Tuesdays used to just mean tacos and mild dread about the rest of the week. This Tuesday, Microsoft turned it into a full-blown cardio workout for every sysadmin on Earth, dropping the single largest patch bundle in Windows history. Bring snacks.
622 Flaws Walk Into a Patch, Two Are Already Loose
Microsoft's July 2026 Patch Tuesday fixes a record-breaking 622 vulnerabilities — more than triple June's previous high of roughly 200. Windows alone accounts for 416 of them, including 95 remote code execution bugs, with Office, Edge, and SharePoint Server piling on more.
Two of those flaws are already being exploited in the wild: CVE-2026-56164 lets an unauthenticated attacker escalate privileges over the network in on-prem SharePoint Server, and CVE-2026-56155 lets an already-authenticated attacker do the same locally in Active Directory Federation Services — a bug Microsoft's own incident-response team found while cleaning up after someone else found it first. There's also a publicly disclosed BitLocker bypass that only needs physical access to your laptop, which is exactly the kind of thing that ruins a stolen-device day.
The Kerberos Safety Net Just Got Yanked
Buried in the pile is the quiet death of an old crutch: Microsoft removed the RC4 rollback switch that's let admins keep ancient, weak Kerberos encryption limping along since the crackdown began. After this update, RC4 only works for accounts explicitly configured for it — everyone else's tickets just stop authenticating, no warning shot.
Translation for anyone running legacy service accounts: audit your RC4 usage and rotate those passwords before you patch, not after, unless you enjoy locked-out systems and a very long night. And if you're still on SharePoint Server 2016 or 2019, extended support ended the same day this patch dropped — there's no paid lifeline left to buy you time.
Nothing says "we mean it this time" quite like a 27-year-old crypto standard finally getting evicted on the same day two zero-days show up to the party. Patch first, ask questions later.
Source: The Hacker News