This Month’s Patch Cycle Is Not Normal—and You Cannot Treat It As Such
This month’s patch cycle is an unprecedented wave of critical security patches and CVE vulnerability updates across Microsoft, Firefox, Chrome, Adobe, and VMware, combining record-breaking volume, multiple zero-day exploits, and public proof-of-concept code that sharply increases the risk of rapid, widespread attacks against identity, collaboration, and web-facing infrastructure. Microsoft shipped 622 CVEs in July’s Patch Tuesday, more than tripling June’s total and marking the largest update in the program’s history. The release alone is bigger than the previous three months combined, a clear sign that AI-driven discovery has turned patching into a continuous crisis rather than a monthly chore. When the volume curve goes vertical, IT teams that cling to traditional severity-based triage are going to lose. The only rational response is aggressive, exploit-focused prioritization and faster patch deployment than you are used to.
Start Here: Microsoft’s Actively Exploited Identity and Collaboration Zero-Days
Priority one is Microsoft’s two exploited zero-day exploits already under active attack. CVE-2026-56164 hits on-premises SharePoint Server, letting an unauthenticated attacker elevate privileges over the network with no credentials or user interaction required. CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services found by Microsoft’s DART unit. Both attack the heart of identity and collaboration, and both carry mid-tier CVSS scores of 5.3 and 7.8—proof that “critical” labels no longer sort anything when 600-plus CVEs land in a day. SharePoint Server 2016 and 2019 reached end of extended support on the same day, with no paid extended security updates available, meaning unpatched instances quickly become soft targets. For defenders, the calculus has shifted: sort by what is being exploited, not by CVSS score, patch faster than before, and do not wait for any external catalog to bless an exploited bug as “official” before you act.
Public Exploits Put Browsers and Encryption Squarely in the Firing Line
Next, you must move on browser and platform flaws where exploit code is already public. Mozilla released updates for two critical security patches in Firefox—CVE-2026-15718, an invalid pointer in the JavaScript WebAssembly component, and CVE-2026-15719, a site isolation issue in DOM Navigation—and warned that exploit code for these vulnerabilities has been published. Both are fixed in Firefox version 152.0.6, and you should treat that upgrade as mandatory. Google shipped fixes for 15 flaws in Chrome, including critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), patched in Chrome 150.0.7871.124/.125 across platforms. A third publicly disclosed but not-yet-exploited Windows bug, CVE-2026-50661, allows a BitLocker bypass via physical access, linked to the “GreatXML” research and an ecosystem of proof-of-concept exploits that show how quickly “Exploitation Unlikely” can become weaponized. Anthropic’s Red Team already demonstrated that 13 of 14 such “low-risk” vulnerabilities could be exploited.
Enterprise Stack Under Fire: Adobe ColdFusion, Commerce, AEM, and VMware
If your environment includes Adobe server products or VMware Avi, they belong near the top of your queue. Adobe shipped security updates for 88 vulnerabilities, including multiple critical-severity ColdFusion flaws. Eight CVEs hit ColdFusion, with CVE-2026-48318—a path traversal bug—rated CVSS 9.9 and capable of arbitrary code execution. Other issues include code injection (CVE-2026-48322), improper input validation (CVE-2026-48284), missing authentication for critical functions (CVE-2026-48325), SQL injection (CVE-2026-48324), and several incorrect authorization and path traversal bugs that can drive privilege escalation or remote code execution. They are fixed in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22. Adobe also addressed critical vulnerabilities in Commerce and Magento Open Source—such as a file upload flaw (CVE-2026-48356) and an output encoding issue (CVE-2026-48358)—and high-impact server-side request forgery and XML external entity flaws in Experience Manager. Meanwhile, Broadcom released a fix for a critical authentication bypass in VMware Avi Load Balancer (CVE-2026-47865, CVSS 9.8), which allows a malicious user with network access to reach the Avi control plane.
A New Patch Strategy for AI-Speed Vulnerabilities
The uncomfortable truth is that your old patch playbook will not survive AI-speed vulnerability discovery. Microsoft has already warned customers to expect a higher volume of security updates in each release as internal multi-model scanning discovers more bugs, and its July Security Update Guide has shifted to summary tables instead of listing every CVE. Meanwhile, more than 35,000 CVEs were published in the first half of 2026, but only 85—0.24%—appeared in one major Known Exploited Vulnerabilities catalog, underscoring how incomplete traditional “watch lists” are when the volume curve goes vertical. The flood of patches is gutting severity-based triage; this month’s two exploited zero-days are mid-score issues, while a Windows VMSwitch elevation-of-privilege vulnerability carries a CVSS 9.9 but is not yet the most urgent threat. Your new strategy should be blunt: track Patch Tuesday alerts closely, sort by exploitation and public proof-of-concept, patch browsers, identity and encryption systems on an emergency timeline, and accept that waiting for comfort signals from third parties is now itself a risk decision.
