Microsoft Patches Record 622 Flaws, Including Two Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-50522 +1 in the same advisory: …55040 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthenticated attacker to send maliciously crafted serialized data over the network and execute code on the server, reflected in its 9.8 critical CVSS score with no privileges or user interaction required. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, giving attackers a foothold for follow-on actions such as data theft, lateral movement, or ransomware. Any organization running on-premises SharePoint Server is in scope, particularly deployments reachable from untrusted networks; the required action notes stakeholders must evaluate each asset's internet exposure under CISA BOD 26-04. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-22 and security news headlines describe it as a critical RCE exploited in the wild, with some reports referencing exploitation after a public proof-of-concept release and an authentication bypass. The structured record lists no public PoC as confirmed, but an EPSS of 84.6% (100th percentile) underscores a very high near-term exploitation likelihood. Do: Apply Microsoft's security updates for SharePoint Server immediately per the vendor advisory, as required under CISA's KEV listing and BOD 26-04, and prioritize any SharePoint deployments that are internet-facing (federal/critical-infrastructure operators must follow BOD 26-04 timelines or discontinue unmitigated use). Until patched, restrict public access to SharePoint endpoints (VPN, firewall rules, or reverse proxy) and review IIS/application logs and running processes for signs of unauthenticated deserialization abuse. Because some reports reference an authentication bypass being chained, also verify authentication paths and monitor for follow-on attacker activity after patching. | 9.8 group max | 85% | KEV |
| massorder of 100,000+ on-prem SharePoint Server deployments worldwide, with tens of thousands plausibly internet-exposed | |
| CVE-2026-57092 +1 in the same advisory: …50661 | Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. NVD description · AI analysis pending | 9.9 group max | <1% |
| — | ||
| CVE-2026-54117 +1 in the same advisory: …54118 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. NVD description · AI analysis pending | 9.8 | 1% |
| — | ||
| CVE-2026-55008 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spo Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. NVD description · AI analysis pending | 9.6 | <1% |
| — | ||
| CVE-2026-56155 | Local Privilege Escalation in Microsoft Active Directory Federation Services CVE-2026-56155 is a high-severity (CVSS 3.1: 7.8) access-control flaw (CWE-1220) in Microsoft Active Directory Federation Services (AD FS), in which insufficient granularity of access control lets an authorized attacker elevate privileges locally. Exploitation requires only low local privileges and no user interaction, so any locally authenticated user or process on a system with the AD FS role can trigger it. Successful exploitation yields full local privilege escalation with high impact on confidentiality, integrity, and availability. It affects organizations running AD FS on Windows Server 2012, 2016, 2019, 2022, and 2025, and on Windows 10 versions 1607 and 1809, per CISA's affected-products list. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-14, confirming in-the-wild exploitation despite a modest EPSS of 0.3%; it was fixed as part of Microsoft's record-breaking July 2026 Patch Tuesday. Do: Apply Microsoft's July 2026 security updates to all affected Windows 10 and Windows Server systems, prioritizing servers hosting the AD FS role, especially federation servers tied to Microsoft 365 or hybrid identity. Per CISA KEV and BOD 26-04, federal agencies must apply vendor mitigations promptly or discontinue use, and all defenders should inventory AD FS servers, restrict local logon to them, and triage for signs of local privilege-escalation activity. No public PoC or workaround beyond patching is currently known. | 7.8 | <1% | KEV |
| largetens of thousands of internet-exposed AD FS servers; likely six figures of total AD FS deployments affected | |
| CVE-2026-56164 | Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation Microsoft SharePoint Server contains a missing authentication for critical function vulnerability (CWE-306) that lets an unauthenticated attacker elevate privileges over a network without valid credentials. The flaw is triggered when the affected SharePoint function is accessed remotely without any authentication check, allowing an attacker to gain higher privileges than intended. Successful exploitation could enable an attacker to take elevated actions within the SharePoint environment, potentially leading to further compromise of the server and its data. All organizations running on-premises Microsoft SharePoint Server are potentially affected, though specific versions have not yet been enumerated by Microsoft or CISA. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14, indicating it is being actively exploited, and its EPSS score of 26.6% (98th percentile) reflects a high near-term exploitation risk. Do: Apply Microsoft's security updates for SharePoint Server as soon as they are available, and check Microsoft's advisory for the specific affected version ranges once published. In the meantime, restrict network access to SharePoint servers, especially for internet-facing instances, and verify whether your environment falls under CISA BOD 26-04 requirements given the KEV listing. Monitor for updated guidance from Microsoft and CISA, as exploitation is confirmed and patching urgency is high. | 9.8 | 27% | KEV |
| masspotentially millions of users and well over 100,000 exposed installations worldwide |
Full article1,256 words · extracted from thehackernews.com · click to collapse
Microsoft shipped its largest Patch Tuesday on record today, and two of the fixes close holes that attackers are already exploiting. The release covers 622 of Microsoft's own CVEs by its Security Update Guide count, more than triple June's previous high of around 200.
