Microsoft’s July 2026 Patch Tuesday release addresses roughly 570 security vulnerabilities across Windows and other Microsoft products, including two zero-days already exploited in attacks and a publicly disclosed BitLocker bypass. Windows 11 users should prioritize KB5101650 or KB5099414, while administrators running Active Directory Federation Services and on-premises SharePoint Server face the most urgent exposure.
The record-setting total was first reported by BleepingComputer, which counted 570 vulnerabilities released on July 14. Microsoft’s Security Update Guide supplies the underlying advisories, although totals published by security firms vary because they count CVEs, product entries, Chromium fixes, and updates issued earlier in the month differently.
This is not simply a bundle of 570 flaws in the Windows desktop operating system. The release spans Microsoft’s wider product portfolio, with Windows components, SharePoint Server, AD FS, Office, developer tools, and server technologies represented across the advisories.
CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services. Microsoft says insufficiently granular access controls in AD FS can let an authorized local attacker elevate privileges and obtain administrative capabilities.
Microsoft Detection and Response Team members Jeremy Kingston and Scott Clark discovered the flaw, suggesting it surfaced during incident-response work. Microsoft has not disclosed the attacks, affected organizations, or initial access method, leaving defenders without indicators that would help them determine whether exploitation has already occurred in their environments.
The associated AD FS hardening involves the access control list for the Distributed Key Manager container. Administrators should review Microsoft’s CVE-2026-56155 guidance and KB5121391 rather than treating the standard Windows cumulative update as the entire remediation plan.
CVE-2026-56164 affects Microsoft SharePoint Server and permits elevation of privilege over a network. Microsoft describes the underlying weakness as missing authentication for a critical function, potentially allowing an unauthorized attacker to gain elevated access remotely.
The SharePoint flaw was reported by researchers associated with Mandiant Incident Response, Google Cloud and FLARE OTF, along with an anonymous researcher. As with the AD FS vulnerability, Microsoft has confirmed exploitation but has not explained how attackers are using it.
Organizations unable to patch SharePoint immediately can reduce exposure by enabling Antimalware Scan Interface integration and setting Request Body Scan mode to Full, according to Microsoft’s guidance. That mitigation should be treated as a temporary control, not a substitute for installing the security update and checking the server for signs of compromise.
The third zero-day, CVE-2026-50661, is a Windows BitLocker security-feature bypass. An attacker with physical access could reportedly bypass BitLocker Device Encryption on the system drive and obtain encrypted information.
Microsoft says it is not aware of active exploitation of CVE-2026-50661, but the vulnerability was publicly disclosed before a fix became available. Its physical-access requirement reduces the risk for most home systems, although it matters considerably for lost laptops, stolen corporate devices, shared workstations and computers handled by untrusted personnel.
Those categories add up to 569 rather than 570, illustrating why Patch Tuesday totals should not be treated as a perfectly standardized metric. Tenable reported 569 CVEs and 56 Critical vulnerabilities, while SecurityWeek used a broader count of 622 vulnerabilities. Differences can arise from revisions, duplicate product listings, Microsoft and third-party CVEs, and the inclusion or exclusion of fixes released outside the main Patch Tuesday window.
BleepingComputer excluded hundreds of Chromium vulnerabilities already fixed by Google and inherited by Microsoft Edge. It also excluded vulnerabilities addressed earlier in July in products and services including Azure OpenAI, Microsoft 365 Copilot, Exchange Online, Microsoft Entra Provisioning Service and Edge for Android.
The defensible conclusion is that July 14 delivered Microsoft’s largest Patch Tuesday release to date under the commonly used CVE-counting methods, substantially surpassing June 2026’s roughly 200 fixes. The precise headline figure matters less operationally than the presence of two exploited zero-days and a large set of Critical remote-code-execution vulnerabilities.
