Microsoft’s July 2026 Patch Tuesday fixes 622 flaws and 2 exploited zero-days

Microsoft’s July 2026 Patch Tuesday fixes 622 CVEs across Windows, Office, SharePoint, SQL Server, Azure and development tools; three issues demand immediate attention — an actively exploited AD FS privilege escalation (CVE-2026-56155), a remotely exploitable SharePoint authentication bypass (CVE-2026-56164) observed in attacks, and a publicly disclosed BitLocker bypass (CVE-2026-50661). The report notes Microsoft’s MDASH AI-assisted scanning that expanded findings, and advises risk-based patch prioritization, privileged access management, and rapid deployment for exposed systems and devices.