Microsoft Patch Tuesday July 2026 – Record 570 Vulnerabilities Patched

In July 2026, Microsoft addressed a record total of 570 vulnerabilities, including three zero-days, two of which were exploited in the wild and one that was publicly disclosed. The release includes 59 Critical vulnerabilities, with Remote Code Execution (RCE) flaws making up the majority of the Critical-rated issues.

It is important to note that the total announced by Microsoft excludes certain security fixes released outside the primary monthly bundle, such as those related to cloud services, online services, and Chromium/Edge. Consequently, organizations should not consider the 570 vulnerabilities to be a complete count of all Microsoft-related security issues disclosed in July.

Patch Tuesday Overview

The counts for vulnerability categories exceed 570 because individual Microsoft advisories may be tracked across product and vulnerability classifications differently in third-party Patch Tuesday reporting.

This July update notably includes a high concentration of fixes for Windows, as well as updates for SharePoint, Office, Exchange, SQL Server, Hyper-V, DHCP, Remote Desktop, Power BI, and Microsoft 365 applications.

The most urgent fixes address two vulnerabilities confirmed to have been exploited, and one publicly disclosed BitLocker bypass. Security teams should prioritize addressing these vulnerabilities, particularly in environments using Active Directory Federation Services (AD FS), on-premises SharePoint, or endpoints protected by BitLocker.

Immediate attention is required for SharePoint Server. In addition to the exploited CVE-2026-56164, Microsoft has also patched CVE-2026-55040, a Critical authentication bypass in SharePoint that Rapid7 states could be combined with a second, still-embargoed issue to achieve unauthenticated remote code execution on vulnerable servers.

Critical Remote Code Execution fixes were also released for Windows Print Spooler, DHCP, Remote Desktop, Media Foundation, Active Directory Domain Services, SQL Server, Microsoft Office, and Microsoft Defender. These services are often found in privileged or highly connected enterprise environments, making quick identification of assets and patch deployment essential.

Notably, Microsoft’s July 2026 Patch Tuesday coincides with the end-of-support milestones for SharePoint Server 2016 and 2019. Organizations using these products should assess their support postures and consider migrating to SharePoint Subscription Edition.

Recommended Actions

1. Deploy July security updates immediately for internet-facing SharePoint, AD FS, Exchange, Remote Desktop, DHCP, DNS, and domain-controller infrastructure.

2. Look for signs of compromise on SharePoint and AD FS servers before and after remediation, especially due to confirmed exploitation of CVE-2026-56164 and CVE-2026-56155.

3. Enable AMSI and set SharePoint Request Body Scan to Full where applicable to reduce exposure to the exploited SharePoint issue.

4. Patch or restrict Print Spooler on servers where printing is not necessary, due to the Critical Windows Print Spooler RCE vulnerability.

5. Review physical access controls, recovery key governance, endpoint encryption status, and boot protections related to CVE-2026-50661.

6. Prioritize critical RCE patches before addressing lower-risk local privilege escalation issues, and then complete the full cumulative update rollout through standard change-control procedures.

7. Confirm support status for SharePoint 2016/2019 and other products that are nearing or have surpassed their lifecycle deadlines.

The following table includes the CVEs provided in the July 14, 2026 advisory. All entries are marked as requiring customer action and were released on July 14, 2026. They were not publicly disclosed or known to be exploited at the time of release based on the advisory fields provided.

Gain browser-level visibility to expose decrypted phishing pages, speed investigations, and cut credential theft costs -> Power your SOC with ANY.RUN