July 2026 Patch Tuesday: Microsoft fixes 570 flaws and 3 zero-days

Microsoft’s July 2026 Patch Tuesday shipped fixes for 570 vulnerabilities across its products, according to BleepingComputer. It is one of the largest sets of patches the company has released to date. Of that total, 59 flaws were rated critical, most of them remote code execution issues. The cycle also disclosed three zero-days, two of which are already being exploited by attackers in the wild.

The two flaws under active attack are CVE-2026-56155, in Active Directory Federation Services (AD FS), and CVE-2026-56164, in SharePoint Server. The first is an elevation-of-privilege bug rooted in insufficient access control, letting a local, already authenticated attacker gain higher privileges. The second stems from a missing authentication check on a critical SharePoint function, opening a path to escalate privileges over the network. The third zero-day, disclosed but without confirmed exploitation, is CVE-2026-50661, a BitLocker bypass.

By volume, the batch is dominated by elevation of privilege (254 cases) and remote code execution (145), followed by information disclosure, denial of service, security feature bypass, and spoofing.

Why it matters

AD FS and SharePoint sit at the core of many corporate environments. AD FS brokers authentication and identity federation; compromising privileges there can open doors to lateral movement and access to connected systems. SharePoint concentrates sensitive documents and workflows, and a flaw exploitable without valid authentication widens the attack surface. When two of these vulnerabilities are already being exploited, the window between patch release and intrusion attempts shrinks sharply. Companies in Brazil and Latin America that rely on these platforms should treat this cycle as an operational priority, not routine maintenance.

What to do

• Prioritize applying the fixes for CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint), both under active exploitation.
• For SharePoint, follow Microsoft’s guidance to enable AMSI and set request body scanning to full mode to strengthen mitigation.
• Review authentication and SharePoint access logs for signs of privilege elevation or anomalous access.
• Extend your inventory and patching plan to the other critical items in the batch, without letting the high volume become an excuse to defer.