Microsoft July 2026 Patch: 570 Vulnerabilities, 3 Zero‑Days, 2 Exploited in the Wild

Microsoft’s July 2026 Patch Tuesday delivered one of the larger monthly security bundles in recent memory, resolving a record 570 vulnerabilities across Windows and numerous server and enterprise products.

The release includes 59 Critical-rated issues and three zero-day vulnerabilities; two of those zero-days have been confirmed as exploited in the wild and a third was publicly disclosed prior to the update. Remote Code Execution (RCE) flaws represent the largest single class of Critical bugs, underscoring the urgency for rapid patching in exposed environments.

Microsoft’s 570-vulnerability tally excludes fixes shipped outside the monthly bulletin, such as security updates for cloud and online services and Chromium-based Edge, so organizations should not treat this figure as exhaustive for all Microsoft-related risks disclosed in July.

Microsoft July 2026 Patch

Third-party Patch Tuesday trackers also categorize advisories across products and vulnerability types differently, which is why summed counts by vulnerability type (for example, 145 RCEs, 254 Elevation of Privilege, 102 Information Disclosure) exceed the headline total.

The most urgent items in this cycle are two elevation-of-privilege flaws exploited in the wild: CVE-2026-56155 affecting Active Directory Federation Services (AD FS) and CVE-2026-56164 impacting Microsoft SharePoint Server.

Both are rated High and have active exploitation confirmed, meaning defenders should prioritize detection and remediation on internet-facing and high-value AD FS and SharePoint hosts.

A third notable item, CVE-2026-50661, is a publicly disclosed BitLocker security feature bypass; while not currently reported as exploited, its disclosure increases the risk profile for bypassing endpoint disk encryption protections.

July’s bundle is particularly consequential for SharePoint administrators. Beyond the exploited CVE-2026-56164, Microsoft patched CVE-2026-55040, a Critical authentication-bypass in SharePoint that Rapid7 warns could be chained with an additional (still-embargoed) issue to achieve unauthenticated remote code execution.

These fixes arrive alongside the end-of-support milestones for SharePoint Server 2016 and 2019, creating a convergence of risk: organizations on legacy releases should urgently assess upgrade plans, ideally to SharePoint Subscription Edition, or implement compensating controls while they patch.

Critical RCE patches touch many ubiquitous Microsoft services: Windows Print Spooler, DHCP, Remote Desktop, Media Foundation, Active Directory Domain Services, SQL Server, Microsoft Office, and Microsoft Defender.

Because these components commonly run with elevated privileges or sit in high-connectivity network locations, remaining unpatched increases the chance of widespread compromise after a successful exploit. Security teams must identify exposed assets, prioritize patch rollout to high-touch infrastructure, and validate successful deployment

Recommended actions (practical steps)

• Immediately deploy July updates for internet-facing SharePoint, AD FS, Exchange, Remote Desktop, DHCP, DNS, and domain controllers.
• Search for indicators of compromise on SharePoint and AD FS servers (pre- and post-patch), focusing on file changes, anomalous authentication events, and unusual network connections tied to the exploited CVEs.

July’s Patch Tuesday is a stark reminder that attackers continue to target identity, collaboration, and privilege planes, AD FS and SharePoint among them.

With multiple in-the-wild exploits and a heavy concentration of RCEs affecting enterprise-critical services, defenders should treat this update as high priority: inventory affected assets, deploy patches quickly, and hunt actively for signs of compromise.