Microsoft July 2026 Patch Tuesday Fixes 570 Flaws, Including Three Zero-Days
Summary
Microsoft’s July 2026 Patch Tuesday addresses 570 vulnerabilities, including two actively exploited privilege-escalation flaws and a publicly disclosed BitLocker bypass.
Key points
- The release fixes 59 critical vulnerabilities, including 48 remote code execution flaws.
- CVE-2026-56155 allows an authorized attacker to elevate privileges locally in Active Directory Federation Services; Microsoft reports active exploitation.
- CVE-2026-56164 allows an unauthorized attacker to elevate privileges over a network in SharePoint Server and has been actively exploited.
- Microsoft says enabling AMSI and setting Request Body Scan mode to Full can help mitigate the SharePoint flaw.
- CVE-2026-50661 is a publicly disclosed BitLocker bypass that could expose encrypted data to an attacker with physical access.
- Microsoft has not disclosed details of how the two actively exploited flaws were used in attacks.
Article Details
- Event Type
- Microsoft July 2026 Patch Tuesday security updates
- Impact
- Microsoft patched 570 vulnerabilities, including two actively exploited privilege-escalation zero-days and a publicly disclosed BitLocker bypass that could expose encrypted data to an attacker with physical access. The release includes 59 critical vulnerabilities.
CVE
CVE-2026-50661Microsoft · Windows 10 1607; Microsoft · Windows 10 1809; +9 moreCVE-2026-50661 is a publicly disclosed BitLocker bypass that could expose encrypted data on physically accessed devices.CVE-2026-56155Microsoft · Windows 10 Version 1607; Microsoft · Windows 10 Version 1809; +11 moreCVE-2026-56155 affects Active Directory Federation Services and enables privilege escalation.CVE-2026-56164Microsoft · Sharepoint serverCVE-2026-56164 affects Microsoft SharePoint Server and was used for remote privilege escalation.
People
Genwei JiangMicrosoft credited Jiang with the actively exploited SharePoint Server vulnerability CVE-2026-56164.Jayson FrostMicrosoft credited Frost with the actively exploited SharePoint Server vulnerability CVE-2026-56164.Jeremy KingstonMicrosoft credited Kingston with the actively exploited Active Directory Federation Services vulnerability CVE-2026-56155.Scott ClarkMicrosoft credited Clark with the actively exploited Active Directory Federation Services vulnerability CVE-2026-56155.
Vendors
Products
Active Directory Federation ServicesThe fixes span major products such as Active Directory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege,BitLockerThe fixes span major products such as Active Directory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege,Microsoft Defender Antimalware PlatformDirectory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege, remote code execution, information disclosure,Microsoft Exchange Serverspan major products such as Active Directory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege, remoteMicrosoft SharePoint ServerCVE-2026-56164 affects Microsoft SharePoint Server and was used for remote privilege escalation.Microsoft Windowssuch as Active Directory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege, remote code execution,Officeproducts such as Active Directory Federation Services, SharePoint Server, BitLocker, Exchange Server, Office, Windows, and Microsoft Defender, with broad coverage across elevation of privilege, remote code