all AD FS servers next.
AD FS sits close to enterprise identity trust. That makes it more important than a normal local privilege escalation issue.
Review AD FS audit logs, inspect DKM container permissions, and monitor for unusual activity involving token-signing or token-encryption material.
Identity incidents can spread quickly because downstream services trust issued tokens.
Priority Three: Complete the Kerberos RC4 Audit
Do not deploy Windows patches blindly across environments that still rely on legacy Kerberos behavior.
Use audit events to identify accounts requesting RC4 Kerberos tickets. Then rotate passwords for the flagged service accounts so AES keys are generated.
Coordinate with application owners before making changes to service accounts.
After deployment, monitor authentication failures, Kerberos ticket requests, and service health.
Priority Four: Patch the SharePoint JWT Bypass
Patch CVE-2026-55040 across SharePoint environments.
Rapid7 showed that this issue can form part of a broader exploit chain. Even though the RCE component was separate, the authentication bypass weakens the boundary that protects SharePoint.
Applying the July fix breaks that chain at the authentication stage.
Security teams should plan for the follow-up SharePoint RCE update as soon as it becomes available.
Priority Five: Patch the BitLocker Bypass
Patch CVE-2026-50661 in the normal patch cycle.
Give higher priority to mobile devices, executive laptops, regulated endpoints, shared workstations, and systems exposed to theft or physical access.
BitLocker bypass issues matter most when attackers can touch the device.
Device control, physical security, and endpoint monitoring should support the patch.
Additional Issues to Review After the Emergency Fixes
After the two exploited zero-days and Kerberos preparation, review Exchange, Defender, SQL Server, Edge, Office, and Developer Tools issues.
Exchange deserves careful review because enterprise email platforms create high-impact opportunities when attackers can execute script, spoof content, or abuse trusted sessions.
Defender vulnerabilities also deserve attention because endpoint protection infrastructure supports detection and containment.
SQL Server vulnerabilities should be prioritized where databases are exposed, business-critical, or connected to regulated data.
Developer tool issues matter where engineering environments connect to source code, CI/CD, secrets, and deployment pipelines.
Broader Security Lessons From the Record Patch Release
This release shows that patch management has entered a new phase.
AI-assisted discovery gives vendors more ways to find vulnerabilities. That is good for defense, but it increases patch volume.
Attackers can also move faster after patches ship. They can reverse engineer fixes, build proof-of-concept exploits, and target organizations that wait too long.
Security teams need threat-informed patching. That means prioritizing exploited flaws, exposed assets, identity systems, and business-critical platforms before lower-risk issues.
The release also shows why end-of-life systems create permanent security debt. Unsupported platforms cannot keep pace with modern vulnerability discovery.
Why AI Changes Vulnerability Management
AI does not remove human review, but it changes scale.
Microsoft’s MDASH work shows how agentic systems can help find vulnerabilities earlier and across large codebases.
That also means security teams should expect more disclosures, more patches, and more triage pressure.
Organizations should prepare now by improving asset inventory, patch automation, emergency change processes, and vulnerability prioritization.
The future patch problem is not just finding vulnerabilities. It is absorbing the volume and fixing the right systems first.
Why Identity Systems Need Special Treatment
Identity systems deserve priority because they control trust.
AD FS, Active Directory, token-signing infrastructure, and Kerberos all sit near the center of enterprise authentication.
A vulnerability in one of these systems can have a broader impact than its CVSS score suggests.
Security teams should rank identity infrastructure above ordinary servers during emergency patch decisions.
They should also monitor identity logs continuously after applying patches.
Key Takeaway on Microsoft Patches Record 622 Flaws
Microsoft patches record 622 flaws in July 2026, including two exploited zero-days in SharePoint and AD FS.
The main lesson is simple. Patch exploited vulnerabilities first, prioritize identity and collaboration systems, prepare for Kerberos RC4 hardening, and avoid CVSS-only triage.
SharePoint CVE-2026-56164 and AD FS CVE-2026-56155 should lead the patch sequence.
Kerberos RC4 audits should happen before broad Windows deployment.
SharePoint CVE-2026-55040 should follow quickly because it breaks a disclosed exploit chain.
BitLocker CVE-2026-50661 should remain in the patch plan, especially for devices exposed to physical access risk.
What Organizations Should Do Now
Identify every on-premises SharePoint server and patch CVE-2026-56164 immediately.
Patch AD FS servers for CVE-2026-56155 and review DKM container access controls.
Run Kerberos RC4 audits before broad Windows patch deployment. Rotate passwords for flagged service accounts so AES keys exist.
Patch SharePoint CVE-2026-55040 to break the JWT bypass chain disclosed by Rapid7.
Patch BitLocker CVE-2026-50661 in the standard cycle, with priority for high-risk devices.
Review Exchange, Defender, SQL Server, Edge, Office, and Developer Tools vulnerabilities after the emergency items.
For the one external source in this article, review Microsoft’s official Security Update Guide: Microsoft Security Update Guide
Frequently Asked Questions About Microsoft Patches Record 622 Flaws
Why Did Microsoft Patches Record 622 Flaws This Month?
Microsoft patches record 622 flaws because vulnerability discovery is accelerating. Microsoft has said customers should expect higher security update volumes as AI helps defenders discover more issues earlier.
What Are the Two Exploited Zero-Days?
The two exploited zero-days are CVE-2026-56164 in on-premises SharePoint Server and CVE-2026-56155 in Active Directory Federation Services.
Why Is SharePoint CVE-2026-56164 So Urgent?
SharePoint CVE-2026-56164 is urgent because it affects on-premises SharePoint Server, allows privilege escalation over the network, and Microsoft confirmed active exploitation.
Why Is AD FS CVE-2026-56155 Dangerous?
AD FS CVE-2026-56155 is dangerous because AD FS supports enterprise identity and token trust. A privilege escalation issue on AD FS can create broader risk across systems that rely on AD FS.
What Is CVE-2026-55040?
CVE-2026-55040 is a SharePoint JWT token authentication bypass disclosed by Rapid7. Rapid7 chained it with a separate RCE issue to achieve unauthenticated remote code execution against vulnerable SharePoint servers.
What Is the Kerberos RC4 Issue?
The Kerberos RC4 issue relates to Microsoft hardening legacy RC4 behavior. Service accounts that still request RC4 tickets can fail authentication unless teams audit and rotate those accounts before patch deployment.
How Should Teams Prioritize the 622 CVEs?
Teams should patch exploited vulnerabilities first, especially SharePoint CVE-2026-56164 and AD FS CVE-2026-56155. Then they should complete Kerberos RC4 preparation, patch SharePoint CVE-2026-55040, and address BitLocker CVE-2026-50661.
Should Teams Use CVSS Alone for This Patch Tuesday?
No. CVSS alone is not enough for a 622-CVE release. Teams should combine exploitation status, asset exposure, identity impact, EPSS, business criticality, and operational risk.
