Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack

Microsoft's July 2026 Patch Tuesday addresses a record 622 vulnerabilities, including two actively exploited zero-days. CVE-2026-56164 is a privilege escalation flaw in SharePoint Server exploited by unauthenticated attackers over the network. CVE-2026-56155 is a local privilege escalation in Active Directory Federation Services exploited by authenticated attackers. Despite moderate severity ratings, both are under active attack and require immediate patching.

AI-extracted · verify before operational use