July 2026 Patch Tuesday: Microsoft's Biggest Ever, Two Zero-Days, and a Kerberos Deadline

Microsoft shipped the largest Patch Tuesday in its history on July 14, and the headline number obscures the part that actually needs your attention this week. Two of the fixes are zero-days already being used in attacks, one in SharePoint and one in Active Directory Federation Services, and a third change in the same release has nothing to do with a CVE at all: it removes the escape hatch that’s been letting legacy Kerberos authentication limp along on old encryption. If you run Windows Server or on-prem identity infrastructure, this month’s update list is worth reading past the summary count.

The scale, briefly

Microsoft’s own count puts this release at 569 CVEs. Third-party trackers that include bundled Chromium/Edge fixes and other vendor CVEs land on 622. Either number clears the previous record of 198, set just last month. Of the total, 56 are rated critical, and elevation-of-privilege bugs make up the largest single category at roughly 41%, ahead of remote code execution at 27%.

A record count on its own doesn’t tell you what to do Monday morning. The zero-days do.

The two actively exploited zero-days

CVE-2026-56164 (SharePoint Server) is an elevation-of-privilege vulnerability, CVSS 5.3, that an unauthenticated attacker can trigger remotely over the network with no user interaction and low attack complexity. The moderate CVSS score undersells the risk here: the “unauthenticated” and “no user interaction” parts are what push this into zero-day territory despite a middling severity number. It affects SharePoint Server 2016, 2019, and Subscription Edition, both Enterprise and standard builds.

This is a different bug from CVE-2026-45659, the deserialization RCE that CISA added to its Known Exploited Vulnerabilities catalog on July 1. That patch shipped back in May. This one is new, in this release, and needs its own patch cycle even if you’ve already handled the earlier one. Two separate SharePoint zero-days landing seven weeks apart on the same product line is a pattern worth flagging to whoever owns your SharePoint farm, not a coincidence to shrug off.

CVE-2026-56155 (Active Directory Federation Services) is CVSS 7.8, an elevation-of-privilege flaw from insufficient access control granularity. It needs local, low-privileged access rather than being remotely triggerable, but AD FS sits at the center of federated authentication for most enterprise identity setups. A local privilege escalation there is a foothold for lateral movement across everything AD FS federates into, not a contained issue. Microsoft credited its own Detection and Response Team with finding it, which usually means it surfaced during an active incident investigation rather than routine research.

The third zero-day: BitLocker, and why it’s lower priority for most servers

CVE-2026-50661 is a publicly disclosed (not confirmed exploited) protection-mechanism bypass in BitLocker. It requires physical access to the device. For a server locked in a data center rack, that’s a low-probability threat model. For a laptop that leaves the building, a kiosk, or any machine that could plausibly be lost, stolen, or handled by someone outside your organization, it matters a lot more. Triage this one by device class, not by CVSS score alone.

The change that isn’t a CVE: RC4 Kerberos support is gone

Buried in the same release is a compatibility change that won’t show up in any vulnerability scanner: Microsoft removed the RC4DefaultDisablementPhase registry switch. Since January 2026, Microsoft has been phasing domain controllers away from RC4-encrypted Kerberos tickets toward AES-256, but that switch let administrators force the old RC4 behavior back on for compatibility with legacy service accounts and applications. July’s update removes it entirely.

Before July 2026 update	After July 2026 update
RC4 Kerberos tickets accepted if RC4DefaultDisablementPhase set	RC4 Kerberos tickets rejected, no rollback switch
Legacy service accounts negotiate RC4 silently	Legacy service accounts fail authentication
Compatibility issue is invisible until noticed	Compatibility issue surfaces as auth failures immediately

If any service account, scheduled task, or older line-of-business application in your domain still negotiates RC4 tickets, it can start failing the moment this update installs on your domain controllers. That’s not a security bug, it’s the security fix working as intended, but it will look exactly like an outage to whoever’s on call. Audit Kerberos encryption types in your environment before you roll this out broadly, not after.

What to actually do this week

1. Patch SharePoint Server and AD FS first. Both zero-days are confirmed exploited, and both sit on infrastructure that, once compromised, tends to cascade into broader access.
2. Triage BitLocker by device class. Mobile and physically exposed devices before racked servers.
3. Audit Kerberos encryption types before the rollout reaches your domain controllers. Run klist or check AD FS event logs for RC4 ticket requests now, so the failures you see next week are ones you already expected.
4. Don’t stop at the zero-days. With 56 critical fixes in one release, use your normal severity-and-exposure triage for the rest rather than assuming “not a zero-day” means “not urgent.”

If patch management and vulnerability triage are a recurring source of fire drills for your team, that’s usually a process gap more than a tooling gap, and it’s the kind of thing worth reviewing as part of a broader infrastructure audit rather than re-litigating every month a record-breaking Patch Tuesday shows up.

Patch the zero-days today. Audit your Kerberos tickets before you patch everything else.