Microsoft just shipped the largest Patch Tuesday in its history. 570 vulnerabilities. Three of them zero-days.
July 2026 Patch Tuesday: 59 critical, 510 important, 3 zero-days — two actively exploited before the patch existed, one publicly disclosed ahead of a fix. If your patch window is measured in weeks, this month it needs to be measured in hours.
WHAT ACTUALLY SHIPPED
CVE-2026-56155 — Active Directory Federation Services elevation of privilege, exploited in the wild. Insufficient access control granularity hands an attacker admin-level rights inside your federation trust.
CVE-2026-56164 — SharePoint Server elevation of privilege, exploited in the wild. Missing authentication on critical functions, chained with other SharePoint flaws this month for full compromise.
CVE-2026-50661 — Windows BitLocker security feature bypass, publicly disclosed before patching. Disk encryption assumptions break the moment physical or pre-boot access is in play.
WHY THE VOLUME ITSELF IS THE STORY
570 CVEs in one release is not a monthly patch cycle, it is a prioritization problem disguised as a maintenance task. Teams that patch everything with equal urgency will patch the wrong things first. Teams that wait for a "quiet month" to catch up just watched that strategy fail publicly.
The two actively-exploited zero-days both target identity and access infrastructure — ADFS and SharePoint permissions — not endpoints. That is where this month's real damage will happen.
WHAT TO DO NOW
TRIAGE BY EXPLOITATION STATUS FIRST, CVSS SECOND — CVE-2026-56155 and CVE-2026-56164 go to the front of the line regardless of what else is queued.
AUDIT ADFS TRUST RELATIONSHIPS TODAY — assume the elevation path has already been probed if your ADFS servers are internet-reachable.
DO NOT TREAT BITLOCKER AS A CLOSED CONTROL — CVE-2026-50661 is public with no patch yet; compensating controls on physical access matter until Microsoft ships a fix.
BUILD A RECORD-VOLUME PLAYBOOK NOW — 570 CVEs will not be the ceiling. The next outlier month needs a pre-agreed triage process, not an improvised one.
A record patch count is not a badge of thoroughness. It is a measure of how much attack surface shipped before anyone was watching.
How does your team triage a 500-plus CVE month — CVSS score, exploitation status, or asset criticality?