Microsoft Patches Record 622 CVEs, Including Two Actively Exploited Zero-Days

Summary

Microsoft's July Patch Tuesday addresses 622 CVEs. The company flags two privilege-escalation flaws in SharePoint Server and AD FS as exploited; the release also completes Kerberos RC4 hardening and includes a SharePoint authentication-bypass fix.

Key points

Microsoft's Security Update Guide lists 622 unique CVEs in the release; ZDI independently counted 621.
Microsoft says CVE-2026-56164 in on-premises SharePoint Server is being exploited. The article describes it as an unauthenticated, network-based privilege-escalation flaw.
Microsoft also flags CVE-2026-56155 in Active Directory Federation Services as exploited; it requires authentication and allows local privilege escalation, according to the article.
SharePoint Server 2016 and 2019 reached the end of extended support on the release date, according to the article.
Rapid7's CVE-2026-55040 SharePoint JWT authentication-bypass finding was reportedly chained with a separate, unpatched RCE; Microsoft is slated to fix that RCE in August.
The update removes the Kerberos RC4 rollback switch. The article advises auditing RC4 use and rotating flagged service-account passwords before patching to reduce authentication failures.

Article Details

Event Type: Microsoft Patch Tuesday security update release
Impact: Microsoft patched 622 CVEs, including two vulnerabilities reported as actively exploited: an unauthenticated network privilege-escalation flaw in SharePoint Server and a local privilege-escalation flaw in Active Directory Federation Services. A separate SharePoint JWT authentication bypass can be chained with an unpatched remote-code-execution flaw to reach unauthenticated RCE. The update also removes the Kerberos RC4 rollback switch, which may cause authentication failures for service accounts or legacy clients that still depend on RC4.