A Record-Breaking Patch Tuesday That Overwhelms Traditional Playbooks
Microsoft’s July Patch Tuesday is a coordinated monthly release of fixes for security flaws in Windows, Office, cloud and server products, and this edition sets a record with 622 unique CVE vulnerabilities addressed in a single wave, including multiple zero-day exploits and hundreds of high-severity issues that reshape how enterprises must approach patching strategy and risk prioritization. The headline is not the number alone, but what it exposes: score-based patching is broken. When one cycle carries 600-plus CVEs and a large share are rated High or Critical, "critical" stops sorting anything. Teams that still rely on severity rankings as their main triage lens are now outpaced by attackers targeting the gaps. This Patch Tuesday is a stress test of enterprise patch management maturity—and many environments will fail it.
Microsoft’s security update guide for this month lists 622 distinct CVEs for its products, more than triple the roughly 200 seen in June’s previous high. Another source counts 570 vulnerabilities in the core Microsoft update set alone, with 57 critical and 510 important-severity flaws, plus an additional 468 CVEs tied to Microsoft Edge and its Chromium base. Both views tell the same story: the number on the box is only going up. This is not an aberration but a trajectory, and it forces a simple question: can enterprises sustain traditional patching processes when the volume curves upward and attackers focus almost entirely on what remains unpatched?
Two Live Zero-Days in SharePoint and AD FS: Identity and Collaboration Under Fire
Amid the sea of CVE vulnerabilities, two zero-day exploits stand out because they hit the systems that anchor identity and collaboration. Both are elevation-of-privilege flaws already exploited in the wild: CVE-2026-56164 in on-premises SharePoint Server and CVE-2026-56155 in Active Directory Federation Services. These are not flashy remote code execution bugs, but they target where trust resides—the document store and the box that signs logins. Treat them as infrastructure incidents, not as routine patch items. CISA has added both to its Known Exploited Vulnerabilities catalog and set hard patch-by dates, underscoring that delay here translates directly into attacker opportunity.
The SharePoint zero-day stems from missing authentication for a critical function, allowing an unauthenticated attacker to elevate privileges over the network, with no credentials and no user interaction required. SharePoint has been an attacker magnet since earlier exploit chains tore through unpatched servers, and it remains a favored path to sensitive documents and lateral movement. Microsoft’s advisory notes that enabling the Antimalware Scan Interface on the server and setting Request Body Scan mode to Full can help mitigate this flaw. The AD FS zero-day, driven by insufficient granularity of access control, lets an authenticated attacker elevate locally and gain administrator privileges on the host that signs security tokens. On that kind of system, a "local" elevation bug is a domain-wide trust problem.
Beyond Zero-Days: BitLocker, Copilot, and the Kerberos RC4 Trap
Focusing only on the exploited zero-days misses the larger risk landscape this Patch Tuesday exposes. Microsoft’s own breakdown shows 145 remote code execution vulnerabilities, 254 elevation-of-privilege issues, and dozens more spanning information disclosure, spoofing, and security feature bypass across Windows Media, HTTP.sys, Hyper-V, NTFS, BitLocker, Bluetooth components, Microsoft Copilot, Defender, Exchange Server, and many other products. Among the three zero-day vulnerabilities fixed is a protection mechanism failure in Windows BitLocker that can let an unauthenticated attacker bypass a security feature via a physical attack, potentially defeating device encryption to reach data on the system storage drive. In other words, even "offline" risks are part of this cycle, and ignoring them based on network exposure alone is complacent.
There are also critical remote code execution vulnerabilities in Microsoft Copilot, Microsoft Office SharePoint, Dynamics NAV, Active Directory Domain Services, Windows Message Queuing, and network drivers such as the Reliable Multicast Transport Driver and Windows TCP/IP. These flaws can enable unauthenticated attackers to execute code locally, over the network, or across adjacent network boundaries, often through issues like command injection, deserialization of untrusted data, heap-based buffer overflows, race conditions, and integer underflows. On top of that, this update wave finishes Microsoft’s multi-year Kerberos RC4 hardening: after these patches, RC4 works only for accounts explicitly configured to allow it. If any service account still requests RC4 tickets, its authentication can fail as soon as the update lands, unless teams follow the recommended order—audit using the RC4 events added in January, rotate passwords on flagged accounts to generate AES keys, and only then patch.
Enterprise Patching Strategy: From Severity Scores to Exploit-Driven Decisions
This Patch Tuesday exposes the limits of patch management built around neat queues and static maintenance windows. With attackers targeting unpatched systems and live exploitation already underway, timely deployment of updates remains one of the most effective defenses against compromise—but "timely" can no longer mean "next quarter". When hundreds of CVEs arrive at once, enterprises must abandon score-driven triage in favor of exploit-driven prioritization. The practical guidance is blunt: sort by what is being exploited, using sources such as Known Exploited Vulnerabilities lists, exploit prediction scoring, and Microsoft’s exploited flags, not by severity scores, and patch faster than you used to. In this context, enterprise patching is less about comfort and more about accepting operational disruption as the price of reducing exposure.
The sheer scale of 622 CVEs forces security and infrastructure teams into hard decisions about patching timelines and risk trade-offs across servers, endpoints, collaboration platforms, and identity systems. It also raises uncomfortable questions about CVE tracking effectiveness: a four-point spread in severity on a single bug illustrates how little a score captures in real-world risk. As one source notes, "When a release carries 600-plus CVEs and a large share are rated High or Critical, 'critical' stops sorting anything." Sustainable patch management will require more automation, tighter integration between vulnerability intelligence and change management, and a willingness to push emergency updates for exploited zero-day exploits in SharePoint security and AD FS, even when they cut across planned maintenance cycles. Waiting for perfect order is, in effect, choosing higher breach odds.
Conclusion: Patch Faster, Test Smarter, and Accept the New Normal
This record-setting Microsoft Patch Tuesday is a warning, not an outlier: CVE counts are rising, zero-day exploits are hitting core identity and collaboration systems, and attackers are using unpatched gaps as their primary entry points. Enterprises that cling to slow, severity-only patching models will remain attractive targets. The path forward is clear but uncomfortable: prioritize exploited flaws in SharePoint Server and AD FS first, harden BitLocker and other critical components, and treat the Kerberos RC4 change as a controlled authentication risk that must be tested before deployment. At the same time, accept that sustainable enterprise patching now means continuous change, closer alignment between security and operations, and a more ruthless focus on exploit intelligence over tidy queues. In this new normal, hesitation is not caution—it is exposure.
