Microsoft's Record 622-CVE Patch Tuesday: Three Active Zero-Days and What Maldives IT Teams Must Patch First
A record that says more about AI than about Windows
The headline number is real, and it depends on how you count. Microsoft fixed 570 of its own CVEs this month, already an all-time record. Add the third-party fixes republished in the same release (Chromium-based Edge, Azure Linux, and others) and the total climbs to 621–622. Either figure shatters the previous record.
For context, June shipped 206 CVEs and was itself called a "new normal." May was closer to 130. So this is not a spike. It is a curve, roughly tripling month over month, and the reason has almost nothing to do with Windows getting less secure. It has to do with who is now finding the bugs.
Microsoft's own severity breakdown tells the story of scale:
| Category | Count |
|---|---|
| Total Microsoft CVEs | 570 (622 with third-party fixes) |
| Critical severity | 59 (48 of them remote code execution) |
| Elevation of Privilege | 254 |
| Remote Code Execution | 145 |
| Information Disclosure | 102 |
| Denial of Service | 35 |
| Zero-days | 3 (2 actively exploited) |
Microsoft's AI is now finding the bugs, and it isn't slowing down
In May, Microsoft VP of Engineering Tom Gallagher warned that monthly patch volumes would grow because of AI-driven vulnerability discovery. Two months later, the prediction has landed hard.
At the centre of it is MDASH, Microsoft's multi-model agentic security scanning system: roughly 100 AI agents working together to find, validate, and help fix vulnerabilities at a speed no human review team could match. "Advanced AI models enable us to reason about code paths and configurations at a speed and consistency that would not be possible through manual review alone," Gallagher wrote.
Here is why that matters for you, and it is not the reassuring story Microsoft would prefer. AI compresses the time between "a bug exists" and "a bug is found" to almost nothing. Microsoft is using that to find flaws in its own code before attackers do, which is genuinely good news. But the same class of tooling is available to everyone, including the people breaking into your network. The defender's monthly patch pile is going to keep growing, the attacker's discovery cycle is going to keep shrinking, and the old habit of "we patch everything on the second Tuesday" is quietly becoming impossible.
The three zero-days hiding in the pile
Six hundred CVEs is noise. These three are signal, and losing them in the volume is exactly the risk. Two are already being used in real attacks.
| CVE | Product | Status | What it gives an attacker |
|---|---|---|---|
| CVE-2026-56155 | AD FS | Actively exploited | Escalation to administrator on the identity broker |
| CVE-2026-56164 | SharePoint Server | Actively exploited | Network privilege escalation via missing authentication |
| CVE-2026-50661 | Windows BitLocker | Publicly disclosed | Encryption bypass with physical device access |
CVE-2026-56155: Active Directory Federation Services. AD FS is the component that brokers single sign-on between your on-premises Active Directory and Microsoft 365. This flaw lets an authorised attacker escalate to administrator through insufficient access-control granularity. Compromise the identity broker and you do not just get one server. You get a foothold over federated authentication for the whole tenant. It is being exploited now.
CVE-2026-56164: SharePoint Server. A missing authentication check on a critical function lets an attacker escalate privileges over the network against on-premises SharePoint. If you cannot patch immediately, Microsoft's interim mitigation is to enable the Antimalware Scan Interface (AMSI) and set Request Body Scan to Full. On-prem SharePoint has been a favourite target all year; this one is live.
CVE-2026-50661: Windows BitLocker. Publicly disclosed but not yet exploited. An attacker with physical access to a device can bypass BitLocker encryption and reach the data at rest. Lower urgency for servers behind locked doors, but very relevant to a mobile laptop fleet.
"Patch everything" already broke: triage on exploitation, not severity
You cannot test and deploy 570 patches at once without breaking something, and you should not try. The failure mode this month is not leaving a bug unpatched. It is burning your first 48 hours regression-testing a denial-of-service fix while an actively-exploited AD FS escalation sits untouched. Prioritise by whether a flaw is being used against real networks and whether the affected asset is exposed, not by CVSS score alone.
zero-day?} B -->|Yes| C[Patch in 48 hours
AD FS & SharePoint] B -->|No| D{Critical RCE on an
internet-facing asset?} D -->|Yes| E[Patch this week] D -->|No| F{Physical or
local-access only?} F -->|Yes| G[Roll into normal cycle
prioritise mobile fleet] F -->|No| H[Bulk EoP & disclosure
risk-based, do not block above]
What to patch first
- The two exploited zero-days, now. Patch CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint) ahead of everything else. Internet-facing AD FS and on-prem SharePoint are the priority instances.
- Apply the SharePoint mitigation immediately if a patch window is hours away. Enable AMSI and set Request Body Scan to Full. It buys time; it is not a substitute for the update.
- The 48 Critical RCEs on exposed servers, within the week. Focus on anything reachable from the internet or from an untrusted network segment.
- BitLocker for your mobile fleet. Prioritise laptops that leave the building (travelling staff, finance, executives) over deskbound machines.
- Everything else on a rolling, risk-based cycle. The bulk elevation-of-privilege and information-disclosure fixes matter, but they must not delay the four steps above.
What this means for Maldives organisations
The two exploited zero-days hit precisely the setup most Maldivian banks, government agencies, and larger enterprises run: hybrid Microsoft 365 with AD FS for federated sign-on, and on-premises SharePoint for internal collaboration. If that describes you, this is not a "monitor the situation" month.
For institutions under the MMA IT Risk Management Guidelines, a 570-CVE release is a direct test of your vulnerability-management maturity. A monthly "we apply all patches" claim no longer scales to this volume. What a regulator and a competent board should expect now is a documented, risk-based prioritisation process that can defend why AD FS was patched in 48 hours and a low-severity spoofing fix was scheduled for next cycle.
Resorts and hospitality groups should not skip the BitLocker item. General managers, finance staff, and executives move between islands, Malé, and abroad with laptops full of guest and payment data. A lost or stolen device combined with this bypass is a data-at-rest exposure under the Data Protection Act 2021, PCI-DSS, and (for EU guest records) GDPR.
The larger point stands beyond this one Tuesday. AI-driven discovery means these releases keep growing, and the organisations that cope are the ones that already treat patching as continuous risk triage rather than a monthly ritual. If your team is still deciding what to patch by reading the CVE count, this is the month that habit stops working.
CyberCloud helps Maldives organisations build risk-based vulnerability management and validate that their most-exposed systems are actually patched, including penetration testing that shows which of these flaws an attacker could reach from the outside. If July's release left you unsure where to start, get in touch.
References
- Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days. BleepingComputer, July 2026
- July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days. Malwarebytes, July 2026
- Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs. Tenable, July 2026
- Microsoft expects more Windows security updates from AI-discovered flaws. BleepingComputer, 2026
- AI-driven bug hunting fuels record Microsoft Patch Tuesday. Help Net Security, July 2026
- Patch Tuesday security updates for July 2026, the largest update ever. Security Affairs, July 2026