Microsoft shipped 622 security fixes on July 14 — the largest Patch Tuesday in the program’s 23-year history. Two of those patches close zero-days that attackers are already exploiting in the wild: one in Active Directory Federation Services, one in SharePoint Server. CISA has added both to its Known Exploited Vulnerabilities catalog. The federal remediation deadline for the ADFS bug is July 28. If you run Windows Server infrastructure, this is not a drill.
CVE-2026-56164: The SharePoint Bug Microsoft Understated
Start here. CVE-2026-56164 is an elevation of privilege vulnerability in on-premises SharePoint Server 2016, 2019, and the Subscription Edition. A missing authentication check in the User Profiles assembly lets an unauthenticated attacker skip identity verification entirely — no credentials required, just the right routing headers — and escalate straight to Farm Administrator.
CISA confirmed that attackers are actively chaining this with two other SharePoint CVEs (CVE-2026-32201 and CVE-2026-45659) to achieve remote code execution, steal IIS machine keys, and deploy malware for persistence. This is a working attack chain, not a theoretical proof of concept.
Here is where the vendor’s scoring becomes a problem. Microsoft rated CVE-2026-56164 at 5.3 — “Moderate.” The National Vulnerability Database independently scored it 9.8 — “Critical.” Rapid7, Tenable, and Orca Security all listed it as their top patching priority regardless. That CVSS gap is not a rounding error. It is a scoring decision that could lead IT teams to deprioritize an actively exploited, unauthenticated attack vector with a clear path to full server compromise. Treat this as the 9.8 it is.
SharePoint Online is not affected. Patch on-premises deployments immediately using Microsoft’s July 14, 2026 security updates.
CVE-2026-56155: Patch the ADFS Zero-Day by July 28
CVE-2026-56155 is an elevation of privilege flaw in Active Directory Federation Services discovered by Microsoft’s Detection and Response Team during active incident response — meaning it was already being used against real organizations when the patch shipped. A local attacker with limited privileges can exploit the DKM container ACL flaw to gain administrator access on the AD FS server.
CISA’s Binding Operational Directive 22-01 sets the federal remediation deadline at July 28. Non-federal organizations should treat that deadline as equally urgent.
To patch: install KB5121391. Fixed builds are 14393.9339 for Server 2016, 17763.9020 for Server 2019, 20348.5386 for Server 2022, and 26100.33158 for Server 2025. A reboot is required. After restarting AD FS services, validate that federation sign-in is functioning. This July update starts phase 1 of hardening; October 2026 brings stricter enforcement, so patching now is necessary regardless of your preferred timeline.
CVE-2026-57092: A VM Escape Rated CVSS 9.9
The highest-severity bug in July’s batch is CVE-2026-57092 in Windows VMSwitch, carrying a CVSS score of 9.9. It is not actively exploited yet, but it is publicly disclosed — and it is a guest-to-host VM escape.
The flaw is a use-after-free in Hyper-V’s Virtual Switch. An authenticated attacker inside a guest VM sends crafted network requests to force the host to access freed memory, breaking the hypervisor isolation boundary and achieving host-level code execution. Any environment running Hyper-V — on-premises datacenters, Azure IaaS workloads, hosted virtual environments — should treat this as Tier 2 priority behind the two actively exploited zero-days. Tenable’s full CVE breakdown has additional technical context.
Check Kerberos RC4 Before You Patch Domain Controllers
This is not a new CVE, but it can cause more immediate pain than the zero-days for unprepared environments. July’s update permanently removes the Kerberos RC4 rollback registry key. There is no registry-based recovery path once domain controllers are updated.
Before applying July patches to domain controllers, check event log IDs 201, 202, 205, 206, and 207 for Kerberos audit failures. Any service account, storage appliance, Unix or Linux machine joined to Active Directory, or Java application still relying on RC4-based Kerberos tickets will face hard authentication failures after the update. Update those dependencies to AES key material first, then patch.
Why 622? AI Is Finding Bugs Faster Than Most Teams Can Triage Them
June 2026 had roughly 200 CVEs. May had fewer. July landed at 622 — more than triple the previous month. The structural reason is Microsoft’s MDASH system, a multi-model agentic scanning harness that orchestrates over 100 specialized AI agents to find, validate, and prove exploitable flaws at machine speed. Microsoft EVP Pavan Davuluri wrote on July 9 that customers should expect this higher volume to be permanent.
The implication for security and DevOps teams is direct. Patch triage built around 150–200 CVE monthly batches does not scale to 622. A tiered approach — exploit-confirmed first, then publicly-disclosed-known, then everything else — is no longer optional. It is the only way to keep pace with a discovery pipeline that will keep accelerating.
For this month: patch SharePoint and ADFS now. Schedule VMSwitch for this week. Verify Kerberos RC4 dependencies before touching domain controllers. The remaining CVEs can follow your standard cycle. BleepingComputer’s full coverage has the complete CVE list if you need to audit your exposure.
