Microsoft's July 2026 Patch Tuesday shattered every previous record, delivering fixes for 622 unique CVEs — including three zero-days, two of them under active exploitation — and more than 60 critical flaws. The unprecedented volume, which follows a May warning from Microsoft engineering VP Tom Gallagher that AI-driven vulnerability discovery would swell monthly releases, is forcing security teams to rethink triage strategies that lean on CVSS scores alone.

A record-setting release

The July 2026 release notes cover the largest batch of fixes in the program's history. When Gallagher cautioned in May that monthly patch drops would grow because AI tooling was accelerating bug discovery, few anticipated the count would clear 600 only two months later.

The distribution across the product portfolio:

Severity-wise, the numbers are equally stark. "If people want a severity hook, July has 26 vulnerabilities with a CVSS base score above 9.0, and 13 of those sit at 9.8," Fortra lead cybersecurity analyst Josh Taylor noted, while cautioning that CVSS is only one input: the genuine triage problem this month is the combination of actively exploited bugs, a publicly disclosed BitLocker weakness, and the sheer concentration of flaws in Windows and Office. His advice: patch the exploited issues and exposed infrastructure first, not by raw volume.

Researchers at Nightwing went further, declaring on July 14, 2026 that the industry is leaving the classic monthly-cadence model behind and entering an era of continuous, high-volume security updates.

The two actively exploited zero-days

CVE-2026-56155 (CVSS 7.2) is an elevation-of-privilege flaw in Microsoft Active Directory Federation Services. Per the NVD entry, the root cause is insufficient granularity of access control in AD FS, which lets an authorized attacker elevate privileges locally — in practice, all the way to SYSTEM on a federation server. A GitHub security advisory (GHSA-p436-qch3-9m59) tracks the issue as well.

CVE-2026-56164 (CVSS 5.3) is a second elevation-of-privilege bug, this one stemming from missing authentication for a critical function in SharePoint Server. The modest base score understates its relevance: it is already being exploited in the wild.

CISA added both flaws to its Known Exploited Vulnerabilities catalog as part of a July 14 alert covering four new KEV entries (alongside CVE-2026-15410, a SonicWall SMA1000 code-injection vulnerability). Federal agencies face aggressive remediation deadlines: July 17 for the SharePoint Server flaw and July 28 for the AD FS bug.

The publicly disclosed BitLocker bypass

The third zero-day, CVE-2026-50661 (CVSS 6.1), is a security feature bypass in Windows BitLocker. It is publicly known but not yet observed under exploitation. An attacker with physical access to a target machine can sidestep BitLocker's Device Encryption feature and read data that should have remained encrypted — a classic evil-maid / stolen-laptop scenario that matters most for fleets of mobile endpoints.

Other high-priority fixes

Beyond the zero-days, researchers flagged a cluster of high- and critical-severity bugs that deserve a place near the top of the queue:

• CVE-2026-57092 (CVSS 9.9) — a near-maximum-severity flaw in Windows VMSwitch. Successful exploitation lets an attacker break out of a guest VM and compromise the Hyper-V host, making this the single most dangerous bug in the release for virtualization-heavy environments.
• CVE-2026-48561 (CVSS 9.6) — remote code execution in Microsoft Copilot, exploitable by an unauthorized attacker to run arbitrary code on affected systems.
• CVE-2026-55008 (CVSS 9.6) — a spoofing vulnerability in Microsoft Exchange Server allowing an unauthorized attacker to spoof over the network. Microsoft tags this one "Exploitation More Likely."
• CVE-2026-58644 (CVSS 9.8) — remote code execution in SharePoint Server, adding to the pressure on SharePoint administrators already dealing with the exploited CVE-2026-56164.
• CVE-2026-55012 and CVE-2026-55011 (both CVSS 7.8) — a pair of remote code execution flaws in Microsoft Defender, notable because the affected component is the security tooling itself.

AI is breaking the exploitability models

Perhaps the most consequential data point in the release isn't a CVE at all. Tenable senior staff research engineer Satnam Narang pointed out that current exploitability indexes fail to account for how fast AI can now weaponize bugs: Claude's Mythos Preview produced working proof-of-concept exploits for 13 of 14 vulnerabilities that Microsoft had rated "Exploitation Less Likely" or "Exploitation Unlikely."

That gap undermines a core assumption of most patching programs — that low-likelihood ratings buy time. As Narang put it: "CVSS is a good foundation, but it's just a number. Not every CVSS 9.8 is urgent, and not every CVSS <8.0 should be ignored. Context matters. This is one of the core principles of proactive exposure management."

Triage and mitigation guidance

Jack Bicer, director of vulnerability research at Action1, argues the real bottleneck isn't the CVE count but the ability to triage, prioritize, and deploy at speed. His baseline recommendations:

• Maintain a comprehensive asset management program so you know what's actually exposed.
• Enforce phishing-resistant multifactor authentication.
• Run a centralized patch management system.
• Test, deploy, and verify zero-day and critical patches within hours, and high-severity fixes within days.
• Track patch deployment times as a KPI and report the results regularly.

Mayuresh Dani, security research manager at the Qualys Threat Research Unit, says CVSS-only prioritization is finished, and teams should fold in EPSS, the CISA KEV catalog, and the Likely Exploited Vulnerabilities model. He recommends a tiered SLA: "a KEV-listed CVE or EPSS >0.5 should be patched within 24 to 36 hours," with Internet-facing high-privilege infrastructure — VPN gateways, remote admin consoles — as the next tier.

Dani also stresses attack surface reduction as a standing mitigation: don't expose Active Directory Federation Services to the Internet, don't run on-premises SharePoint with public access, and don't leave remote management tools reachable from anywhere. Applied to this month's release, that guidance directly blunts both actively exploited zero-days.

Technical background

The source reporting does not include exploit details or PoC code for these CVEs; the following is general, well-established guidance for this class of release.

For a Patch Tuesday of this size, the practical first step is establishing which in-scope products you actually run and whether the July cumulative updates have landed. Generic examples:

# List recently installed Windows updates on a host
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Check AD FS role presence (prioritize these hosts for CVE-2026-56155)
Get-WindowsFeature ADFS-Federation | Where-Object Installed

# Verify BitLocker status on endpoints relevant to CVE-2026-50661
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus

For exposure reduction while patches roll out, the standard playbook applies: pull AD FS and on-prem SharePoint behind VPN or reverse-proxy authentication rather than direct Internet exposure, restrict Hyper-V host management interfaces to dedicated admin networks (relevant to the VMSwitch escape), and review Exchange transport and authentication logs for spoofing anomalies. Given the KEV listings and federal deadlines, CVE-2026-56155 and CVE-2026-56164 should be treated as patch-now items regardless of sector.