Three Zero-Days, 570 Flaws: Microsoft's July 2026 Patch Tuesday Sets a New Record
Summary
Microsoft's July 2026 Patch Tuesday delivered the company's largest monthly security update to date, addressing 570 vulnerabilities across Windows, Microsoft Office, SharePoint Server, Active Directory, Hyper-V, Remote Desktop, DHCP, Microsoft Dynamics, Defender, Exchange Server, .NET, Visual Studio, Copilot, and numerous core operating system components.
The release includes three zero-day vulnerabilities, two of which were already being exploited in real-world attacks. The actively exploited flaws affect Active Directory Federation Services and Microsoft SharePoint Server, placing enterprise identity and collaboration infrastructure at immediate risk. A third publicly disclosed vulnerability could allow an attacker with physical access to bypass Windows BitLocker protections and access encrypted data.
Vulnerability Breakdown
Here is the breakdown of the 570 vulnerabilities addressed in the July2026 update:
Zero-Day Vulnerabilities
Microsoft's July 2026 security release addresses three vulnerabilities classified as zero-days. Two were exploited in attacks before patches became available, while the third had been publicly disclosed.
1. CVE-2026-56155 — Active Directory Federation Services Elevation of Privilege Vulnerability
CVE-2026-56155 is an elevation-of-privilege vulnerability affecting Active Directory Federation Services (AD FS). The flaw results from insufficiently granular access control and can allow an authenticated, locally positioned attacker to obtain administrator privileges.
Microsoft confirmed that the vulnerability was exploited in the wild before the July update became available. Although exploitation requires the attacker to possess valid access and execute the attack locally, the vulnerability is particularly serious because AD FS is commonly deployed as part of enterprise authentication and federated identity environments.
2. CVE-2026-56164 — Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2026-56164 is an actively exploited elevation-of-privilege vulnerability in Microsoft SharePoint Server. The issue is caused by missing authentication for a critical function and can allow an unauthenticated remote attacker to gain elevated privileges over a network.
The vulnerability affects supported on-premises SharePoint deployments, including SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Because exploitation can occur remotely without valid credentials, exposed or externally accessible SharePoint servers represent the highest remediation priority.
3. CVE-2026-50661 — Windows BitLocker Security Feature Bypass Vulnerability
CVE-2026-50661 is a publicly disclosed security feature bypass affecting Windows BitLocker. The vulnerability stems from a failure in a protection mechanism and could allow an attacker with physical access to bypass BitLocker Device Encryption on the system storage device.
Successful exploitation could provide access to data that an organization expects to remain protected by full-disk encryption. The vulnerability is therefore particularly relevant to laptops, portable workstations, field systems, shared devices, and equipment located in physically accessible or untrusted environments.
Critical Vulnerabilities
In addition to the three zero-days, the July update includes some of Critical vulnerabilities affecting enterprise applications, server infrastructure, identity services, networking components, productivity software, and virtualization platforms.
CVE-2026-57092 — Windows VMSwitch Elevation of Privilege Vulnerability
CVE-2026-57092 is a use-after-free vulnerability affecting Windows VMSwitch. The flaw received a CVSS score of 9.9 and could allow a low-privileged attacker operating within a virtualized environment to cross a security boundary and compromise the underlying host.
The vulnerability is particularly significant for Hyper-V environments because compromise of the host could expose multiple virtual machines, management services, stored credentials, and workloads running on the same virtualization platform.
CVE-2026-55944 — Microsoft Dynamics NAV and Business Central Remote Code Execution
CVE-2026-55944 is a Critical remote-code-execution vulnerability affecting Microsoft Dynamics NAV and on-premises Microsoft Dynamics 365 Business Central. The issue results from deserialization of untrusted data and can be triggered through a specially crafted login request.
Exploitation does not require authentication or user interaction. An attacker who can reach a vulnerable server over the network could potentially execute arbitrary code, compromise application data, steal credentials, or use the affected system as an entry point into the broader enterprise network.