The sudden growth also does not necessarily mean Microsoft software became dramatically less secure in one month. Microsoft recently said it is using AI-assisted vulnerability discovery to identify weaknesses across the Windows codebase before attackers find them. More aggressive internal discovery can produce a larger patch count while reducing long-term exposure, though administrators still inherit the immediate testing and deployment burden.
Microsoft says it is not currently aware of any problems with either Windows 11 update. That status can change as deployment expands, so enterprises should continue staged rollouts and monitor the Windows release health dashboard rather than assuming a day-one clean bill of health guarantees broad compatibility.
The cumulative updates also contain changes beyond the July CVEs. Windows now includes curl 8.21.0, while Remote Desktop gains support for SHA-2 certificate thumbprints for trusted RDP publishers. SHA-1 remains available for compatibility but is scheduled for eventual removal, giving administrators another reason to audit policies and signed
A networking hardening change may have more immediate consequences. Applications using sockets over unregistered third-party Transport Driver Interface transports may stop working after installing updates released on or after July 14, 2026. Registered TDI transports are unaffected, but organizations with old networking, security or industrial software should include those applications in compatibility testing.
The update also continues Microsoft’s rollout of replacement Secure Boot certificates. Certificates used by many Windows devices began reaching expiration in June 2026, and Microsoft has been delivering newer certificates through Windows Update. Systems that have not yet received them should continue booting and accepting normal updates, but managed fleets should verify certificate readiness rather than relying solely on the automatic consumer rollout.
Enterprise administrators have a more complicated task. AD FS and SharePoint Server should receive priority because exploitation is confirmed, followed by internet-facing servers, Remote Desktop infrastructure and machines carrying sensitive BitLocker-protected data.
A practical deployment order is to patch exposed identity and collaboration servers first, examine logs and endpoint telemetry for suspicious activity, and then accelerate workstation and general server rings after essential application tests. Organizations using custom TDI transports should validate network-dependent applications before broad deployment, but that compatibility concern should not become a reason to leave exploited SharePoint or AD FS systems exposed.
Windows 11 24H2 Home and Pro also reach end of servicing on October 13, 2026, while Windows 11 23H2 Enterprise and Education reach that milestone on November 10, 2026. July’s unusually large release therefore arrives as some administrators must manage both an urgent security rollout and migrations to versions that will continue receiving fixes after the autumn support deadlines.
Talos also highlighted critical, unauthenticated remote-code-execution flaws affecting Windows DHCP Server and SharePoint Server. The SharePoint issues, CVE-2026-50522 and CVE-2026-58644, involve unsafe deserialization and add further urgency for administrators already responding to actively exploited CVE-2026-56164.
The signatures provide an additional monitoring layer for detecting probes and possible exploitation before or during patch deployment. They do not replace Microsoft’s updates or establish that systems have not already been compromised. Security teams should update detection rules, accelerate patching of exposed SharePoint and AD FS infrastructure, and investigate relevant alerts and historical activity.
blog.talosintelligence.com
Microsoft attributes the growing volume and urgency of security fixes partly to AI accelerating vulnerability discovery for both defenders and attackers. Its multi-model MDASH scanning system reportedly identified 16 significant vulnerabilities in Windows networking and authentication components, including four Critical remote-code-execution flaws.
For administrators, the revised guidance favors rapid, policy-enforced deployment over lengthy deferral periods. Organizations should still perform essential compatibility checks, particularly around July’s TDI transport changes, but Microsoft’s position is that routine quality updates should reach managed devices within days rather than weeks.
The feature is reportedly enabled by default on Windows Home and Pro devices with system drives of at least 200GB. This gives eligible users another recovery option, but organizations should assess the feature’s storage, management, and security implications before relying on it.
Techlicious also discusses the publicly disclosed BitLocker bypass. Contrary to its framing, Microsoft’s advisories identify the actively exploited vulnerabilities as the AD FS and SharePoint flaws; Microsoft has not reported active exploitation of the BitLocker issue.
