Three Zero Days 570 Flaws Microsoft S July 2026 Patch Tuesday Sets A New Record

Microsoft's July 2026 Patch Tuesday delivered the company's largest monthly security update to date, addressing 570 vulnerabilities across Windows, Microsoft Office, SharePoint Server, Active Directory, Hyper-V, Remote Desktop, DHCP, Microsoft Dynamics, Defender, Exchange Server, .NET, Visual Studio, Copilot, and numerous core operating system components.

The release includes three zero-day vulnerabilities , two of which were already being exploited in real-world attacks. The actively exploited flaws affect Active Directory Federation Services and Microsoft SharePoint Server, placing enterprise identity and collaboration infrastructure at immediate risk. A third publicly disclosed vulnerability could allow an attacker with physical access to bypass Windows BitLocker protections and access encrypted data.

Here is the breakdown of the 570 vulnerabilities addressed in the July2026 update:

Microsoft's July 2026 security release addresses three vulnerabilities classified as zero-days. Two were exploited in attacks before patches became available, while the third had been publicly disclosed.

CVE-2026-56155 is an elevation-of-privilege vulnerability affecting Active Directory Federation Services (AD FS). The flaw results from insufficiently granular access control and can allow an authenticated, locally positioned attacker to obtain administrator privileges.

Microsoft confirmed that the vulnerability was exploited in the wild before the July update became available. Although exploitation requires the attacker to possess valid access and execute the attack locally, the vulnerability is particularly serious because AD FS is commonly deployed as part of enterprise authentication and federated identity environments.

CVE-2026-56164 is an actively exploited elevation-of-privilege vulnerability in Microsoft SharePoint Server. The issue is caused by missing authentication for a critical function and can allow an unauthenticated remote attacker to gain elevated privileges over a network.

The vulnerability affects supported on-premises SharePoint deployments, including SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Because exploitation can occur remotely without valid credentials, exposed or externally accessible SharePoint servers represent the highest remediation priority.

CVE-2026-50661 is a publicly disclosed security feature bypass affecting Windows BitLocker. The vulnerability stems from a failure in a protection mechanism and could allow an attacker with physical access to bypass BitLocker Device Encryption on the system storage device.

Successful exploitation could provide access to data that an organization expects to remain protected by full-disk encryption. The vulnerability is therefore particularly relevant to laptops, portable workstations, field systems, shared devices, and equipment located in physically accessible or untrusted environments.

In addition to the three zero-days, the July update includes some of Critical vulnerabilities affecting enterprise applications, server infrastructure, identity services, networking components, productivity software, and virtualization platforms.

CVE-2026-57092 is a use-after-free vulnerability affecting Windows VMSwitch. The flaw received a CVSS score of 9.9 and could allow a low-privileged attacker operating within a virtualized environment to cross a security boundary and compromise the underlying host.

The vulnerability is particularly significant for Hyper-V environments because compromise of the host could expose multiple virtual machines, management services, stored credentials, and workloads running on the same virtualization platform.

CVE-2026-55944 is a Critical remote-code-execution vulnerability affecting Microsoft Dynamics NAV and on-premises Microsoft Dynamics 365 Business Central. The issue results from deserialization of untrusted data and can be triggered through a specially crafted login request.

Exploitation does not require authentication or user interaction. An attacker who can reach a vulnerable server over the network could potentially execute arbitrary code, compromise application data, steal credentials, or use the affected system as an entry point into the broader enterprise network.

CVE-2026-50518 is a heap-based buffer overflow in Windows DHCP Server. The vulnerability received a CVSS score of 9.8 and may allow an unauthenticated remote attacker to execute code by sending specially crafted network traffic to an affected service.

DHCP is a foundational network service, and compromise of a DHCP server could disrupt address allocation, affect network availability, expose infrastructure configuration, or provide an attacker with access to a trusted server located deep within the enterprise network.

CVE-2026-56190 is an unauthenticated remote-code-execution vulnerability affecting Windows Remote Desktop Server. Specially crafted RDP traffic could interact with an uninitialized resource, potentially leading to memory corruption and arbitrary code execution.

Organizations should identify systems exposing Remote Desktop services, especially those reachable from the internet, partner networks, unmanaged segments, or remote-access environments. Access to RDP should be restricted through VPNs, gateways, firewalls, network-level authentication, and multifactor authentication.

CVE-2026-49164 is a heap-based buffer overflow in Active Directory Domain Services. The vulnerability may allow an unauthenticated attacker to execute code over a network, making affected domain infrastructure a high-value target.

Domain controllers are central to authentication, authorization, policy enforcement, and identity management. Successful exploitation could have organization-wide consequences, including credential compromise, persistence, lateral movement, and loss of control over the Windows domain.

CVE-2026-55008 affects Microsoft Exchange Server and can enable stored script execution through Outlook Web Access. A maliciously crafted email viewed through the affected web interface could execute attacker-controlled JavaScript in the user's browser session.

Depending on the victim's privileges and active session, exploitation could support session abuse, account impersonation, theft of sensitive mailbox information, or delivery of additional malicious content.

The July 2026 Patch Tuesday release affects a broad range of Microsoft's enterprise, productivity, identity, virtualization, networking, and security products, addressing approximately 570 vulnerabilities across the Windows ecosystem, including three zero-days.

Saner Patch Management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here .