622 CVEs in One Drop: Why This Patch Tuesday Changes the Game
Microsoft’s record Patch Tuesday release of 622 CVEs, including two actively exploited zero-day vulnerabilities in core identity and collaboration systems, forces enterprises to rethink patching priorities, shift from score-based triage to exploit-based decisions, and treat Patch Tuesday July as a turning point in how they manage Microsoft security patches at scale.
This is not just another busy patch cycle; it is a structural break. Microsoft shipped 622 CVEs in July’s Patch Tuesday, more than tripling June’s record of roughly 200 and making it the largest update in the program’s history. The July release alone is bigger than the three previous months combined. Windows accounts for 416 of those fixes, with Office adding another large batch. When the vendor’s own guidance stops listing every CVE in a single page and moves to summary tables, defenders should take the hint: volume is now the norm, not the exception. The idea that you can sort 600-plus updates by “critical” and feel safe is over.
Two Zero-Days in SharePoint and AD FS: Mid-Scores, High Impact
The real story in this ocean of Microsoft security patches is not the count; it is where the live fire is. Two exploited zero-day vulnerabilities are already under active attack: CVE-2026-56164 in on-premises SharePoint Server and CVE-2026-56155 in Active Directory Federation Services. Both are elevation-of-privilege flaws in systems that sit at the heart of enterprise identity and collaboration, and both undermine any comfort you might take from “only” seeing privilege escalation instead of remote code execution.
CVE-2026-56164 lets an unauthenticated attacker escalate privileges over the network with no credentials or user interaction required on self-hosted SharePoint. If you run self-hosted SharePoint, this is the one to grab first, especially because SharePoint Server 2016 and 2019 reach the end of extended support with no paid extended security updates to fall back on. Beyond patching, enabling AMSI in Full Mode on the server blunts the attack. CVE-2026-56155 in AD FS lets an already-authenticated attacker elevate privileges locally through weak access controls. AD FS is the box that signs tokens for the estate, so treating this as a “local” low-urgency bug is wishful thinking.
Kerberos RC4 Cleanup: The Change That Breaks Before It Protects
Buried among the 622 CVEs is a change that can hurt uptime faster than it saves you from attackers: the final phase of Kerberos RC4 hardening. This update finishes Microsoft’s multi-year Kerberos RC4 cleanup by removing the RC4DefaultDisablementPhase rollback switch admins have leaned on since January. After this rollout, RC4 only works for accounts explicitly configured to allow it, and any service account still requesting RC4 Kerberos tickets can fail authentication the moment the update lands.
Enterprises that treat this like any other security fix risk self-inflicted outages. The order matters: audit first using the RC4 audit events Microsoft added in January, then rotate the passwords on flagged service accounts so Windows generates AES keys for them, then patch. Rotation only fixes accounts missing AES keys; anything pinned to RC4 by configuration or legacy clients needs its own remediation before deployment. This one does not get you breached; it breaks things, but it will page you at 2am if you skip the audit. In other words, this is a textbook case for staged rollout and careful testing in any serious enterprise patching strategy.
From CVSS Scores to Exploit Signals: A New Enterprise Patching Strategy
When a release carries 600-plus CVEs and a large share are rated High or Critical, “critical” stops sorting anything. This month proves that zero-day vulnerabilities do not always come with eye-watering CVSS scores: the two exploited zero-days in SharePoint and AD FS are mid-tier privilege flaws, yet both are already in use. Waiting for a CISA Known Exploited Vulnerabilities listing is a luxury; neither CVE is on that catalog as of this writing, but Microsoft’s own exploitability rating already marks both as exploited. For defenders, the calculus has shifted. Sort by what is being exploited, not by CVSS score.
A sane enterprise patching strategy for Patch Tuesday July and beyond looks like this: immediately prioritize exploited zero-days in identity and collaboration systems, including CVE-2026-56164 on self-hosted SharePoint and CVE-2026-56155 on AD FS. Do not wait for a KEV listing to make an exploited bug official. In parallel, treat RC4 hardening as a change-management project, auditing and fixing service accounts before rolling out the updates. After that, phase the remaining Microsoft security patches through test, pilot, and production waves. The blunt truth is that you must patch faster than you used to—but smarter too, or you will trade security incidents for stability incidents.
Looking Ahead: Patch Bypasses, AI Discovery, and the Cost of Delay
Even beyond July’s blast radius, the story continues. A SharePoint JWT authentication bypass, CVE-2026-55040, fixes the part of a chain that Rapid7 Labs used to reach unauthenticated remote code execution against vulnerable servers; the RCE half is not patched yet and is slated for August. That means July’s fix breaks the chain now, and waiting hands attackers a shorter route once the remaining bug details surface. A third publicly disclosed but not-yet-exploited bug, CVE-2026-50661, is another BitLocker bypass requiring physical access, so it should be patched but does not jump ahead of the two live identity flaws.
AI-assisted discovery is already driving this surge in Microsoft security patches, and traditional, human-paced triage cannot keep up. As one report notes, AI-driven exploit development has already produced proof-of-concept exploits for vulnerabilities Microsoft rated “Exploitation Less Likely” or “Exploitation Unlikely”. Britain’s national cybersecurity guidance warned organizations earlier this year to brace for a wave of urgent updates; that wave has arrived. Enterprises that cling to quarterly patch cycles and CVSS-driven spreadsheets will find themselves on the wrong side of this curve. The practical conclusion is clear: prioritize exploited zero-day vulnerabilities, treat identity infrastructure as sacred, plan carefully around disruptive changes like the Kerberos RC4 cleanup, and accept that Patch Tuesday is now a standing incident, not a routine chore.