The release also adds an option to resize the touchpad’s right-click zone, giving laptop and touchpad users more control over how secondary clicks are recognized.
These changes provide practical quality-of-life benefits, but the update’s security fixes remain the primary reason to deploy it quickly. Organizations should verify the File Explorer and shutdown improvements during staged testing while continuing to prioritize systems exposed to the actively exploited vulnerabilities.
The record-setting total was first reported by BleepingComputer, which counted 570 vulnerabilities released on July 14. Microsoft’s Security Update Guide supplies the underlying advisories, although totals published by security firms vary because they count CVEs, product entries, Chromium fixes, and updates issued earlier in the month differently.
This is not simply a bundle of 570 flaws in the Windows desktop operating system. The release spans Microsoft’s wider product portfolio, with Windows components, SharePoint Server, AD FS, Office, developer tools, and server technologies represented across the advisories.
Three Zero-Days Move to the Front of the Queue
CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services. Microsoft says insufficiently granular access controls in AD FS can let an authorized local attacker elevate privileges and obtain administrative capabilities.Microsoft Detection and Response Team members Jeremy Kingston and Scott Clark discovered the flaw, suggesting it surfaced during incident-response work. Microsoft has not disclosed the attacks, affected organizations, or initial access method, leaving defenders without indicators that would help them determine whether exploitation has already occurred in their environments.
The associated AD FS hardening involves the access control list for the Distributed Key Manager container. Administrators should review Microsoft’s CVE-2026-56155 guidance and KB5121391 rather than treating the standard Windows cumulative update as the entire remediation plan.
CVE-2026-56164 affects Microsoft SharePoint Server and permits elevation of privilege over a network. Microsoft describes the underlying weakness as missing authentication for a critical function, potentially allowing an unauthorized attacker to gain elevated access remotely.
The SharePoint flaw was reported by researchers associated with Mandiant Incident Response, Google Cloud and FLARE OTF, along with an anonymous researcher. As with the AD FS vulnerability, Microsoft has confirmed exploitation but has not explained how attackers are using it.
Organizations unable to patch SharePoint immediately can reduce exposure by enabling Antimalware Scan Interface integration and setting Request Body Scan mode to Full, according to Microsoft’s guidance. That mitigation should be treated as a temporary control, not a substitute for installing the security update and checking the server for signs of compromise.
The third zero-day, CVE-2026-50661, is a Windows BitLocker security-feature bypass. An attacker with physical access could reportedly bypass BitLocker Device Encryption on the system drive and obtain encrypted information.
Microsoft says it is not aware of active exploitation of CVE-2026-50661, but the vulnerability was publicly disclosed before a fix became available. Its physical-access requirement reduces the risk for most home systems, although it matters considerably for lost laptops, stolen corporate devices, shared workstations and computers handled by untrusted personnel.
The Record Number Needs Some Accounting
BleepingComputer categorized the July release as 254 elevation-of-privilege flaws, 145 remote-code-execution vulnerabilities, 102 information-disclosure bugs, 35 denial-of-service flaws, 17 security-feature bypasses and 16 spoofing vulnerabilities. Its count identifies 59 vulnerabilities as Critical, including 48 remote-code-execution bugs.Those categories add up to 569 rather than 570, illustrating why Patch Tuesday totals should not be treated as a perfectly standardized metric. Tenable reported 569 CVEs and 56 Critical vulnerabilities, while SecurityWeek used a broader count of 622 vulnerabilities. Differences can arise from revisions, duplicate product listings, Microsoft and third-party CVEs, and the inclusion or exclusion of fixes released outside the main Patch Tuesday window.
BleepingComputer excluded hundreds of Chromium vulnerabilities already fixed by Google and inherited by Microsoft Edge. It also excluded vulnerabilities addressed earlier in July in products and services including Azure OpenAI, Microsoft 365 Copilot, Exchange Online, Microsoft Entra Provisioning Service and Edge for Android.
