Microsoft's July 2026 Patch Tuesday landed on July 14 as the largest security update in the company's history — 622 CVEs, more than triple the previous monthly record — with two actively exploited zero-days that CISA added to its Known Exploited Vulnerabilities catalog the same day.
SharePoint CVE-2026-56164: unauthenticated privilege escalation, already in use
The most urgent bug is CVE-2026-56164, a missing-authentication flaw in on-premises SharePoint Server 2016, 2019 and Subscription Edition that lets an unauthenticated network attacker escalate privileges without credentials or user interaction. Microsoft assigned a CVSS score of 5.3 — a "moderate" rating that has drawn unanimous industry criticism, given that the U.S. National Vulnerability Database independently scored it 9.8. CISA set a July 17 remediation deadline for Federal Civilian Executive Branch agencies. Attackers are already chaining CVE-2026-56164 with older SharePoint weaknesses to steal IIS machine keys, establish persistence and deploy malware — the same operational fingerprint as the 2025 ToolShell campaign that swept unpatched servers across finance, healthcare, government and energy sectors. Microsoft credits discovery to incident responders including Mandiant and Google's FLARE team, meaning the bug was found during live intrusions.
AD FS CVE-2026-56155: 'local' bug with a token-forging blast radius
CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services (CVSS 7.8). Microsoft labels the attack "local," but the practical impact is anything but: AD FS signs the authentication tokens trusted by every federated cloud and on-premises app, so an attacker who reaches administrator on an AD FS host can forge tokens and impersonate any user across the entire federated estate. Microsoft's incident-response unit DART discovered the bug during a live intrusion investigation. CISA's federal deadline for AD FS remediation is July 28. A third zero-day, CVE-2026-50661, is a BitLocker protection-mechanism bypass requiring physical device access.
End-of-life SharePoint, Kerberos RC4 removal compound the pain
SharePoint Server 2016 and 2019 reached end of extended support on the exact day the patch shipped, meaning organizations still on those versions will get no further security updates from Microsoft. In the same cumulative update, Microsoft permanently removed the Kerberos RC4 rollback registry key tied to CVE-2026-20833 — a change with no security alert and no recovery path. Service accounts running on RC4-only keys will silently fail authentication with event ID 4769 error code 0x19, taking down SQL Server linked servers, Windows-auth application pools and Java apps that specify rc4-hmac in krb5.ini. The remediation sequence — audit event IDs 4768 and 4769 for RC4 tickets first, reset flagged service-account passwords, then deploy the update — is mandatory before rollout, not optional.
AI-assisted discovery is the new floor, not a spike
Five days before the release, Microsoft EVP for Windows and Devices Pavan Davuluri told customers to expect permanently elevated patch volumes. The driver is MDASH, Microsoft's multi-model agentic scanning harness, a production pipeline of 100+ specialized AI agents that models attack surfaces, debates candidate findings and builds proof-of-concept triggers before any bug reaches engineering. MDASH scored 88.45% on the CyberGym benchmark in May and 96.55% by Build 2026, and surfaced 16 previously unknown Windows vulnerabilities in a single month, including four critical RCEs. The 622-CVE total is not a one-time backlog clear — it is what a permanent AI-assisted discovery pipeline looks like, and enterprise patch programs sized for 100-200 CVEs per month are now operating on a structurally wrong baseline.
The July update lands weeks after other high-severity flaws hit the same infrastructure, including the CVE-2026-45659 SharePoint RCE and the WordPress wp2shell force patch. Meanwhile the White House this week launched an AI Cybersecurity Coordination Group with Anthropic, OpenAI, Meta and Nvidia, formalizing information sharing on flaws that AI models help surface.
Reporting based on coverage from Tech Times, Tenable, BleepingComputer and CISA advisories.