Microsoft has issued security updates for 570 flaws, including 59 vulnerabilities rated as "Critical," as part of the Patch Tuesday updates for July 2026. This month stands out as the largest single release in history, putting immense pressure on IT and security teams. The massive cycle is driven by multiple zero-day vulnerabilities and a dangerous wave of wormable, critical-severity flaws affecting core enterprise infrastructure and network layers.
Zero-Days Fixed
Microsoft confirmed the inclusion of three prominent zero-day flaws that were publicly known or actively exploited in the wild prior to a patch being available. These require immediate, out-of-band deployment:
- CVE-2026-56155 - Active Directory Federation Services (AD FS) Elevation of Privilege
- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege
- CVE-2026-50661 - Windows BitLocker Security Feature Bypass
Critical Vulnerabilities to Prioritise
Out of the 570 flaws, 59 received a "Critical" rating, carrying CVSS scores up to 9.9. The following infrastructure and application flaws require immediate mitigation:
- CVE-2026-57092 - Windows Hyper-V Guest-to-Host Escape
- CVE-2026-50370, CVE-2026-50518, & CVE-2026-54128 - Windows DHCP Server & Client RCE
- CVE-2026-55944 - Microsoft Dynamics 365 Business Central RCE
- CVE-2026-55008 - Microsoft Exchange Server Spoofing
Vulnerabilities by Category
The July 2026 updates addressed a total of 570 flaws, categorised as follows:
- Elevation of Privilege Vulnerabilities - 254
- Remote Code Execution Vulnerabilities - 145
- Information Disclosure Vulnerabilities - 102
- Denial of Service Vulnerabilities - 35
- Security Feature Bypass Vulnerabilities - 17
- Spoofing Vulnerabilities - 16
- Total Flaws - 570
Need Help with Patch Management?
Struggling with the relentless pace and record-breaking volume of monthly patching? In 2026, "good enough" security is no longer an option. NOCTeam can secure your environment with proactive Patch Management, M365 hardening, and advanced Endpoint Detection and Response (EDR) services.
Email [email protected] today for a free security checkup of your IT systems.
#PatchTuesday #CyberSecurity2026 #M365 #ZeroDay #VulnerabilityManagement #NOCTeam #Infosec #Remediation #WindowsSecurity #SysAdmin
Originally published on LinkedIn.