Microsoft’s July 2026 Patch Tuesday shipped fixes for 622 vulnerabilities, the largest single release in the program’s history, and two of them were already being exploited in the wild when the patches landed. For security teams, the bigger story is not the record count. It is that patching everything, on schedule, every month, is no longer a realistic operating model, and CrowdStrike’s own analysis of the release says so directly.
The Numbers Behind the Record
Microsoft’s July release addressed 622 CVEs across Windows, Office, Microsoft Edge, SharePoint Server, Azure, and its developer tooling, according to CrowdStrike’s Patch Tuesday analysis. Sixty two of those flaws carry a Critical severity rating. Windows alone accounted for 416 of the total, the largest single-product share, with elevation-of-privilege bugs (255 CVEs, 41 percent of the release) and remote code execution flaws (166 CVEs, 27 percent) making up the bulk of the exploitation techniques represented.
The release also began enforcing a long-planned security change: Windows domain controllers stopped falling back to RC4-based Kerberos tickets, pushing organizations that have not finished migrating to AES-256 encryption toward an immediate compatibility problem layered on top of the patch load.
CyberTech has tracked this trend as it built through the year, reporting earlier on how disclosure volume was already outpacing fix capacity, and this release is the clearest evidence yet that the trend has not leveled off.
Two Zero-Days, Very Different Risk Profiles
Two vulnerabilities in the release were already under active exploitation before Microsoft shipped a fix, according to CrowdStrike’s analysis.
CVE-2026-56164: SharePoint Server
This elevation-of-privilege flaw in on-premises SharePoint Server carries a CVSS score of 5.3, a relatively modest number that undersells its risk. CrowdStrike’s analysis notes it allows unauthenticated remote exploitation, meaning an attacker does not need valid credentials to begin an attack against an exposed SharePoint deployment. Organizations still running on-premises SharePoint, particularly instances internet-facing for collaboration with external partners, are the highest-risk population.
CVE-2026-56155: Active Directory Federation Services
The second exploited zero-day sits in AD FS, the service many enterprises use to issue authentication tokens across cloud and on-premises applications. Rated CVSS 7.8, it lets a low-privileged, already-authenticated attacker escalate to administrative rights. Because AD FS sits at the center of federated identity, a successful escalation here can cascade into every application that trusts tokens the service issues.
A third flaw, an unpatched BitLocker security feature bypass (CVE-2026-50661, CVSS 6.1) requiring physical device access, was publicly disclosed but has no fix yet. CrowdStrike’s analysis also flags a separate, unpatched Windows User Profile Service issue, nicknamed “LegacyHive” in other reporting, that was disclosed without an assigned CVE, adding another known gap security teams have to track without a patch to close it.
The severity scoring split is itself worth noting. A CVSS 5.3 flaw sitting near the middle of most vulnerability scanners’ priority queues (SharePoint) is under active exploitation, while an unpatched CVSS 6.1 issue (BitLocker) is not, at least not yet, because it needs physical access. Teams that triage purely by CVSS score without weighing exploitation status and exposure will misprioritize this release. Active-exploitation status, not the numeric score alone, is the signal that should move a CVE to the front of the queue.
What This Means for the Security Leader
CrowdStrike states the uncomfortable part plainly in its own analysis: not every highly exploitable vulnerability can be easily patched. That is a shift in how a major vendor is framing patch guidance. For years, the operating assumption was that a monthly cadence plus a reasonably fast SLA covered the exposure. A release of this size makes that assumption unworkable on its own terms. Even a well resourced patch management team cannot fully test, stage, and deploy fixes for 622 CVEs, 62 of them Critical, inside a normal maintenance window without either slowing the pace of deployment or accepting partial coverage.
That reframes the job. The security leader’s task this cycle is not “patch the release.” It is deciding, in the first 48 hours, which subset of 622 buys down the most real world risk, and building a defensible, board ready rationale for the CVEs that get deferred to the next cycle. CyberTech has previously covered how quickly exposed edge appliances get weaponized once a flaw goes public, and the same clock now applies to identity infrastructure like AD FS.
The Defender’s Move: Triage Over Total Coverage
Practical priorities for this release: patch CVE-2026-56164 and CVE-2026-56155 first, since both are confirmed under active exploitation. Internet-facing SharePoint servers should be isolated or patched ahead of internal ones. AD FS servers warrant an access review in addition to the patch, since the flaw’s low privilege bar means an attacker who already has a foothold anywhere in the domain can attempt the escalation. Teams with unfinished Kerberos AES migrations should treat the RC4 fallback removal as a compatibility test to run this week, not next quarter, since authentication failures after the change land as an operational incident, not a security one.
For the unpatched BitLocker and User Profile Service issues, CrowdStrike’s guidance points toward compensating controls, physical security for BitLocker protected devices and monitoring for anomalous registry activity, rather than waiting on a patch with no committed date. Organizations still carrying Kerberos RC4 dependencies in legacy applications should inventory them now; a compatibility failure discovered during an authentication outage is a far worse position than one found during a planned test window.
That is the discipline this release is forcing across the industry: security programs that can prioritize under volume, ranking exploitation status and exposure above raw CVE count, will hold their exposure window steady. Programs still operating on a patch everything model, working the list top to bottom regardless of what is actually being exploited, will fall further behind with every release like this one, and CrowdStrike’s own framing suggests that gap is now the vendor’s expectation, not an edge case.
Source: CrowdStrike
