Microsoft released its July 2026 Patch Tuesday security updates, marking the largest vulnerability remediation effort in the company’s history. The release addresses 570 vulnerabilities across Windows, Microsoft Office, SharePoint Server, Active Directory Federation Services (AD FS), Azure, Visual Studio, SQL Server, and other Microsoft products. Among the patched flaws are 57 Critical vulnerabilities, including numerous remote code execution (RCE) issues that could allow attackers to execute arbitrary code on vulnerable systems. Microsoft also fixed two zero-day vulnerabilities that were actively exploited in the wild prior to the release of patches, significantly increasing the urgency for organizations to deploy updates as quickly as possible.

The actively exploited zero-days include CVE-2026-56155, a local privilege escalation vulnerability affecting Active Directory Federation Services (AD FS) that could allow an attacker with limited access to obtain administrator privileges, and CVE-2026-56164, a remote code execution vulnerability affecting Microsoft SharePoint Server. Because AD FS is commonly used to provide authentication and single sign-on services across enterprise environments, successful exploitation could enable attackers to escalate privileges and compromise identity infrastructure. Similarly, exploitation of the SharePoint flaw could provide threat actors with a foothold into enterprise collaboration environments, enabling credential theft, persistence, lateral movement, and access to sensitive organizational data. Both vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, reflecting confirmed exploitation activity.

The record-breaking number of vulnerabilities continues a broader trend observed throughout 2026, with Microsoft attributing the increase in part to advances in AI-assisted vulnerability discovery and internal security research. Security experts expect monthly patch volumes to remain elevated as automated analysis techniques uncover software flaws at an increasingly rapid pace. The July release reinforces the importance of maintaining a mature vulnerability management program capable of rapidly assessing, prioritizing, and deploying security updates, particularly for internet-facing systems and identity infrastructure that are frequently targeted by both state-sponsored and financially motivated threat actors. Organizations should prioritize patching the exploited zero-days, monitor for indicators of compromise, and review privileged access controls to reduce the risk of post-exploitation activity.