The defensible conclusion is that July 14 delivered Microsoft’s largest Patch Tuesday release to date under the commonly used CVE-counting methods, substantially surpassing June 2026’s roughly 200 fixes. The precise headline figure matters less operationally than the presence of two exploited zero-days and a large set of Critical remote-code-execution vulnerabilities.
The sudden growth also does not necessarily mean Microsoft software became dramatically less secure in one month. Microsoft recently said it is using AI-assisted vulnerability discovery to identify weaknesses across the Windows codebase before attackers find them. More aggressive internal discovery can produce a larger patch count while reducing long-term exposure, though administrators still inherit the immediate testing and deployment burden.
Windows 11 Builds Advance With Security and Compatibility Changes
Windows 11 versions 24H2 and 25H2 receive KB5101650, moving supported systems to OS builds 26100.8875 and 26200.8875 respectively. Windows 11 version 23H2 receives KB5099414 and advances to build 22631.7376.Microsoft says it is not currently aware of any problems with either Windows 11 update. That status can change as deployment expands, so enterprises should continue staged rollouts and monitor the Windows release health dashboard rather than assuming a day-one clean bill of health guarantees broad compatibility.
The cumulative updates also contain changes beyond the July CVEs. Windows now includes curl 8.21.0, while Remote Desktop gains support for SHA-2 certificate thumbprints for trusted RDP publishers. SHA-1 remains available for compatibility but is scheduled for eventual removal, giving administrators another reason to audit policies and signed
.rdp files.A networking hardening change may have more immediate consequences. Applications using sockets over unregistered third-party Transport Driver Interface transports may stop working after installing updates released on or after July 14, 2026. Registered TDI transports are unaffected, but organizations with old networking, security or industrial software should include those applications in compatibility testing.
The update also continues Microsoft’s rollout of replacement Secure Boot certificates. Certificates used by many Windows devices began reaching expiration in June 2026, and Microsoft has been delivering newer certificates through Windows Update. Systems that have not yet received them should continue booting and accepting normal updates, but managed fleets should verify certificate readiness rather than relying solely on the automatic consumer rollout.
Patch Fast, but Test the Infrastructure Around It
Home users can install the July updates through Settings, Windows Update and Check for updates. Because Windows security updates are cumulative, installing the current package also brings in earlier fixes missing from the device.Enterprise administrators have a more complicated task. AD FS and SharePoint Server should receive priority because exploitation is confirmed, followed by internet-facing servers, Remote Desktop infrastructure and machines carrying sensitive BitLocker-protected data.
A practical deployment order is to patch exposed identity and collaboration servers first, examine logs and endpoint telemetry for suspicious activity, and then accelerate workstation and general server rings after essential application tests. Organizations using custom TDI transports should validate network-dependent applications before broad deployment, but that compatibility concern should not become a reason to leave exploited SharePoint or AD FS systems exposed.
Windows 11 24H2 Home and Pro also reach end of servicing on October 13, 2026, while Windows 11 23H2 Enterprise and Education reach that milestone on November 10, 2026. July’s unusually large release therefore arrives as some administrators must manage both an urgent security rollout and migrations to versions that will continue receiving fixes after the autumn support deadlines.
Update: Cisco Talos Releases Snort Rules for July Vulnerabilities (July 14, 2026)
Cisco Talos has released Snort 2 and Snort 3 signatures designed to detect attempted exploitation of some vulnerabilities addressed in Microsoft’s July security release. Cisco Security Firewall and Snort users should install the latest rule updates, although Talos cautions that signatures may change as additional technical details emerge.Talos also highlighted critical, unauthenticated remote-code-execution flaws affecting Windows DHCP Server and SharePoint Server. The SharePoint issues, CVE-2026-50522 and CVE-2026-58644, involve unsafe deserialization and add further urgency for administrators already responding to actively exploited CVE-2026-56164.
