Patch Tuesday used to be a calendar reminder you could safely ignore until Thursday. Not this month. Microsoft just shipped fixes for 570 vulnerabilities in one go, and two of them were already being actively exploited in the wild — which is corporate-speak for "attackers got there before the patch did."

A Record-Breaking Pile of Holes

July's Patch Tuesday is the largest in Microsoft's history, addressing 59 Critical-rated flaws, 254 elevation-of-privilege bugs, and 145 remote code execution vulnerabilities across Windows, Office, SharePoint, Exchange, SQL Server, and Azure. Buried in that mountain are three standouts worth knowing by name: two zero-days already under active attack, and one publicly disclosed before Microsoft had a fix ready to ship.

CVE-2026-56155 lets an attacker escalate to admin privileges inside Active Directory Federation Services — basically the keys to the identity kingdom, since AD FS is what a huge share of enterprises use to hand out single sign-on tokens. CVE-2026-56164 is worse in a different way: an unauthenticated attacker can hijack SharePoint Server with zero credentials and zero user interaction required, which is about as close to a walk-in invitation as vulnerabilities get. There's also CVE-2026-50661, a BitLocker bypass that lets anyone with physical access to a device peek at encrypted data.

Why Your Sysadmin Skipped Lunch

Both zero-days were flagged by Microsoft's own Detection and Response Team, the unit that gets called in after something's already gone wrong — a strong hint these bugs were found mid-attack rather than in a lab. AD FS and SharePoint aren't obscure corners of the stack either; they're the plumbing behind enterprise logins and intranets everywhere, which means a single compromised server can cascade into a very bad week for an entire organization, its partners, and anyone whose data lives on that network. Ransomware crews in particular love a good identity-server bug, because owning AD FS is the difference between "we got into one laptop" and "we own the whole domain."

There's a nice irony buried in the fine print, too: Microsoft credits part of this record-setting haul to an AI-powered vulnerability-hunting system now combing through the Windows codebase. The machines are getting better at finding bugs at roughly the same pace attackers are getting better at exploiting them — a race that, this month at least, Microsoft's DART team narrowly won by catching the exploitation in progress instead of reading about it afterward in an incident report.

570 patches, two live fires, zero excuses for leaving this update sitting in the "restart later" queue.

Source: BleepingComputer