Those two live bugs are the ones to grab first. Microsoft credits incident responders for both. Both are elevation-of-privilege flaws in identity and collaboration infrastructure: CVE-2026-56164 in on-premises SharePoint Server and CVE-2026-56155 in Active Directory Federation Services.
Neither is one of the splashy remote code execution criticals. They are privilege bugs in two systems that matter more than their scores suggest: the company document store, and the box that signs its logins.
The two zero-days to patch first
CVE-2026-56164, a SharePoint Server flaw Microsoft says is being exploited in attacks, lets an unauthenticated attacker escalate privileges over the network. No credentials, no user interaction, remote. Microsoft credited it to Mandiant's incident responders and Google's FLARE team, which points to discovery inside active attacks, though Microsoft has not said how it was exploited or by whom.
If you run self-hosted SharePoint, this is the one to grab first, and there is a second clock on it: today is also the day SharePoint Server 2016 and 2019 reach the end of extended support. Unlike Windows Server or SQL Server, neither has a paid ESU program to fall back on.
Beyond patching, Microsoft's advisory notes that enabling AMSI in Full Mode on the server blunts the attack. SharePoint has been an attacker magnet since the ToolShell chain tore through unpatched servers in 2025, and it has not stopped being one.
CVE-2026-56155, an Active Directory Federation Services flaw Microsoft also flags as exploited, lets an already-authenticated attacker elevate privileges locally through weak access controls. Microsoft's own DART incident-response unit gets the credit.
AD FS is the box that signs the tokens for the rest of the estate trusts, which is why a flaw labeled "local" on that host is worth more attention than the label suggests. Microsoft has not said what privileges it grants, or how attackers used it.
Worth knowing for anyone tracking remediation deadlines: neither CVE is on CISA's Known Exploited Vulnerabilities catalog as of this writing. Microsoft's own exploitability rating already marks both as exploited. Do not wait for a KEV listing to make it official.
Microsoft also rates the SharePoint bug fairly low on severity, which is a good reminder that the severity label is not the thing to sort by this month.
A third bug, and a SharePoint chain landing in August
The third zero-day was publicly disclosed but is not under attack: CVE-2026-50661, another BitLocker bypass. It needs physical access to the device, so it is not a remote emergency. Patch it, but it does not jump the queue. It continues a run of BitLocker bypasses stretching back through bitskrieg and YellowKey earlier this year.
SharePoint drew a second notable fix. Rapid7 Labs disclosed CVE-2026-55040, a JWT authentication bypass they built for their Pwn2Own Berlin entry. The score depends on who you ask: Rapid7 puts it at 5.3 and says Microsoft assigned it medium severity, while ZDI reads the release as Critical at 9.1.
