Microsoft's biggest Patch Tuesday ever includes two active zero-days
Key takeaways
- July's Patch Tuesday is Microsoft's largest ever, with counts ranging from 569 to 622 flaws depending on the source
- Two zero-days, CVE-2026-56164 (SharePoint) and CVE-2026-56155 (AD FS), were already being exploited before the fix shipped
- US federal agencies face a 17 July deadline for SharePoint and 28 July for AD FS under a binding directive
- Home users aren't directly affected by these two flaws but should still let Windows Update run
Microsoft just shipped its largest Patch Tuesday on record. Depending on which count you use, it's 569, 570, or 622 fixes this month, the number moved as more disclosures rolled in, but the headline is the same either way: patch now if you haven't already.
Two of the flaws were already being used in real attacks before the fix landed. CVE-2026-56164 is an elevation-of-privilege bug in SharePoint Server, CVSS 5.3, that lets an attacker who already has some access grab higher privileges. CVE-2026-56155 hits Active Directory Federation Services, the system many organisations use for single sign-on, and it's rated 7.8. Both were confirmed exploited, not just theoretical.
Why the federal deadline matters to everyone else
US federal civilian agencies were given until today, 17 July 2026 (ET), to fix the SharePoint flaw, and until 28 July for the AD FS bug, under a CISA binding operational directive. That's a government compliance deadline, but the underlying advice applies to any organisation running these systems: this isn't a "patch when convenient" release.
If you're an IT admin running on-premises SharePoint or AD FS, treat this as urgent. If you're a home user on a personal Windows machine, this specific pair of flaws doesn't touch you directly, but the same monthly update includes fixes for consumer-facing components too, so let Windows Update run rather than snoozing it again.
What to do: IT teams should confirm SharePoint and AD FS patches are applied today, not just scheduled. Everyone else should make sure automatic updates are switched on and restart when Windows asks.
What Patch Tuesday actually is
Patch Tuesday is Microsoft's monthly batch of security fixes. It lands on the second Tuesday of each month, a rhythm the company set in 2003 so that administrators could plan around one predictable day rather than reacting to fixes dropped at random.
Why the second Tuesday? The usual explanation is that it gives IT teams a full working week to test and roll out before the month's end, while avoiding the first week's change freezes. It also means Wednesday is the day attackers study the fixes. Security researchers and criminals alike compare patched and unpatched files to work out what was broken, which is why the gap between release and installation is the dangerous window.
Microsoft can and does ship emergency fixes outside the cycle, but most flaws wait for the monthly drop. That is why the size of this one matters.
What a zero-day is
A zero-day is a flaw that attackers are using, or that has been made public, before a fix exists. The name comes from the vendor having had zero days to respond. Microsoft usually labels a flaw as exploited when it has evidence of real attacks, and as publicly disclosed when details are out but attacks are not confirmed.
Both CVE-2026-56164 and CVE-2026-56155 fall into the first group. Attackers were already using them, which is why they jump the queue. For a recent example of how a Windows flaw can be turned against the defences meant to stop it, see ShieldBreak.
How to triage a very large release
A release with hundreds of entries looks overwhelming. It isn't, because most of the entries will never touch most of your machines. A sensible order is:
- Exploited flaws first. Anything confirmed in the wild goes to the front, whatever its score.
- Wormable flaws next. These can spread between machines without a user doing anything, and they are rare but severe.
- Everything else by exposure. Internet-facing servers, identity systems and anything holding credentials come before internal file shares and desktops.
Notice what this does to the two flaws here. The SharePoint bug carries a CVSS score of 5.3, which looks modest. The score measures technical severity, not whether anyone is attacking it. Exploitation beats the number every time. The 7.8 on AD FS matters for a different reason: federation servers sit at the centre of sign-in, so a foothold there can open many other systems.
| Triage tier | What it covers | Typical timescale |
|---|---|---|
| Exploited | Confirmed attacks, such as the SharePoint and AD FS flaws | Same day |
| Wormable | Self-spreading remote bugs | Within days |
| Exposed | Internet-facing and identity systems | Within a week or so |
| Everything else | Internal and low-risk systems | Normal monthly cycle |
The CISA catalogue of known exploited flaws is the quickest way to check whether something is on the attackers' list. There is a walkthrough in how to check the CISA KEV catalogue.
Windows Update versus Defender updates
People often assume that Windows Update and Microsoft Defender are one thing. They are not.
Windows Update delivers operating system patches, including the monthly security release. It usually needs a restart, and a cumulative update can run to roughly 4 GB on a fresh install, so keep at least 10 GB free before it starts.
Defender's update channel is separate. It pushes new detection definitions, known as security intelligence, in the background, often several times a day, with no restart. That keeps antivirus current, but it does not fix the underlying hole in Windows. A flaw like these two is closed only by the monthly patch. Defender can also be a target itself, as the BlueHammer Defender flaw showed.
So a green tick in Defender does not mean your system is patched. Check Windows Update separately.
What home users should do
Home users are not exposed to these two flaws, but the habit matters. Windows runs on well over 1 billion devices, according to Microsoft's own figures, which makes it the most heavily targeted desktop platform there is.
- Leave automatic updates on, and restart when asked rather than postponing for weeks.
- Check Settings, then Windows Update, once a month to confirm it says you are up to date.
- Turn on multi-factor authentication for your Microsoft account. Microsoft has said it blocks more than 99% of automated account takeover attempts, though your own results will vary.
What IT teams should do
Start with inventory. You cannot patch what you do not know you run, and many organisations discover forgotten SharePoint or federation servers only when a deadline arrives.
Then work through the order above. Confirm the SharePoint and AD FS fixes are installed, not just approved. Test the wider release on a pilot group, then roll it out in rings. Where a restart is impossible today, restrict access to those servers in the meantime and watch the logs for unusual sign-ins.
The cost of delay is well documented. Equifax's 2017 breach exposed data on about 147 million people after a known, fixable flaw went unpatched. The WannaCry outbreak the same year had a fix available for two months beforehand, and its damage is often estimated at around $4 billion. Those figures are approximate, but the lesson is not: the patch usually exists before the attack arrives.
Key takeaways
- July's Patch Tuesday is Microsoft's largest ever, with counts ranging from 569 to 622 flaws depending on the source.
- Two zero-days, CVE-2026-56164 (SharePoint) and CVE-2026-56155 (AD FS), were already being exploited before the fix shipped.
- US federal agencies face a 17 July deadline for SharePoint and 28 July for AD FS under a binding directive.
- Triage in order: exploited, then wormable, then by exposure. A low CVSS score does not make an exploited flaw safe to wait on.
- Windows Update patches the operating system; Defender's updates only refresh detection, so check both.
- Home users aren't directly affected by these two flaws but should still let Windows Update run.
