Massive Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days

Microsoft’s July 2026 Patch Tuesday delivers fixes for approximately 570 vulnerabilities across its product ecosystem, following June’s record-breaking release of 206 flaws that also included three publicly disclosed zero-days.

This massive patch follows the recent Microsoft update on artificial intelligence in vulnerability discovery, deploying a proprietary multi-model agentic scanning system across the Windows codebase

CVE-2026-56164 targets Microsoft SharePoint Server and allows an attacker to escalate privileges on a compromised or authenticated session, a pattern consistent with prior SharePoint EoP flaws that have been chained with RCE bugs for full server takeover. Given active exploitation, on-premises SharePoint farms should be treated as a top patching priority regardless of the “Moderate” severity label, since real-world attack chains often combine low-severity EoP bugs with other flaws for maximum impact.

CVE-2026-56155 affects Active Directory Federation Services (AD FS), Microsoft’s identity federation and SSO infrastructure component, and is also confirmed as exploited in the wild. Because AD FS underpins authentication trust across hybrid Azure AD/on-prem environments, successful exploitation could let an attacker escalate privileges and pivot toward broader identity infrastructure compromise, similar to the AD FS golden SAML attack patterns seen in past campaigns.

CVE-2026-50661 is a Windows BitLocker Security Feature Bypass vulnerability that was publicly disclosed ahead of patch availability, though no active exploitation has been confirmed yet. This mirrors the pattern of the disclosed “YellowKey” BitLocker bypass (CVE-2026-45585) from earlier in 2026, where attackers with physical device access exploited flaws in BitLocker’s recovery environment rather than its core encryption, allowing them to bypass disk encryption on lost or stolen devices.

This month’s rollout includes two Critical-rated Remote Code Execution bugs in SharePoint and Print Spooler, alongside dozens of Important-severity Elevation of Privilege and RCE issues affecting core Windows components.

The July batch spans Windows OS components, Microsoft Office, SharePoint Server, Remote Desktop Services, and Windows Admin Center, with most fixes requiring customer action rather than being resolved automatically via cloud servicing.

Two vulnerabilities stand out as Critical: CVE-2026-58644, a Microsoft SharePoint Remote Code Execution flaw, and CVE-2026-58608, a Windows Print Spooler RCE bug, both categories that have historically been favored attack vectors for ransomware operators and nation-state actors.

Elevation of Privilege remains the dominant bug class this cycle, affecting components like the Windows Kernel, DirectX Graphics Kernel, Desktop Window Manager, and Win32K subsystem, which attackers typically chain with an initial foothold to gain SYSTEM-level access.

Enterprises running SharePoint on-premises deployments should prioritize CVE-2026-58644 given its Critical rating and RCE impact, mirroring the exploitation patterns seen in prior SharePoint zero-day campaigns.

Organizations exposing Remote Desktop Services, Windows Admin Center, or DHCP Server to internal or hybrid networks should also treat CVE-2026-58626, CVE-2026-58631, and CVE-2026-58627 as high priorities, since these affect infrastructure commonly targeted in lateral-movement attacks.

IT administrators should prioritize testing and deploying patches for the two Critical RCE flaws in SharePoint and Print Spooler within the next 48 hours, given their history as high-value targets for exploitation.

Other Patch Tuesday Updates

Attackers Move in Seconds. Defenses Take Hours! Blackpoint Built the Answer – Attend a Free Webinar on AI SOC Agent to contain a live attack.