Microsoft Patches 622 Vulnerabilities, Including Two Exploited Zero-Days
Summary
Microsoft's July 2026 Patch Tuesday fixes 622 vulnerabilities, including two reported as exploited zero-days affecting AD FS and SharePoint Server. The roundup also highlights critical flaws across Windows and other products.
Key points
- Microsoft released patches for 622 vulnerabilities; the article reports that two Active Directory and SharePoint Server flaws were exploited in the wild as zero-days.
- CVE-2026-56155 affects AD FS and could allow local privilege escalation to administrator.
- CVE-2026-56164 affects SharePoint Server and could allow unauthenticated, network-based privilege escalation.
- CVE-2026-50661 is a BitLocker security-feature bypass exploitable by physical attackers; it was publicly disclosed before the July 2026 Patch Tuesday.
- Windows received fixes for 416 vulnerabilities and Office for 164. Critical flaws highlighted include Windows VMSwitch CVE-2026-57092 and SharePoint CVE-2026-50522.
- The article says Microsoft is using a multi-model agentic scanning harness (MDASH) to find vulnerabilities faster across the Windows codebase.
Article Details
- Event Type
- Microsoft's July 2026 Patch Tuesday release addressed 622 vulnerabilities, including two reported as exploited in the wild as zero-days.
- Impact
- The exploited Active Directory Federation Services flaw could allow local privilege escalation to administrator; the SharePoint Server flaw could allow unauthenticated network-based privilege escalation. Other highlighted issues included a BitLocker security feature bypass exploitable by physical attackers, critical Windows VMSwitch and SharePoint flaws, and several XSS and remote-code-execution vulnerabilities.
CVE
CVE-2026-50518Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +5 morecode execution (RCE) bugs in the Remote Desktop Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and Minecraft Bedrock Dedicated ServerCVE-2026-50522Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreflaws in Windows VMSwitch, tracked as CVE-2026-57092 (CVSS score of 9.9), and SharePoint, tracked as CVE-2026-50522 (CVSS score of 9.8), ZDI says.CVE-2026-50661Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +9 moreAnother security defect that Microsoft drew attention to is CVE-2026-50661, a BitLocker security feature bypass issue that can be exploited by physical attackers and which was publicly disclosed before the July 2026CVE-2026-55008Microsoft · Exchange server; Microsoft · Exchange server subscription editionAn XSS in Exchange Server (CVE-2026-55008) and remote code execution (RCE) bugs in the Remote Desktop Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), andCVE-2026-55010Microsoft · Minecraft bedrock dedicated serverWindows Server Network driver (CVE-2026-56188), and Minecraft Bedrock Dedicated Server (CVE-2026-55010) also deserve increased attention.CVE-2026-56155Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +11 moreTracked as CVE-2026-56155, the exploited AD flaw affects Federation Services (AD FS) and could allow attackers to elevate their privileges locally to administrator.CVE-2026-56164Microsoft · Sharepoint serverAlso leading to privilege escalation, the SharePoint Server flaw is tracked as CVE-2026-56164 and can be exploited over the network without authentication.CVE-2026-56188Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +10 moreProtocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and Minecraft Bedrock Dedicated Server (CVE-2026-55010) also deserve increased attention.CVE-2026-56190Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +10 moreExchange Server (CVE-2026-55008) and remote code execution (RCE) bugs in the Remote Desktop Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and MinecraftCVE-2026-57092Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +10 moredefects that deserve special attention include critical flaws in Windows VMSwitch, tracked as CVE-2026-57092 (CVSS score of 9.9), and SharePoint, tracked as CVE-2026-50522 (CVSS score of 9.8), ZDI says.
People
Pavan DavuluriMicrosoft Windows executive VP who said AI is speeding up vulnerability discovery and described Microsoft's use of MDASH to surface bugs across the Windows codebase.Satnam NarangTenable senior staff research engineer who suggested the BitLocker vulnerability might be related to vulnerabilities disclosed by Nightmare-Eclipse or Chaotic-Eclipse; the article says there was no official confirmation.
Vendors
Products
Active Directory Federation ServicesTracked as CVE-2026-56155, the exploited AD flaw affects Federation Services (AD FS) and could allow attackers to elevate their privileges locally to administrator.BitLockerAnother security defect that Microsoft drew attention to is CVE-2026-50661, a BitLocker security feature bypass issue that can be exploited by physical attackers and which was publicly disclosed before the July 2026Microsoft Active DirectoryMicrosoft on Tuesday announced patches for a record-breaking 622 vulnerabilities, including two bugs in Active Directory and SharePoint Server that have been exploited in the wild as zero-days.Microsoft Exchange ServerAn XSS in Exchange Server (CVE-2026-55008) and remote code execution (RCE) bugs in the Remote Desktop Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), andMicrosoft WindowsAccording to Microsoft’s release notes, Windows received fixes for 416 vulnerabilities this month, while the Office suite received patches for 164 of them.Minecraft Bedrock Dedicated ServerWindows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and Minecraft Bedrock Dedicated Server (CVE-2026-55010) also deserve increased attention.OfficeAccording to Microsoft’s release notes, Windows received fixes for 416 vulnerabilities this month, while the Office suite received patches for 164 of them.SharePoint ServerMicrosoft on Tuesday announced patches for a record-breaking 622 vulnerabilities, including two bugs in Active Directory and SharePoint Server that have been exploited in the wild as zero-days.Windows DHCP Serverand remote code execution (RCE) bugs in the Remote Desktop Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and Minecraft Bedrock DedicatedWindows Server Network driverbugs in the Remote Desktop Protocol (CVE-2026-56190), Windows DHCP Server (CVE-2026-50518), Windows Server Network driver (CVE-2026-56188), and Minecraft Bedrock Dedicated Server (CVE-2026-55010) also deserveWindows VMSwitchSome of the security defects that deserve special attention include critical flaws in Windows VMSwitch, tracked as CVE-2026-57092 (CVSS score of 9.9), and SharePoint, tracked as CVE-2026-50522 (CVSS score of 9.8), ZDI