The signatures provide an additional monitoring layer for detecting probes and possible exploitation before or during patch deployment. They do not replace Microsoft’s updates or establish that systems have not already been compromised. Security teams should update detection rules, accelerate patching of exposed SharePoint and AD FS infrastructure, and investigate relevant alerts and historical activity.
Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for July 2026, which includes 622 vulnerabilities affecting a range of products, including 57 that Microsoft marked as "critical".
Microsoft notes that two of the vulnerabilities disclosed this month have been exploited in the wild...
blog.talosintelligence.com
Update: Microsoft Urges Quality Updates Within Three Days (July 15, 2026)
Windows Latest reports that Microsoft has tightened its deployment guidance, recommending that organizations defer Windows quality updates for fewer than three days. Microsoft suggests setting update deadlines to zero or one day and limiting the grace period to no more than two days, with Intune and Windows Autopatch offered as deployment options.Microsoft attributes the growing volume and urgency of security fixes partly to AI accelerating vulnerability discovery for both defenders and attackers. Its multi-model MDASH scanning system reportedly identified 16 significant vulnerabilities in Windows networking and authentication components, including four Critical remote-code-execution flaws.
For administrators, the revised guidance favors rapid, policy-enforced deployment over lengthy deferral periods. Organizations should still perform essential compatibility checks, particularly around July’s TDI transport changes, but Microsoft’s position is that routine quality updates should reach managed devices within days rather than weeks.
Update: July Update Adds Automatic Point-in-Time Restore (July 15, 2026)
Techlicious reports that the July Windows update also introduces Point-in-Time Restore, a recovery feature that automatically creates system snapshots every 24 hours. Users can restore a malfunctioning PC from the Windows Recovery Environment if an update, driver, or configuration change prevents normal operation.The feature is reportedly enabled by default on Windows Home and Pro devices with system drives of at least 200GB. This gives eligible users another recovery option, but organizations should assess the feature’s storage, management, and security implications before relying on it.
Techlicious also discusses the publicly disclosed BitLocker bypass. Contrary to its framing, Microsoft’s advisories identify the actively exploited vulnerabilities as the AD FS and SharePoint flaws; Microsoft has not reported active exploitation of the BitLocker issue.
Microsoft ships record Patch Tuesday fixing active attacks
July's Patch Tuesday fixes more vulnerabilities than any release in Microsoft's history, including two flaws already being exploited. Here's what to update now.
www.techlicious.com
Update: July Update Improves Shutdown Speed and File Explorer Reliability (July 15, 2026)
PCMag reports that the July cumulative update also includes several user-facing improvements beyond its security fixes. Microsoft says the update should accelerate shutdowns and improve File Explorer’s performance and reliability.The release also adds an option to resize the touchpad’s right-click zone, giving laptop and touchpad users more control over how secondary clicks are recognized.
These changes provide practical quality-of-life benefits, but the update’s security fixes remain the primary reason to deploy it quickly. Organizations should verify the File Explorer and shutdown improvements during staged testing while continuing to prioritize systems exposed to the actively exploited vulnerabilities.
References
- Primary source: Lifehacker
Published: 2026-07-14T19:52:57+00:00
Microsoft Just Patched a Record 570 Flaws in Windows
This month's Patch Tuesday update also includes three zero-days.au.lifehacker.com - Related coverage: bleepingcomputer.com
- Official source: support.microsoft.com
CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening | Microsoft Support
CVE-2026-56155: AD FS Distributed Key Manager container ACL hardeningsupport.microsoft.com - Related coverage: krebsonsecurity.com
- Related coverage: securityweek.com
Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days - SecurityWeek
Microsoft has announced patches for 622 vulnerabilities, including exploited zero-days in Active Directory and SharePoint Server.www.securityweek.com
- Related coverage: techradar.com
Microsoft breaks Patch Tuesday record with fixes for over 200 security flaws | TechRadar
AI use is really starting to showwww.techradar.com
Last edited:
