INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft Patches 570 CVEs via Patch Tuesday

| 2026-07-15 09:20 CRITICAL HIGH VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
Microsoft has released updates for an unprecedented 570 CVEs during this month’s Patch Tuesday on July 14. The patch deluge came after warnings from the tech giant that its use of agentic AI to find new flaws would lead to an increase in security updates for customers . Trey Ford, chief strategy and trust officer at Bugcrowd, said this was the new normal for the foreseeable future. AI has collapsed the cost of finding vulnerabilities, and this increase in volume is a new floor, not the ceiling … at least for a while,” he added.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-56164, CVE-2026-50661 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-56164CVE-2026-56164 CVE-2026-50661CVE-2026-50661 CVE-2026-48561CVE-2026-48561 CVE-2026-56155CVE-2026-56155 CVE-2026-55008CVE-2026-55008 CVE-2026-57092CVE-2026-57092
Target & Sectors
Global Scope
Incident Timeline
‎July 14
Microsoft released updates for 570 CVEs on July 14.
‎2026/07/15
Threat actors used Microsoft's unpatched vulnerabilities to target Active Directory Federation Services.
‎2026/07/15
The US Cybersecurity and Infrastructure Security Agency (CISA) has included 570 CVEs in its catalog of known exploited vulnerabilities, urging federal agencies to address the SharePoint Server issue by July 17 and the Active Directory flaw by July 28.
organisation Active Directory Federation Services
CVE-2026-56155 is an elevation of privilege (EoP) vulnerability in Active Directory Federation Services which allows an authorized attacker to elevate privileges locally.
infrastructure 7.2
High-Priority Vulnerabilities The immediate threats in this month's release are CVE-2026-56155 (CVSS: 7.2), an elevation of privilege (EoP) vulnerability in Microsoft Active Directory Federation Services that attackers can exploit to gain system…
infrastructure Windows
The publicly disclosed zero day is CVE-2026-50661: a Windows BitLocker security feature bypass flaw which could allow attackers to access encrypted data.
Related: Microsoft Reins in RoguePlanet Zero-Day Threat The third-zero day vulnerability — publicly known, but as yet unexploited — is a security feature bypass vulnerability in Windows BitLocker, tracked as CVE-2026-50661 (CVSS: 6.1).
These include: CVE-2026-57092 (CVSS 9.9), a near maximum severity vulnerability in Windows VMSwitch that an attacker could exploit to escape a VM boundary and compromise the host system CVE-2026-48561 (CVSS 9.6), a Microsoft Copilot remote code e…
The total includes 416 vulnerabilities in Windows, 82 each in Office and Office 2016, 46 in Edge, 27 in Microsoft Developer Tools, and 17 in SharePoint Server.
The real triage problem this month is the mix of exploited issues, a publicly disclosed BitLocker flaw, and a massive concentration of vulnerabilities in Windows and Office," he said.
organisation Microsoft
Microsoft Patches 570 CVEs in Record Patch Tuesday.
organisation Record Patch
Microsoft Patches 570 CVEs in Record Patch Tuesday.
organisation Bugcrowd
Trey Ford, chief strategy and trust officer at Bugcrowd, said this was the new normal for the foreseeable future.
organisation Microsoft SharePoint
but this time in Microsoft SharePoint Server.
infrastructure 5.3
…in Microsoft Active Directory Federation Services that attackers can exploit to gain system level privileges; and CVE-2026-56164 (CVSS: 5.3), another EoP flaw, this time tied to missing authentication in a critical function in SharePoint Server.
organisation 460 Edge/Chromium
Google fixed over 460 Edge/Chromium flaws this month, and Adobe recently switched its patching cadence to twice a month.
organisation Adobe
Google fixed over 460 Edge/Chromium flaws this month, and Adobe recently switched its patching cadence to twice a month.
organisation KEV
For example, a KEV-listed CVE or EPSS >0.5 should be patched within 24-36 hours.
organisation CVE
For example, a KEV-listed CVE or EPSS >0.5 should be patched within 24-36 hours.
organisation EPSS >0.5
For example, a KEV-listed CVE or EPSS >0.5 should be patched within 24-36 hours.
financial 36 hours
For example, a KEV-listed CVE or EPSS >0.5 should be patched within 24-36 hours.
organisation Active Directory Federation Service
Classification should be risk-based and will be different each organization  Introduce attack surface reduction and mitigation mechanisms, such as ensuring systems like Active Directory Federation Service aren’t internet-connected, on-premises SharePoint doesn’t have public access, and remote management tools aren’t reachable from anywhere Improve patching practices
organisation SharePoint
Classification should be risk-based and will be different each organization  Introduce attack surface reduction and mitigation mechanisms, such as ensuring systems like Active Directory Federation Service aren’t internet-connected, on-premises SharePoint doesn’t have public access, and remote management tools aren’t reachable from anywhere Improve patching practices
organisation Improve
Classification should be risk-based and will be different each organization  Introduce attack surface reduction and mitigation mechanisms, such as ensuring systems like Active Directory Federation Service aren’t internet-connected, on-premises SharePoint doesn’t have public access, and remote management tools aren’t reachable from anywhere Improve patching practices
infrastructure 9.0
Security experts highlighted several other vulnerabilities in Microsoft's July update — all of them with a CVSS score of 9.0 and higher — as bugs that merit immediate attention.
data_breach 600 numbers
When Microsoft vice president of engineering Tom Gallagher warned in May that the company's monthly patch releases could soon grow larger because of AI-driven vulnerability discovery, few likely expected the numbers would surpass 600 just two mont…
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The publicly disclosed zero day is CVE-2026-50661: a Windows BitLocker security feature bypass flaw which could allow attackers to access encrypted data.
These include: CVE-2026-57092 (CVSS 9.9), a near maximum severity vulnerability in Windows VMSwitch that an attacker could exploit to escape a VM boundary and compromise the host system CVE-2026-48561 (CVSS 9.6), a Microsoft Copilot remote code e…
The total includes 416 vulnerabilities in Windows, 82 each in Office and Office 2016, 46 in Edge, 27 in Microsoft Developer Tools, and 17 in SharePoint Server.
The real triage problem this month is the mix of exploited issues, a publicly disclosed BitLocker flaw, and a massive concentration of vulnerabilities in Windows and Office," he said.
Related: Microsoft Reins in RoguePlanet Zero-Day Threat The third-zero day vulnerability — publicly known, but as yet unexploited — is a security feature bypass vulnerability in Windows BitLocker, tracked as CVE-2026-50661 (CVSS: 6.1).
Metrics
financial
36
Hours
For example, a KEV-listed CVE or EPSS >0.5 should be patched within 24-36 hours.
Metrics
infrastructure
‎7.2
Software Version
High-Priority Vulnerabilities The immediate threats in this month's release are CVE-2026-56155 (CVSS: 7.2), an elevation of privilege (EoP) vulnerability in Microsoft Active Directory Federation Services that attackers can exploit to gain system…
Metrics
infrastructure
‎5.3
Software Version
…in Microsoft Active Directory Federation Services that attackers can exploit to gain system level privileges; and CVE-2026-56164 (CVSS: 5.3), another EoP flaw, this time tied to missing authentication in a critical function in SharePoint Server.
Metrics
infrastructure
‎9.0
Software Version
Security experts highlighted several other vulnerabilities in Microsoft's July update — all of them with a CVSS score of 9.0 and higher — as bugs that merit immediate attention.
Metrics
data_breach
600
Numbers
When Microsoft vice president of engineering Tom Gallagher warned in May that the company's monthly patch releases could soon grow larger because of AI-driven vulnerability discovery, few likely expected the numbers would surpass 600 just two mont…
Intelligence Sources
Dark Reading 2026-07-14
Infosecurity-Magazine 2026-07-15