**Record July Patch Tuesday: What You Need to Do Now**
Microsoft has released its largest **Patch Tuesday** update on record, addressing an unprecedented **622 vulnerabilities** across its software portfolio. Among the fixes are two actively exploited zero-day vulnerabilities in critical infrastructure products. This release highlights the growing challenge of managing security at scale, especially when automation increases both the volume of patches and the speed at which exploits appear.
—
### The Two Zero-Days to Prioritize Immediately
The most urgent fixes are for two flaws that Microsoft confirms are already being exploited in the wild. Both are **elevation-of-privilege vulnerabilities** affecting core identity and document management systems.
* **CVE-2026-56164 (SharePoint Server):** This is the top priority for organizations running on-premises SharePoint Server. The flaw allows an unauthenticated attacker to escalate privileges remotely without needing any user credentials. Microsoft credits incident responders from Mandiant and Google’s FLARE team with discovering this active exploitation.
* **Important Context:** If you are running SharePoint Server 2016 or 2019, today is also the final day of extended support for these versions. Unlike other server products, there is no paid Extended Security Agreement (ESA) option available, making patching mandatory.
* **Mitigation:** Microsoft recommends enabling AMSI (Antimalware Scan Interface) in Full Mode on the server to blunt the attack vector while you apply the patch.
* **CVE-2026-56155 (Active Directory Federation Services – ADFS):** This flaw allows an already-authenticated attacker to escalate privileges locally. ADFS is a critical component because it manages trust and signs authentication tokens for the entire network; a compromise here undermines the security of the entire estate.
**Key Takeaway:** Do not wait for these vulnerabilities to appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Microsoft has already labeled them as exploited, meaning attacks are occurring now.
—
### Other Notable Fixes
Beyond the two immediate threats, the update includes several other critical fixes:
* **CVE-2026-50661 (BitLocker Bypass):** A physically proximate attacker can bypass BitLocker encryption. While not a remote threat, this should be patched as part of your endpoint security routine.
* **CVE-2026-55040 (SharePoint JWT Bypass):** Discovered by Rapid7 during a Pwn2Own contest, this bug allows for authentication bypass. When chained with a separate, unpatched Remote Code Execution (RCE) vulnerability, it could allow an attacker full control. Microsoft will release the second part of the patch in August.
* **Kerberos RC4 Hardening:** This update completes a multi-year effort to remove the RC4 encryption protocol from Kerberos authentication. If your environment relies on legacy service accounts or clients that only support RC4, they will fail to authenticate after this patch is applied. An audit using the new RC4 audit events is required before patching.
—
### Understanding the Scale: Why July Mattered
July is typically the quietest month for Microsoft updates, yet this release included fixes for **622 unique Common Vulnerabilities and Exposures (CVEs)**.
* **Windows:** 416 CVEs
* **SharePoint Server:** 17 CVEs (including the two zero-days)
* **Office:** 82 CVEs
* **SQL Server:** 8 CVEs (including two RCEs rated 8.8)
* **Microsoft Defender:** 5 CVEs (including two Critical RCEs)
The sheer volume underscores a trend Microsoft mentioned in its July 9th post: AI-driven scanning (specifically the MDASH multi-model agentic scanning system) helped identify 16 vulnerabilities in May. While this increases our ability to find flaws, it also means patches are being released faster, giving attackers less time to develop exploits—but giving defenders less time to test and deploy fixes.
—
### FAQ
**Q: What is “Patch Tuesday” and why is it important?**
A: Patch Tuesday is the second Tuesday of every month when Microsoft releases security updates for its software. It is important because it provides a regular, predictable schedule for fixing vulnerabilities. However, due to the severity of the current threats, organizations are advised to prioritize critical patches immediately rather than waiting for the official date.
**Q: Why are the two SharePoint and ADFS vulnerabilities considered “zero-days”?**
A: A zero-day vulnerability is one that is already being exploited in the wild before the vendor (in this case, Microsoft) has released a fix. Because attackers are actively using these flaws, they are considered the highest priority for patching.
**Q: My organization uses SharePoint Online (cloud version). Are we affected?**
A: The specific zero-day mentioned (CVE-2026-56164) affects **on-premises** SharePoint Server. Microsoft typically handles cloud infrastructure security separately, but it is always good practice to ensure automatic updates are enabled for all Microsoft 365 services.
**Q: What does “RC4 Audit Mode” mean for my environment?**
A: Before applying the July update, you must audit your systems to see if any services are still requesting RC4 encryption. You can do this by checking the RC4 audit events in Windows. If a service account is found, you must rotate its password to force the generation of an AES key; otherwise, that service will fail to authenticate after the update.
**Q: How should I prioritize patching with so many vulnerabilities released?**
A: **Do not rely on the CVSS severity score alone.** This month highlights that a “Critical” 9.8 score is less urgent than a “Medium” 6.5 score if the latter is being actively exploited. Prioritize based on:
1. Whether the vulnerability is publicly known/exploited (Check CISA KEV).
2. Whether the vulnerability is reachable from the internet.
3. The value of the asset being protected.
—
### Conclusion
The July 2025 Patch Tuesday serves as a stark reminder that the threat landscape is evolving faster than traditional security models can keep up with. Organizations must move away from relying solely on vulnerability severity rankings and adopt a risk-based approach focused on active exploitation.
The immediate action items are clear:
1. **Patch now** for CVE-2026-56164 (SharePoint) and CVE-2026-56155 (AD FS).
2. **Audit** your environment for the RC4 protocol to avoid authentication outages.
3. **Prepare** for the August patch cycle to address the chained SharePoint RCE vulnerability.
In an era of AI-assisted scanning and automated attacks, the window between patch release and exploit deployment is closing. Vigilance and rapid response are no longer optional—they are the foundation of survival.