What it does is not in dispute. Rapid7 chained it to a separate remote code execution bug to reach unauthenticated RCE against a vulnerable server, and the RCE half is not patched yet; Microsoft is slated to fix it in August.
That makes July bypass the fix that breaks the chain. A four-point spread on one bug also tells you what a severity number is worth this month.
The RC4 cleanup that can break logins
This update also finishes Microsoft's multi-year Kerberos RC4 hardening. The July rollout removes the RC4DefaultDisablementPhase rollback switch, the escape hatch admins have leaned on since Microsoft began the crackdown in January.
After this, RC4 works only for accounts explicitly configured to allow it. If any service account in your environment still requests RC4 Kerberos tickets, it can fail authentication the moment the update lands.
The order matters: audit first, using the RC4 audit events Microsoft added in January, then rotate the passwords on flagged service accounts, so Windows generates AES keys for them, then patch. Rotation only fixes accounts missing AES keys.
Anything pinned to RC4 by configuration, or a legacy client that speaks nothing else, needs its own fix before the update lands. This one does not get you breached; it breaks things, but it will page you at 2am if you skip the audit.
Why a quiet month set a record
July is historically one of the lightest months on Microsoft's calendar, which makes a release this size stand out. Windows alone accounts for 416 of the 622, and ZDI counts 95 remote code execution bugs across the release.
Here is where the rest sits, and what is worth pulling out of each pile:
| Product family | CVEs | Worth pulling out |
|---|---|---|
| Windows | 416 | Both the AD FS zero-day (CVE-2026-56155) and the disclosed BitLocker bypass (CVE-2026-50661) live here. Top score of the release is a VMSwitch RCE, CVE-2026-57092 at 9.9. Also five DHCP RCEs, and 21 NTFS and ReFS driver bugs that ZDI reads as one shared root cause. |
| Office | 82 | Counted once. Microsoft lists the same 82 again under a separate Office 2016 track, which is why some outlets report 164. |
| Microsoft Edge | 46 | ZDI counts 21 as Microsoft's own rather than Chromium re-listings. |
| Developer Tools | 27 | Security feature bypasses across Visual Studio, VS Code, and GitHub Copilot, mostly injection and path traversal. |
| SharePoint Server | 17 | The exploited zero-day (CVE-2026-56164) and Rapid7's chain bypass (CVE-2026-55040), plus a Critical RCE pair including CVE-2026-50522 at 9.8. |
| Azure | 11 | Nothing flagged as urgent. |
| SQL Server | 8 | An RCE pair, CVE-2026-54117 and CVE-2026-54118, both 8.8. |
| Defender | 5 | Two Critical RCEs. |
| Exchange Server | 5 | A stored XSS in Outlook Web Access, CVE-2026-55008, at 9.6. Microsoft files it under spoofing, which undersells it. |
| Other | 5 | Nothing flagged as urgent. |
Counts are from Microsoft's Security Update Guide, which totals 622 unique CVEs this month. ZDI, counting independently, landed on 621, and its July review is the source for the per-family callouts.
Microsoft called this one five days early. In a July 9 post, it told customers to expect a "higher volume of security updates included in each security release" as AI helps it uncover more issues. That work includes MDASH, its multi-model agentic scanning system, which found 16 of the bugs in May's Patch Tuesday by itself. Microsoft has not said how many of July's 622 came out of that pipeline.
The same automation cuts both ways. Once a patch ships, attackers can diff it against the last build, find the bug it closes, and build a working exploit before most shops have finished testing. That eats the old "wait a week" cushion and shrinks the gap to Exploit Wednesday.
It also guts CVSS-based triage. When a release carries 600-plus CVEs and a large share are rated High or Critical, "critical" stops sorting anything. This month's two exploited bugs make the point: neither is a headline 9.8, both are mid-tier privilege flaws, and both are already in use.
Sort by what is being exploited, using KEV, EPSS, and Microsoft's exploited flag, not by score, and patch faster than you used to. The number on the box is only going up.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html