Microsoft shipped its largest security update on record on 14 July 2026, and two of the fixes close holes attackers were already using. The scale is genuinely new: depending on how they are counted, the release covers 621 vulnerabilities by Zero Day Initiative's tally, 622 by Microsoft's own Security Update Guide, and around 570 by narrower counts that exclude certain product variants — more than triple June's previous record of roughly 200. The counting differences are accounting, not disagreement about whether the patches exist. What matters for defenders is narrower than the headline number: two bugs are being exploited now, and the sheer volume has broken the usual way of deciding what to fix first.

The two that are already being exploited

Both live zero-days are elevation-of-privilege flaws, and both sit in infrastructure that matters more than the flaws' modest severity scores suggest.

CVE-2026-56164 is a SharePoint Server elevation-of-privilege vulnerability rated only CVSS 5.3, a Moderate score that will have tempted some organisations to deprioritise it. That would be a mistake. Microsoft describes the issue as an elevation-of-privilege vulnerability that can be exploited remotely without authentication under the conditions outlined in its advisory, making it significantly more important than its moderate CVSS score might suggest. It affects SharePoint Server 2016, 2019, Enterprise Server 2016 and Subscription Edition. Microsoft's advisory notes that enabling the Antimalware Scan Interface in Full Mode on the server reduces the exposure as an interim measure alongside patching.

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services, rated CVSS 7.8. It requires an attacker to already have local access with low privileges — which reads as a limited threat until you consider what AD FS does. It is the service that issues and signs the authentication tokens that federated applications trust, from cloud services to on-premises apps. An attacker who escalates to administrator on an AD FS host is standing in the identity plane, able to forge tokens and impersonate users across every connected service. Microsoft's own Detection and Response Team is credited with the discovery, which strongly suggests it was found during the investigation of real intrusions. The company has not disclosed the attackers, their targets, or how the flaw was used.

The common thread is the lesson. Neither of these is a splashy remote-code-execution critical; both are privilege bugs in the systems that sign an organisation's logins and store its documents. That is precisely why they were worth exploiting, and why a local or Moderate label undersells them.

Patch order when everything is critical

With more than 600 CVEs in a single month, severity scores stop sorting the queue — there are far too many Critical-rated bugs to treat Critical as a priority in itself. A defensible order for this cycle puts the two actively exploited zero-days first, and because Microsoft's incident responders found the AD FS flaw in live attacks, federation servers should be reviewed for signs of prior compromise rather than simply patched forward. Internet-facing, on-premises SharePoint comes next, both for the exploited CVE-2026-56164 and for a pair of unauthenticated remote-code-execution flaws also fixed this cycle. After that come the highest-impact criticals — including a Windows VMSwitch guest-to-host escape and related Hyper-V escalations that put virtualization hosts ahead of the guests they carry.

There is also a deadline hiding in the same release. SharePoint Server 2016 and 2019 reached the end of extended support on 14 July — the exact day these patches shipped. Organisations still running those versions will receive no further security updates and should plan migration to Subscription Edition now, and in the interim reduce their external exposure wherever possible while migration plans are accelerated, recognising that end-of-support systems should be treated as temporary operational risks rather than permanent deployments.

The volume is the story

The uncomfortable part is not any single bug; it is the trend line behind the number. June's all-time record lasted exactly one month, and Microsoft attributes much of the increase to its internal AI-assisted vulnerability discovery efforts, although the long-term industry impact of AI-driven code analysis is still evolving. By Microsoft's account, this is an internal agentic scanning system that runs continuously against its codebase and does not slow between monthly cycles, and the company's own implication is that these volumes go up from here, not down. It is not alone: other major vendors have raised their patch cadence over the same period, several explicitly citing AI-assisted discovery, and a large mobile-platform security batch earlier in the year ran to several hundred fixes. For anyone whose patch process assumes a manageable monthly batch, that assumption no longer holds.

Key Takeaways

  • Microsoft's 14 July 2026 Patch Tuesday is its largest ever — 621 CVEs (ZDI) / 622 (Microsoft) / ~570 (narrower counts), more than triple June's ~200.

  • Two zero-days are under active exploitation: CVE-2026-56164 (SharePoint EoP, CVSS 5.3, unauthenticated over the network) and CVE-2026-56155 (AD FS EoP, CVSS 7.8, needs prior local access).

  • Both are privilege bugs in identity and document infrastructure — their modest scores understate the risk; patch and hunt on AD FS and SharePoint first.

  • SharePoint Server 2016 and 2019 hit end of support on 14 July — no more updates; migrate or remove from internet exposure.

  • Microsoft attributes the CVE surge to AI-assisted discovery and expects volumes to keep rising; this month shows CVSS scores alone are no longer sufficient for prioritisation — weigh exposure and exploitability too.