Microsoft's July 2026 Patch Tuesday shattered its own record, fixing 622 CVEs — roughly three times the volume of the previous month's release. Buried in that flood is a genuinely dangerous pair of actively exploited zero-days: CVE-2026-56155, an elevation-of-privilege flaw in Active Directory Federation Services, and CVE-2026-56164, a related elevation-of-privilege bug in SharePoint Server. Both are being exploited in the wild right now, and both target identity infrastructure specifically — which means the real risk here isn't the raw 622-CVE number, it's that two of the exploited bugs sit at the exact layer where a single successful attack can cascade into your entire authentication stack.
The scale problem is now the story, not just the individual bugs
622 CVEs in a single monthly release is not just a big number — it's a triage crisis for any security team running a traditional "patch everything within thirty days" policy. Windows alone accounted for 416 of the vulnerabilities, followed by Office with 82 and Microsoft Edge with 46. Fifty-nine are rated Critical, and 48 of those are remote code execution flaws. At this volume, comprehensive patching within a standard maintenance window is not realistic for most IT teams, which makes the two actively exploited zero-days the only defensible starting point for prioritization this month — everything else genuinely can wait a few days if it has to.
CVE-2026-56155: the ADFS bug that deserves top priority
CVE-2026-56155 affects Active Directory Federation Services, the identity federation service that underpins single sign-on for a huge share of enterprise Microsoft 365 and hybrid-cloud deployments. It's an elevation-of-privilege vulnerability: a successful exploit lets an attacker gain administrator-level privileges within the ADFS environment. Because ADFS sits at the trust boundary between your on-premises identity infrastructure and everything federated through it — Microsoft 365, Azure AD-integrated SaaS applications, VPN and remote access systems tied to the same identity provider — a compromised ADFS server isn't a single-system incident. It's a keys-to-the-kingdom event, because every downstream service that trusts ADFS-issued tokens inherits the compromise.
This is the vulnerability category security teams should fear most in any Patch Tuesday: not the highest CVSS score necessarily, but the one sitting at the identity chokepoint where a successful exploit doesn't just compromise one server, it potentially compromises the trust relationship for everything federated behind it.
CVE-2026-56164: SharePoint's companion zero-day
The second actively exploited zero-day, CVE-2026-56164, is also an elevation-of-privilege flaw, this time in SharePoint Server, caused by a missing authentication check that lets an attacker escalate privileges over the network. This is a different vulnerability from CVE-2026-45659, the SharePoint RCE that CISA added to its Known Exploited Vulnerabilities catalog earlier this month and which organizations should already have patched. CVE-2026-56164 is a fresh, separate flaw in the same product family — a reminder that "we already patched SharePoint this month" is not a safe assumption once a second, unrelated zero-day surfaces in the same platform within weeks.
A third notable flaw, CVE-2026-50661, is a publicly disclosed but not yet actively exploited BitLocker security feature bypass that allows an unauthorized attacker with physical device access to defeat disk encryption. It's not under active attack today, but public disclosure means a working exploit technique is now available to anyone who wants to build one, and organizations with a meaningful population of lost-or-stolen device risk — field staff, executives who travel, shared workstations — should treat it as a near-term priority rather than routine backlog.
Why this record-breaking pace isn't a one-month anomaly
This is the second consecutive month Microsoft has broken its own Patch Tuesday volume record, and security researchers tracking the trend note that CVE disclosure volume across the industry has been climbing steadily for the past two years, driven partly by more aggressive internal security research at major vendors and partly by AI-assisted vulnerability discovery tools that are finding flaws faster than manual code review ever did. The uncomfortable implication for security teams: 622-CVE months may become the new normal rather than an outlier, which means the traditional monthly patch cycle model — review everything, prioritize by CVSS score, patch within a defined SLA — needs to evolve toward a model that assumes zero-day-first triage every single month, because the volume of routine patches will keep growing regardless.
