Microsoft July 2026 Patch Tuesday: 570 CVEs, 3 Zero-Days

Microsoft’s July 2026 Patch Tuesday just set an unwelcome record: 570 vulnerabilities patched in a single update, three zero-days included, and two of them already being actively exploited when the patches dropped. The volume isn’t an accident. Microsoft attributes the surge to MDASH, its internal AI-powered vulnerability scanner, which is now finding bugs faster than the industry can patch them. If you’re running on-premises SharePoint or AD FS, stop reading and start patching.

The Two Zero-Days You Need to Patch Right Now

Both actively exploited vulnerabilities hit enterprise authentication infrastructure — the kind of stuff that, once compromised, hands attackers the keys to your entire org.

CVE-2026-56164 — SharePoint Server (CVSS 5.3, but treat it as Critical). An unauthenticated attacker on your network can escalate directly to Farm Administrator by omitting the security digest and supplying specific routing headers. No credentials. No user interaction. Mandiant and Google’s FLARE team discovered it mid-attack, which is how you know the threat is real. CISA gave federal agencies three days to patch — agencies rarely get three-day deadlines for “Medium” severity vulnerabilities. Trust CISA’s read here, not the CVSS label.

One critical nuance: the Windows cumulative update alone does not patch SharePoint. You must apply SharePoint’s own servicing process separately. Affected versions are SharePoint Enterprise Server 2016, 2019, and Subscription Edition — on-premises only. SharePoint Online is unaffected.

CVE-2026-56155 — Active Directory Federation Services (CVSS 7.8). A low-privilege local user can elevate to administrator on an AD FS server. Since AD FS handles SSO token issuance across corporate services, a compromised AD FS server is effectively a skeleton key. The patch covers Windows Server 2012 through 2025, but patching alone isn’t enough — Microsoft requires manual ACL hardening of the DKM container after applying the update (see KB5121391). There’s an October enforcement date; after that, unpatched DKM ACLs get blocked by default. Don’t wait until October.

MDASH: Why There Are 570 Vulnerabilities This Month

The record patch count isn’t a fluke or a backlog purge. Microsoft’s MDASH system — a multi-model agentic scanning harness running 100+ specialized AI agents — is now methodically sweeping the Windows codebase for exploitable bugs before attackers find them first. Unlike traditional static analysis that pattern-matches against known signatures, MDASH traces complete exploit chains across multiple files and produces working proof-of-concept code before any alert reaches a human analyst.

MDASH scored 96.55% on the CyberGym security benchmark and has already surfaced 16 new vulnerabilities in the Windows networking and authentication stack, including four Critical RCEs. Microsoft has explicitly committed to continuing this approach — which means elevated Patch Tuesday volumes are the new baseline. The Windows Experience Blog explains the methodology and makes clear this isn’t slowing down.

The implication for every dev and ops team: 30-day patch validation cycles are increasingly untenable. If Microsoft is shipping 500+ fixes per month, your pipeline needs to handle it.

The Third Zero-Day and the Critical RCE Landscape

The third zero-day, CVE-2026-50661, is a BitLocker bypass that hadn’t been exploited at patch time but was publicly disclosed beforehand. Physical access to a device plus hardware tooling (SPI bus sniffing or a DMA attack over Thunderbolt or USB4) lets an attacker recover the Volume Master Key and decrypt the full drive. Relevant for laptops, field devices, and anything that leaves a secured perimeter. Patch it before the technical details circulate further.

Beyond the zero-days, the RCE count is staggering: 145 total, 48 rated Critical. Three worth flagging specifically:

• CVE-2026-54999 (TCP/IP, CVSS 8.8): Race condition, unauthenticated, adjacent-network attack. Any Windows server on a shared VPC, VLAN, or container network is potentially exposed.
• CVE-2026-54995 (RMCAST driver, Critical): Kernel-level use-after-free in the Reliable Multicast driver. Critical priority if you use Windows multicast.
• CVE-2026-42982 (Secure Kernel Mode, CVSS 7.8): Elevation of privilege with sandbox escape potential.

Triage Order for Dev and Ops Teams

At 570 CVEs, triage fatigue is real. Tenable’s full CVE breakdown and the Zero Day Initiative review are solid starting points for teams that need deep technical detail. For everyone else, here’s the priority order:

1. SharePoint Server (CVE-2026-56164) — patch via SharePoint servicing, not Windows Update alone
2. AD FS (CVE-2026-56155) — patch + complete manual ACL hardening from KB5121391
3. Windows TCP/IP (CVE-2026-54999) — all internet-facing or shared-network Windows servers
4. BitLocker (CVE-2026-50661) — laptops and devices that leave the building
5. RMCAST driver (CVE-2026-54995) — systems using multicast networking
6. Remaining 54 Critical vulns — schedule within your next sprint

The broader takeaway: MDASH-driven discovery is going to keep producing months like this. The era of treating Patch Tuesday as a once-monthly admin task is over. Security patching needs to be a continuous, automated part of your delivery pipeline — not a calendar item.