Microsoft’s Record 622-Flaw Patch Tuesday Signals a New Reality for Vulnerability Management

Published: July 15, 2026 · Primary topic: Cybersecurity and enterprise infrastructure

What Microsoft Fixed

Microsoft’s July release covers 622 unique CVEs across Windows, Office, Edge, SharePoint Server, Azure, SQL Server, Defender, Exchange Server, and developer tooling. Windows alone accounts for 416 of the listed vulnerabilities, while Office contributes 82 and Microsoft Edge 46.

The release includes two vulnerabilities Microsoft identifies as actively exploited:

• CVE-2026-56164, an elevation-of-privilege vulnerability in on-premises SharePoint Server that Microsoft says can be exploited remotely without authentication or user interaction.
• CVE-2026-56155, an elevation-of-privilege vulnerability in Active Directory Federation Services affecting an already authenticated attacker on the system.

A third zero-day, CVE-2026-50661, affects BitLocker. It had been publicly disclosed before the update but was not reported as actively exploited. Because it requires physical access, it deserves remediation without automatically displacing remotely exploitable or actively exploited weaknesses.

Why the Two Exploited Vulnerabilities Come First

SharePoint Server: externally reachable collaboration infrastructure

CVE-2026-56164 matters because on-premises SharePoint often sits close to sensitive documents, workflows, identities, and internal applications. Microsoft’s exploitation flag should be enough to move affected systems to the front of the remediation queue, particularly where SharePoint is internet-facing or accessible from broadly trusted network zones.

Administrators should patch supported SharePoint deployments promptly, confirm whether Antimalware Scan Interface integration is enabled in Full Mode, review recent authentication and process activity, and verify that unsupported SharePoint Server 2016 or 2019 installations are not being treated as normal long-term production platforms.

AD FS: a local flaw on a high-value identity system

CVE-2026-56155 requires an authenticated attacker and local access, but that does not make it routine. AD FS issues tokens that other systems trust. An attacker who has already established a foothold may use privilege escalation on an identity server to deepen control over the environment.

Organizations still operating AD FS should treat the server as tier-zero or near-tier-zero infrastructure. Restrict administrative access, review interactive and remote logons, verify endpoint detection coverage, and confirm that federation servers are not functioning as general-purpose Windows hosts.

The Compatibility Risk Hiding Behind the Security Fixes

The July update also advances Microsoft’s Kerberos RC4 hardening by removing the rollback switch administrators previously used during the transition. After this change, RC4 remains available only where accounts are explicitly configured to permit it.

This is not an exploit emergency, but it can become an availability incident. Legacy applications, service accounts without usable AES keys, and systems pinned to RC4 may fail authentication after deployment.

Why 622 Is Not Necessarily a Sign of Collapse

A record patch count can indicate a large attack surface and accumulated security debt, but it can also indicate that discovery is improving. Microsoft warned customers before the release that future security updates may include higher vulnerability volumes as artificial intelligence becomes more deeply integrated into internal security testing.

Microsoft has described MDASH, a multi-model agentic scanning system used to identify software weaknesses. The company has not disclosed how many of July’s 622 vulnerabilities came from that pipeline, so it would be premature to credit AI for the entire increase. The broader direction, however, is difficult to miss: automated systems can inspect more code paths, repeat more tests, and surface more potential issues than manual review alone.

That is good news when flaws are discovered and fixed before attackers exploit them. It also creates a downstream burden for defenders. More findings mean more advisories, more testing, more deployment decisions, and more pressure on teams already struggling with patch backlogs.

Old Patch Management Versus Exposure-Based Remediation

Traditional approach	Exposure-based approach
Sort primarily by CVSS	Start with exploitation evidence, reachability, asset role, and compensating controls
One monthly maintenance window	Continuous assessment with emergency and routine lanes
Flat deployment to all systems	Representative test, pilot, broad, and exception rings
Manual or incomplete inventory	Continuously reconciled asset and service ownership data
Success measured by installation count	Success measured by exposure reduction and service health

CVSS remains useful as one input. It describes technical severity under defined assumptions. It does not know whether a vulnerable feature is enabled, whether a service is reachable, whether an asset handles privileged authentication, or whether active exploitation is occurring in the wild.

A modern remediation program combines multiple signals: vendor exploitation flags, CISA’s Known Exploited Vulnerabilities catalog, exploit probability data such as EPSS, internet exposure, identity tier, business criticality, available mitigations, and the blast radius of a failed deployment.

What Enterprise Teams Should Do

1. Inventory the affected platforms. Confirm ownership and exposure for SharePoint Server, AD FS, Exchange Server, SQL Server, Windows Server, endpoints, and developer tooling.
2. Create an emergency lane. Move actively exploited and externally reachable systems ahead of the routine monthly queue.
3. Audit authentication dependencies. Check for RC4 usage and legacy service accounts before broad Windows deployment.
4. Use deployment rings. Test on representative systems, then expand while monitoring authentication, application, storage, and networking telemetry.
5. Validate recovery. Confirm backups, snapshots where appropriate, rollback procedures, and ownership before touching business-critical infrastructure.
6. Review for compromise. Patching closes the vulnerability; it does not remove an attacker who arrived before remediation.

What Small Businesses and Self-Hosted Operators Should Do

Smaller environments may not have a dedicated vulnerability-management platform, but they can still apply the same logic. Start by listing exposed services and the systems that control identity. Patch SharePoint and AD FS first when present, then move through externally reachable Windows services, domain controllers, management servers, and high-value endpoints.

For homelabs and self-hosted environments, snapshots can reduce recovery time, but they are not substitutes for tested backups. Avoid snapshotting transactional workloads blindly, document dependencies, and verify that a rollback will not create directory, database, or replication inconsistencies.

What Remains Unknown

• Microsoft has not publicly detailed how the two exploited vulnerabilities were used or which threat actors were responsible.
• The company has not stated how many July vulnerabilities were found through AI-assisted systems.
• The exploitation timeline and scale may change as incident responders publish additional findings.
• A separate SharePoint authentication-bypass chain remains notable because another component of the demonstrated chain is expected to receive a fix later.

RavenHawkTech Analysis: Patch Management Is Becoming a Data Problem

Microsoft’s record release is less a one-month anomaly than a preview of a higher-volume future. AI-assisted code analysis will likely help vendors discover more flaws, while attackers use automation to compare patched and unpatched builds and reduce the time needed to understand a fix.

The result is a shrinking decision window. Organizations that depend on spreadsheets, stale inventories, and a single monthly deployment event will struggle—not because their administrators are careless, but because the information volume exceeds what manual triage can reliably process.

The sustainable response is not blind automation. It is observable automation: reliable asset data, service ownership, exposure mapping, deployment rings, health checks, rollback paths, and documented exceptions. Automation should accelerate good decisions, not hide bad ones.

Sources and Further Reading

• Microsoft Security Update Guide
• The Hacker News: Microsoft Patches Record 622 Flaws
• CISA Known Exploited Vulnerabilities Catalog