Microsoft has shipped its July 2026 Patch Tuesday updates, closing a record-setting 570 security flaws across its product line — the largest monthly batch the company has ever released. The rollup includes fixes for three zero-day vulnerabilities: two under active exploitation, in Active Directory Federation Services (CVE-2026-56155) and SharePoint Server (CVE-2026-56164), and one publicly disclosed BitLocker bypass (CVE-2026-50661). Fifty-nine of this month's bugs carry a "Critical" severity rating, the bulk of them remote code execution issues.

July 2026 by the numbers

Of the 59 Critical-rated vulnerabilities, 48 enable remote code execution, 9 allow elevation of privilege, 1 is a security feature bypass, and 1 is a spoofing issue.

The approximate breakdown by vulnerability class:

  • 254 Elevation of Privilege vulnerabilities
  • 145 Remote Code Execution vulnerabilities
  • 102 Information Disclosure vulnerabilities
  • 17 Security Feature Bypass vulnerabilities

These totals count only fixes Microsoft published today. They exclude issues resolved earlier in the month in Mariner, Azure OpenAI, Azure Synapse, M365 Copilot, Microsoft Exchange Online, Microsoft Edge for Android, and the Microsoft Entra Provisioning Service. Also left out are an enormous 468 Microsoft Edge/Chromium bugs that Google patched this month; for comparison, Google fixed 360 flaws during June's cycle that were subsequently ported into Edge.

The unprecedented volume didn't come out of nowhere. Microsoft signaled last week that Patch Tuesday counts would climb as the company ramps up an AI-powered vulnerability discovery system designed to surface weaknesses across the Windows codebase before attackers find them first.

The two actively exploited zero-days

CVE-2026-56155 — AD FS elevation of privilege

The first exploited-in-the-wild flaw affects Active Directory Federation Services and hands attackers administrative rights. Microsoft describes the root cause as insufficient granularity of access control in AD FS, which lets an authorized attacker elevate privileges locally.

Notably, the discovery is credited to Jeremy Kingston and Scott Clark of the Microsoft Detection and Response Team (DART) — Microsoft's incident response unit — a strong hint the bug surfaced during a real-world intrusion investigation. Microsoft has released no details about how it was abused in attacks.

References: MSRC advisory for CVE-2026-56155, NVD entry, CVE.org record.

CVE-2026-56164 — SharePoint Server elevation of privilege

The second exploited zero-day sits in Microsoft SharePoint Server and can be triggered remotely. According to Microsoft, missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network — meaning no valid credentials are required to reach the vulnerable code path.

Microsoft notes that defenders can blunt exploitation by enabling the Antimalware Scan Interface (AMSI) on SharePoint servers and setting the Request Body Scan mode to Full, which forces inspection of complete inbound request bodies before SharePoint processes them.

Credit goes to Jayson Frost of Mandiant Incident Response, Genwei Jiang of Google Cloud, FLARE OTF, and an anonymous researcher. As with the AD FS bug, no exploitation details have been made public.

References: MSRC advisory for CVE-2026-56164.

The publicly disclosed zero-day

CVE-2026-50661 — BitLocker security feature bypass

The third zero-day, disclosed publicly before a fix was available, undermines Windows BitLocker. Microsoft explains that a successful attacker could bypass the BitLocker Device Encryption feature on the system storage device, and that an attacker with physical access to the target machine could leverage the flaw to read data that should be protected by encryption. The finding is attributed to an anonymous researcher.

Reference: MSRC advisory for CVE-2026-50661.

Non-security updates and full details

Administrators looking beyond security fixes should note that Microsoft also published the Windows 11 KB5101650 and KB5099414 cumulative updates and the Windows 10 KB5099539 extended security update today. The complete list of resolved vulnerabilities — with per-CVE descriptions and affected products — is available through Microsoft's update guide advisories linked above.

Technical background

The following is general context on the vulnerability classes involved this month; Microsoft has not published exploitation specifics for any of the three zero-days.

  • AD FS privilege escalation flaws are attractive to attackers because AD FS servers broker authentication for an entire identity federation. Access-control bugs at this tier can let a low-privileged but authenticated user perform actions reserved for administrators — and control of AD FS historically enables downstream abuse such as token forgery against federated services, which is why identity-tier servers should be treated with domain-controller-level hardening and monitoring.
  • Missing-authentication flaws in SharePoint typically mean an endpoint or internal function fails to verify the caller before executing a sensitive operation, letting unauthenticated network requests reach privileged logic. AMSI integration with Full request-body scanning helps because endpoint security products get visibility into the entire payload of incoming HTTP requests before SharePoint acts on them.
  • BitLocker physical-access bypasses generally target the pre-boot trust chain — for example, weaknesses in how keys are released or how the boot path is validated — allowing someone with hands-on access to a lost or stolen device to reach plaintext data. Standard mitigations for this class include requiring a TPM+PIN pre-boot authentication factor and applying the vendor fix promptly.

Other vendors patching this cycle

Microsoft is far from alone this month. Recent vendor activity includes:

Given active exploitation of the AD FS and SharePoint bugs, organizations running either service should prioritize this month's updates — and SharePoint administrators unable to patch immediately should enable AMSI with Request Body Scan set to Full as an interim mitigation.