CVE-2026-50518 — Windows DHCP Server Remote Code Execution Vulnerability
CVE-2026-50518 is a heap-based buffer overflow in Windows DHCP Server. The vulnerability received a CVSS score of 9.8 and may allow an unauthenticated remote attacker to execute code by sending specially crafted network traffic to an affected service.
DHCP is a foundational network service, and compromise of a DHCP server could disrupt address allocation, affect network availability, expose infrastructure configuration, or provide an attacker with access to a trusted server located deep within the enterprise network.
CVE-2026-56190 — Windows Remote Desktop Server Remote Code Execution Vulnerability
CVE-2026-56190 is an unauthenticated remote-code-execution vulnerability affecting Windows Remote Desktop Server. Specially crafted RDP traffic could interact with an uninitialized resource, potentially leading to memory corruption and arbitrary code execution.
Organizations should identify systems exposing Remote Desktop services, especially those reachable from the internet, partner networks, unmanaged segments, or remote-access environments. Access to RDP should be restricted through VPNs, gateways, firewalls, network-level authentication, and multifactor authentication.
CVE-2026-49164 — Active Directory Domain Services Remote Code Execution Vulnerability
CVE-2026-49164 is a heap-based buffer overflow in Active Directory Domain Services. The vulnerability may allow an unauthenticated attacker to execute code over a network, making affected domain infrastructure a high-value target.
Domain controllers are central to authentication, authorization, policy enforcement, and identity management. Successful exploitation could have organization-wide consequences, including credential compromise, persistence, lateral movement, and loss of control over the Windows domain.
CVE-2026-55008 — Microsoft Exchange Server Spoofing Vulnerability
CVE-2026-55008 affects Microsoft Exchange Server and can enable stored script execution through Outlook Web Access. A maliciously crafted email viewed through the affected web interface could execute attacker-controlled JavaScript in the user's browser session.
Depending on the victim's privileges and active session, exploitation could support session abuse, account impersonation, theft of sensitive mailbox information, or delivery of additional malicious content.
Affected Products
The July 2026 Patch Tuesday release affects a broad range of Microsoft's enterprise, productivity, identity, virtualization, networking, and security products, addressing approximately 570 vulnerabilities across the Windows ecosystem, including three zero-days.
- Windows operating systems: Supported Windows client and Windows Server editions, including kernel, drivers, storage, networking, and core operating system components.
- Identity services: Active Directory Federation Services (AD FS), Active Directory Domain Services (AD DS), and related authentication components.
- Microsoft SharePoint Server: SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.
- Virtualization and networking: Hyper-V, VMSwitch, Remote Desktop Services, DHCP, DNS, SMB, and other Windows networking components.
- Microsoft productivity and business applications: Microsoft Office, Exchange Server, Dynamics products, and Windows Admin Center.
- Security and development components: Windows BitLocker, Microsoft Defender, .NET, Visual Studio, and other security and developer platforms.
Mitigation and Security Recommendations
-
Deploy the July 2026 Microsoft security updates immediately.
Use an accelerated deployment schedule for actively exploited vulnerabilities and exposed systems. Validate installation through centralized patch reporting and vulnerability scanning. -
Enable SharePoint AMSI protection.
Confirm that Antimalware Scan Interface integration is enabled on supported SharePoint servers and set Request Body Scan mode toFull. This can help detect malicious POST requests targeting CVE-2026-56164. -
Restrict access to AD FS and SharePoint administration interfaces.
Limit administrative access to trusted management networks and authorized users. Require multifactor authentication and closely monitor privileged account activity. -
Apply least privilege.
Remove unnecessary local administrator rights, restrict service accounts, review delegated identity permissions, and use privileged access management for sensitive administrative operations. -
Monitor for exploitation indicators.
Investigate unusual privilege changes, new administrator accounts, unexpected SharePoint POST requests, AD FS configuration changes, suspicious PowerShell execution, abnormal child processes, and unauthorized access to encrypted storage.
Instantly Fix Risks with Saner Patch Management
Saner Patch Management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.
It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.
Experience the fastest and most accurate patching software here .
