Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes

Microsoft's July 2026 Patch Tuesday update is the largest in the program's history, containing 622 unique CVEs. This massive release includes three zero-day vulnerabilities, two of which are currently being exploited and one that remains publicly known but unexploited. The update also addresses over 50 critical vulnerabilities, many of which Microsoft has identified as likely to be exploited by attackers. Specifically, CVE-2026-56155 (CVSS: 7.2) is an elevation of privilege (EoP) vulnerability in Microsoft Active Directory Federation Services, while CVE-2026-56164 (CVSS: 5.3) is another EoP flaw tied to missing authentication in SharePoint Server. The US Cybersecurity and Infrastructure Security Agency (CISA) has already included both bugs in its catalog of known exploited vulnerabilities and given federal agencies until July 17 to address the SharePoint Server issue and July 28 to mitigate the flaw in Active Directory. The third zero-day vulnerability, CVE-2026-50661 (CVSS: 6.1), is a security feature bypass in Windows BitLocker, allowing an attacker with physical access to bypass encryption. Several other vulnerabilities, all with CVSS scores of 9.0 and higher, are also being highlighted. These include CVE-2026-55008 (CVSS 9.6), a spoofing vulnerability in Microsoft Exchange Server, and numerous other critical flaws. Experts emphasize that the sheer volume of vulnerabilities is not the primary challenge; instead, organizations must effectively triage, prioritize, and deploy patches quickly. Jack Bicer, director of vulnerability research at Action1, notes that a comprehensive asset management program, phishing-resistant multi-factor authentication, and a centralized patch management system are crucial. He recommends testing, deploying, and verifying critical and zero-day patches within hours, and high-severity vulnerabilities within days, tracking patch deployment times as a KPI. Satnam Narang, senior staff research engineer at Tenable, suggests building context around vulnerabilities and prioritizing remediation based on those that pose the biggest threats, considering the speed of AI-developed exploits. Mayuresh Dani, security research manager at Qualys Threat Research Unit, advocates for a tiered patching SLA mechanism, prioritizing KEV-listed CVEs or EPSS >0.5 within 24-36 hours and high-privilege infrastructure within days. He further advises organizations to avoid exposing services like Active Directory FS to the internet and disabling public access to SharePoint on premises.