Microsoft's July 2026 patch load fixes 622 flaws
Microsoft's July update addressed 622 vulnerabilities, including actively exploited SharePoint Server flaws and two zero-days exploited before release. On-premises SharePoint servers are the standout risk and should be patched without waiting.
Why it matters: A remote-code-execution chain plus live exploitation is the combination defenders least want to sit on. If you run SharePoint yourself, this is not a week to skip.
Why SharePoint is the one to patch first
Of everything in this release, the SharePoint chain deserves attention first, for reasons that have little to do with its severity score.
SharePoint is where organisations keep the documents they would least like to lose: contracts, board papers, HR records, internal project files. It is also deeply integrated with identity, which means a compromised SharePoint server is frequently a route into the surrounding Microsoft estate rather than an isolated loss. A chain that achieves remote code execution on that host is therefore both a data breach and a foothold.
On-premises carries the risk, not the cloud
The distinction between SharePoint Online and SharePoint Server is the whole story. Microsoft patches the hosted service itself, so tenants are covered without doing anything. On-premises deployments require an administrator to apply the update, and those servers are frequently the ones still running because a workflow or customisation was never migrated.
That combination is unhelpful. The organisations most likely to be running on-premises SharePoint in 2026 are the ones that found migration too difficult, which correlates closely with having limited capacity to patch quickly.
SharePoint has been exploited this way before
The pattern in this release closely mirrors a real and recent incident, which is the strongest argument for treating it urgently.
In July 2025, a SharePoint flaw chain widely referred to as ToolShell was exploited against on-premises servers before patches were fully available. Microsoft attributed the activity to Chinese actors, including two nation-state groups, Linen Typhoon and Violet Typhoon. The entry requirement was simply having an internet-reachable on-premises SharePoint server.
We have covered the recurrence of this pattern, including SharePoint zero-days under active attack. The lesson from each round has been the same: the exploited population is not the organisations that lacked a patch, it is the ones that had a patch and had not applied it.
622 flaws is a triage problem
The scale is a reminder that patch volume keeps climbing, and that attackers move fastest in the window between a fix shipping and admins applying it.
Volume at this level changes the nature of the task. Nobody assesses 622 advisories individually, so the only workable approach is to sort by exploitability rather than severity and accept that most entries will be patched in the normal monthly cycle without being read.
| Priority | What it covers | Timeframe | Reasoning |
|---|---|---|---|
| 1 | Actively exploited zero-days | Immediately | Attacks are already happening |
| 2 | Internet-facing RCE, including on-premises SharePoint | Within 24 hours | Reachable and gives code execution |
| 3 | Internal server RCE and privilege escalation | This week | Enables lateral movement after a foothold |
| 4 | Client-side flaws needing user interaction | Normal cycle | Requires a user to cooperate |
| 5 | Local denial of service, information disclosure | Normal cycle | Low standalone impact |
The practical instruction is that rows one and two are this week's work and the rest is business as usual. A month with several exploited zero-days and an internet-facing RCE chain means rows one and two are unusually crowded.
The underlying trend is not a Microsoft phenomenon, and patch management designed around a quieter era does not survive contact with these volumes.
The patch gap is the real exposure
The window between release and deployment is where almost all preventable compromise happens, and it has narrowed from both ends.
Mandiant's work on exploitation timing found the average time-to-exploit fell to five days in 2023, from 32 days in 2021-22. Verizon's 2025 breach research tracked vulnerability exploitation rising to 20% of breaches as an initial access route. CISA has responded by compressing its remediation deadlines, and we covered the point at which the patch window came down to three days.
The cost side explains why this is worth organisational attention rather than just an administrator's afternoon. IBM's 2024 breach research put the global average cost of a data breach at $4.88 million, which is a figure that makes an emergency patch window look inexpensive.
This is also now a monthly rhythm rather than an event. Ten actively exploited CVEs landed before September's Patch Tuesday, and an earlier Microsoft release carried two active zero-days. Planning for an exploited flaw every month is more realistic than treating each one as an exception.
What to do this week
Start by establishing what you actually run, since the most common reason an organisation misses an urgent patch is not knowing the asset exists. Specifically, confirm whether any on-premises SharePoint server is reachable from the internet.
Then work rows one and two of that table. Apply the SharePoint updates to on-premises servers first, and verify the build number afterwards rather than trusting that the update completed. Patch the actively exploited zero-days across the estate on the same schedule.
For anything that cannot be patched immediately, reduce reachability instead. Putting an authenticating proxy or VPN in front of an on-premises SharePoint server removes the unauthenticated internet exposure that makes these chains attractive, which buys time without pretending the problem is solved.
Finally, treat a previously exposed server as potentially already compromised. If an internet-facing SharePoint server sat unpatched while exploitation was underway, patching closes the door but evicts nobody. Check for unexpected files in web directories, new or modified service accounts, scheduled tasks you did not create, and outbound connections that do not match normal operation.
Key takeaways
- Microsoft's July 2026 release fixed 622 vulnerabilities, including actively exploited SharePoint Server flaws and two zero-days exploited before release.
- On-premises SharePoint is the priority. The hosted service is patched by Microsoft; self-hosted servers are not, and they are often the hardest to update.
- The precedent is recent and real. The 2025 ToolShell chain was exploited against on-premises SharePoint by Chinese actors before patches were fully available.
- At this volume, triage by exploitability rather than severity. Exploited zero-days and internet-facing RCE are this week's work; the rest can follow the normal cycle.
- Mandiant's average time-to-exploit fell to five days in 2023, exploitation drove 20% of breaches in Verizon's 2025 data, and IBM's 2024 study put the average breach at $4.88 million. The patch gap is the exposure.
- If a server was exposed while exploitation was live, patch and then hunt for persistence. A patch does not remove an intruder already inside.
