Microsoft patches 622 vulnerabilities, including two exploited zero-days
Summary
Microsoft’s Patch Tuesday addressed a record 622 vulnerabilities, including two actively exploited zero-days in Active Directory Federation Services and SharePoint Server. SAP also patched critical flaws in NetWeaver Application Server and Approuter.
Key points
- Microsoft patched 622 vulnerabilities across Windows, Office, Edge and other products.
- The update fixed two actively exploited zero-days: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server.
- The release included 416 Windows flaws, 82 in Office and 46 in Edge; 63 vulnerabilities were rated critical.
- SAP patched critical vulnerabilities CVE-2026-44747 in NetWeaver Application Server and CVE-2026-27690 in Approuter.
- Tenable’s Satnam Narang said the growing CVE volume may reflect improved bug-finding tools and does not necessarily indicate that every flaw poses a risk to organizations.
Article Details
- Event Type
- Microsoft and SAP monthly security updates addressing vulnerabilities, including two actively exploited Microsoft zero-days.
- Impact
- Microsoft patched 622 vulnerabilities across its products; 63 were rated critical. The two actively exploited zero-days were privilege-escalation flaws in Active Directory Federation Services and Microsoft SharePoint Server. SAP also patched critical flaws in NetWeaver Application Server and Approuter.
CVE
CVE-2026-27690Sap · ApprouterSAP also addressed a fresh assortment of vulnerabilities Tuesday, including critical defects CVE-2026-44747 in SAP NetWeaver Application Server and CVE-2026-27690 in SAP Approuter.CVE-2026-44747Vendor / Product unavailableSAP also addressed a fresh assortment of vulnerabilities Tuesday, including critical defects CVE-2026-44747 in SAP NetWeaver Application Server and CVE-2026-27690 in SAP Approuter.CVE-2026-56155Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +11 moreMicrosoft disclosed two actively exploited zero-day vulnerabilities — CVE-2026-56155 and CVE-2026-56164, privilege escalation defects in Active Directory Federation Services and Microsoft SharePoint Server, respectively.CVE-2026-56164Microsoft · Sharepoint serverMicrosoft disclosed two actively exploited zero-day vulnerabilities — CVE-2026-56155 and CVE-2026-56164, privilege escalation defects in Active Directory Federation Services and Microsoft SharePoint Server, respectively.
People
Dustin ChildsHead of threat awareness at Trend Micro’s Zero Day Initiative; commented on the scale of Microsoft’s release.Satnam NarangSenior staff research engineer at Tenable; estimated Microsoft could exceed 2,000 or potentially 3,000 CVEs in 2026 and cautioned that vulnerability volume does not by itself establish organizational risk.
Vendors
MicrosoftMicrosoft’s latest Patch Tuesday set a record by addressing 622 vulnerabilities across Windows, Office, Edge, and other business products, including two actively exploited zero-days in Active Directory FederationSAPSAP also issued fixes for critical flaws in NetWeaver Application Server and Approuter as Microsoft’s vulnerability totals continue rising sharply.
Products
Active Directory Federation ServicesOffice, Edge, and other business products, including two actively exploited zero-days in Active Directory Federation Services and SharePoint Server.EdgeMicrosoft’s latest Patch Tuesday set a record by addressing 622 vulnerabilities across Windows, Office, Edge, and other business products, including two actively exploited zero-days in Active Directory FederationMicrosoft SharePoint ServerMicrosoft disclosed two actively exploited zero-day vulnerabilities — CVE-2026-56155 and CVE-2026-56164, privilege escalation defects in Active Directory Federation Services and Microsoft SharePoint Server, respectively.Microsoft WindowsMicrosoft’s latest Patch Tuesday set a record by addressing 622 vulnerabilities across Windows, Office, Edge, and other business products, including two actively exploited zero-days in Active Directory FederationOfficeMicrosoft’s latest Patch Tuesday set a record by addressing 622 vulnerabilities across Windows, Office, Edge, and other business products, including two actively exploited zero-days in Active Directory FederationSAP ApprouterSAP also addressed a fresh assortment of vulnerabilities Tuesday, including critical defects CVE-2026-44747 in SAP NetWeaver Application Server and CVE-2026-27690 in SAP Approuter.SAP NetWeaver Application ServerSAP also addressed a fresh assortment of vulnerabilities Tuesday, including critical defects CVE-2026-44747 in SAP NetWeaver Application Server and CVE-2026-27690 in SAP Approuter.