Why identity infrastructure keeps being the weak point
This month's ADFS and SharePoint zero-days fit a pattern that's been building across 2026: attackers are increasingly targeting identity and authentication infrastructure directly, rather than trying to break into individual endpoints or applications one at a time. It's a rational shift in attacker strategy. A compromised workstation gets you one machine's worth of access. A compromised identity provider gets you a standing foothold across every application, service, and resource that trusts tokens issued by that provider — often silently, without triggering the endpoint detection tools that would catch a more traditional malware infection. Security teams that have spent years hardening endpoints while treating identity infrastructure as "set it up once and leave it alone" now have the weakest link precisely where attackers are concentrating effort.
This also compounds with a broader trend documented across multiple incidents this year: credential-focused attacks, from FortiGate firewall sniffing campaigns to Azure CLI password-spray operations, have flooded the threat landscape with valid, stolen credentials. A stolen password paired with a live ADFS elevation-of-privilege bug is a far more dangerous combination than either vulnerability alone — the credential gets an attacker in the door, and the zero-day lets them escalate once they're there. Any organization treating this month's Patch Tuesday as an isolated event, rather than one more entry in a running pattern of identity-layer attacks, is underestimating the actual risk.
What good ADFS hardening looks like beyond just patching
Patching CVE-2026-56155 addresses this specific bug, but ADFS hardening as a discipline goes further, and it's worth reviewing your baseline configuration while you're already in the environment applying this patch. Confirm that ADFS servers are not directly internet-facing without a Web Application Proxy in front of them. Review which service accounts have administrative rights on the ADFS farm, and whether any of them are broader than strictly necessary. Check that ADFS event logging is actually being forwarded to your SIEM rather than sitting locally on the server where an attacker with admin access could simply clear it. None of this is new advice, but a record-breaking Patch Tuesday with an ADFS zero-day at the center of it is exactly the kind of forcing function that should prompt a genuine configuration review, not just a patch-and-move-on response.
What to actually do this week
-
Patch ADFS and SharePoint servers first, today, ahead of everything else in this release. These are the two confirmed actively-exploited zero-days, and ADFS specifically warrants same-day attention given its position in your identity trust chain.
-
Audit ADFS logs for anomalous privilege escalation activity now, not just after patching. If CVE-2026-56155 has already been exploited against your environment before you patch, the patch alone won't undo a compromise that already happened — check for unexpected admin account creation, unusual token issuance patterns, and configuration changes you didn't make.
-
Don't assume last month's SharePoint patch covers this month's SharePoint zero-day. CVE-2026-56164 is unrelated to CVE-2026-45659. Confirm your patch management tooling is tracking both CVEs independently rather than marking SharePoint as "handled" after addressing one.
-
Prioritize BitLocker enforcement for any device population with meaningful loss or theft exposure. CVE-2026-50661 isn't under active attack yet, but public disclosure typically precedes weaponization by weeks, not months, in the current threat environment.
-
Build a "zero-day first" triage lane into your patch management process permanently, not just for this release. Given two consecutive months of record CVE volume, treating every Patch Tuesday as a full review-and-prioritize exercise from scratch is no longer sustainable. A standing process that isolates confirmed actively-exploited flaws for same-day action, while routing the rest into a normal 30-day cycle, is the only realistic way to keep up.
-
Brief leadership on the volume trend, not just this month's numbers. If CVE disclosure volume keeps climbing, your security team's headcount and tooling budget conversation needs to reflect that reality before the gap between patch volume and patch capacity becomes an actual breach, not a hypothetical one.
The bottom line
A 622-CVE Patch Tuesday is a genuinely hard month for any security team, but it's also a useful forcing function: it makes clear that CVSS-score-based prioritization alone doesn't scale at this volume, and that "actively exploited" has to become the first and fastest filter your team applies, every single month, not just when the number is unusually high. Patch ADFS and SharePoint today. Then plan for next month's Patch Tuesday to be just as large, because at this point, that's the trend line, not the exception.