Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Microsoft released its largest Patch Tuesday update to date, encompassing 622 security updates, with two of these fixes already being actively exploited by attackers. These vulnerabilities, affecting SharePoint Server and Active Directory Federation Services, allow for privilege escalation and local access, respectively. While Microsoft has addressed the immediate exploits, the sheer volume of updates and the rapid exploitation cycle highlight a shift in how security teams need to approach patching – prioritizing exploited vulnerabilities over CVSS scores.
Microsoft shipped its largest Patch Tuesday update to date, encompassing 622 security updates, marking a significant increase from previous releases. This update includes two zero-day vulnerabilities that are currently being actively exploited by attackers. These vulnerabilities target critical infrastructure within Microsoft’s products.
Two of the most pressing issues involve SharePoint Server and Active Directory Federation Services. CVE-2026-56164 in SharePoint Server allows an unauthenticated attacker to escalate privileges over the network, requiring no credentials or user interaction – a remote attack. Microsoft credits Mandiant's incident responders and Google's FLARE team for discovering this exploit in active attacks. The company notes that this is a significant issue given SharePoint's history as an attacker magnet.
CVE-2026-56155 in Active Directory Federation Services allows an already-authenticated attacker to elevate privileges locally through weak access controls. Microsoft's own DART incident-response unit gets the credit for identifying this vulnerability. AD FS is crucial for signing tokens, so a local flaw on this host is a higher priority than the label suggests.
Beyond these two immediate exploits, a third vulnerability, CVE-2026-50661, a BitLocker bypass, is not currently under attack but needs physical access to the device. Microsoft’s Security Update Guide lists 622 unique CVEs this month, with ZDI independently counting 621. Rapid7 Labs disclosed CVE-2026-55040, a JWT authentication bypass, which they chained to a remote code execution bug to reach unauthenticated RCE – the RCE part of this bug is not yet patched.
Microsoft is also finishing a multi-year effort to harden Kerberos RC4, removing the RC4DefaultDisablementPhase rollback switch. This will prevent services from requesting RC4 Kerberos tickets, but requires auditing of flagged service accounts and password rotation.
The sheer volume of updates – 622 – and the rapid exploitation cycle are driving a shift in how security teams should operate. Microsoft’s AI-powered scanning system, MDASH, found 16 of the bugs in May’s Patch Tuesday alone. This means that CVSS scores are becoming less reliable as a triage metric, and prioritizing exploited vulnerabilities – as identified by KEVs, EPSS, and Microsoft’s exploited flag – is now crucial for faster remediation.
Finally, the update highlights a trend of increasing automation – attackers can now quickly analyze new releases and build exploits before most organizations have completed testing.