Microsoft released fixes for 622 security vulnerabilities on July 14, 2026, making this the largest Patch Tuesday in the program’s history. The company confirmed that two of the flaws are already being exploited in live attacks. Microsoft disclosed the update through its Security Update Guide, and the fixes affect Windows, Office, SharePoint, Exchange, Edge, and several enterprise tools. Businesses and everyday users running Microsoft software are affected, and security teams are being urged to prioritize patching immediately.
Why This Microsoft Update Sets a New Record
This month’s release more than triples the roughly 200 flaws Microsoft addressed in June 2026, which had itself set a high mark. Windows accounts for 416 of the total fixes, the largest single-product share in the release. Office and Office 2016 each carry 82 fixes, while Edge adds 46 and SharePoint Server contributes 17 more.
Security researchers say the jump reflects a broader industry trend rather than a one-time spike. Microsoft said five days before the release that customers should expect a higher volume of updates going forward, partly because of AI-assisted vulnerability discovery tools the company now uses internally.
The Zero-Day Flaws Under Active Attack
Two vulnerabilities in this release are confirmed zero-days already being exploited by attackers. Both were added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, setting firm deadlines for federal agencies to patch.
- CVE-2026-56164 affects on-premises SharePoint Server and allows an unauthenticated attacker to escalate privileges over a network. Federal agencies have until July 17, 2026, to remediate it.
- CVE-2026-56155 affects Active Directory Federation Services and allows an already authenticated attacker to gain elevated privileges locally. The deadline for this flaw is July 28, 2026.
- CVE-2026-50661 is a publicly disclosed BitLocker bypass that requires physical access to a device but does not yet show signs of active exploitation.
Microsoft credited its own incident response teams with discovering both exploited bugs, which points to the flaws surfacing during real investigations rather than routine testing.
Read more: Play Store Redesign
A Separate SharePoint Bug Adds Pressure
Alongside the exploited zero-days, Microsoft patched CVE-2026-55040, a SharePoint authentication bypass reported by Rapid7 through its Pwn2Own Berlin research. Rapid7 chained the bug with a separate remote code execution flaw to demonstrate full unauthenticated compromise of a vulnerable server.
That second flaw in the chain has not been patched yet. Microsoft is expected to release a fix for it during next month’s Patch Tuesday, in August 2026. Until then, patching CVE-2026-55040 removes one link in the attack chain, which is why researchers consider it a priority despite its lower severity rating.
End of Support Adds to the SharePoint Story
This update coincides with the end of extended support for SharePoint Server 2016 and SharePoint Server 2019. Organizations still running those versions no longer receive security patches unless they move to SharePoint Subscription Edition, the only self-hosted version Microsoft continues to fully support.
Companies relying on unsupported SharePoint deployments face growing exposure, since any newly discovered flaws in those versions will go unpatched. IT administrators managing on-premises collaboration platforms should treat this migration as a near-term priority rather than a routine upgrade.
What Else Is Included in the July Release
Beyond the headline zero-days, this July Patch Tuesday release includes dozens of critical-rated bugs across widely used services. Several affect infrastructure that underpins everyday business operations rather than consumer-facing features.
- Remote code execution flaws in Windows DNS Server, DHCP Server, and Remote Desktop Services
- A spoofing vulnerability in Exchange Server that could let attackers impersonate legitimate senders
- Critical bugs in SQL Server and core Windows networking components
- A minor flaw in Age of Empires II: Definitive Edition involving malicious scenario files
Microsoft also finished removing the rollback option for its Kerberos RC4 hardening project, a multi-year effort to phase out an outdated authentication protocol. Administrators who were still using the rollback switch as a temporary workaround no longer have that option available.
Read more: Nintendo Mario Kart
How Organizations Should Prioritize Patching
Security researchers advise treating the two actively exploited flaws as immediate priorities, followed by internet-facing systems and identity infrastructure such as Active Directory. Collaboration platforms like SharePoint and Exchange should come next, given their exposure to external users.
Given the scale of this release, IT teams are encouraged to verify that patches install successfully rather than assuming automatic deployment has completed. With 154 separate security updates bundled into this cycle, confirming successful rollout across managed devices is becoming as important as approving the patches themselves.
Organizations using Microsoft Edge should also confirm that browser versions are up to date, since Edge updates are tracked separately from the core Windows and Office CVE counts. Devices that were offline during the rollout or outside normal management workflows remain at risk until they receive the full update.
