Microsoft's Biggest Patch Tuesday Ever: 570 Bugs, 3 Zero-Days Exploited
Most months, Microsoft's Patch Tuesday lands somewhere between 60–150 fixes. This month it hit 570 — nearly triple the previous record set just a month earlier.
Here's the part that should actually keep you up at night: 3 of those 570 are zero-days, and 2 were already being actively exploited in the wild before a patch existed. Attackers had a head start.
The 3 zero-days you need to know
🔴 CVE-2026-56164 — SharePoint Server EoP (Actively Exploited)
Missing authentication on a critical function lets an unauthenticated remote attacker escalate privileges. No credentials needed. Internet-facing on-prem SharePoint farms are especially exposed. CISA already added this to its KEV catalog with an aggressive deadline.
🔴 CVE-2026-56155 — Active Directory Federation Services EoP (Actively Exploited)
AD FS is the SSO backbone for a huge number of enterprises. A confirmed-exploited flaw here can cascade into identity-based lateral movement across an entire network. Microsoft hasn't published full exploitation details yet, which is typical for actively exploited identity infra bugs.
🟡 CVE-2026-50661 — BitLocker Security Feature Bypass (Publicly Disclosed)
Not yet confirmed exploited, but publicly known — which shortens the runway. An attacker with physical device access could bypass BitLocker and read data-at-rest. Relevant to any org with a lost/stolen laptop policy.
Why the number is so high
Microsoft has pointed to AI-assisted vulnerability discovery scanning the Windows/Office codebase at a scale human researchers can't match. Good news long-term — bugs get found before attackers find them. Short-term, patch volume is only going up, and patch management workflows built for "a few dozen fixes a month" are already behind.
Beyond the zero-days
Two Critical RCE bugs shipped in the same batch and deserve equal attention:
- CVE-2026-58644 — SharePoint RCE, CVSS 9.8, deserialization flaw (CWE-502), rated "Exploitation More Likely"
- CVE-2026-58608 — Windows Print Spooler RCE, CVSS 8.8, use-after-free (CWE-416) — same lineage as PrintNightmare
Practical patching order
- Patch the two actively exploited zero-days first, on internet-facing/identity-critical servers — outside your normal change window if needed
- Patch the Critical RCE bugs next (SharePoint, Print Spooler)
- Roll BitLocker fix out to laptop fleets, especially remote/traveling staff
- Batch remaining EoP/Info Disclosure fixes into your standard cycle, but don't push past 30 days
Full CVE breakdown, detection scripts (PowerShell inventory checks for SharePoint/AD FS footprint), and a SOC/IT triage checklist here:
👉 https://www.xpert4cyber.com/2026/07/microsoft-patch-tuesday-july-2026-570-bugs-3-zero-days.html
What's your team's patch timeline looking like this week? Curious how others are triaging 570 fixes at once.
Tags:
Top comments (0)