July 2026 Patch Tuesday: What You Need to Know Right Now
- Microsoft’s July 2026 Patch Tuesday is the largest in history, addressing 569 CVEs — nearly tripling the previous record of 198 set just one month earlier in June 2026.
- Two zero-days, CVE-2026-56155 and CVE-2026-56164, are already being actively exploited in the wild and demand immediate patching, especially for organizations running Active Directory Federation Services and SharePoint Server.
- A critical CVSSv3 9.8-scored Remote Code Execution flaw in Microsoft Dynamics NAV (CVE-2026-55944) requires no user interaction, making it one of the most dangerous vulnerabilities in this release.
- A publicly disclosed BitLocker bypass vulnerability is also included in this release — a detail that should concern anyone relying on BitLocker for endpoint data protection.
- Scroll down to find out how Microsoft’s new AI-powered MDASH tool contributed to the record-breaking CVE count, and what that means for future Patch Tuesday releases.
Microsoft just shattered every record it has ever set on a Patch Tuesday — and if your systems aren’t patched yet, the clock is already running against you.
The July 2026 Patch Tuesday release dropped on July 14, 2026, addressing a staggering 569 CVEs across Windows and other Microsoft products. For cybersecurity teams tracking threat exposure, resources like Tenable’s Patch Tuesday analysis are invaluable for breaking down severity, exploitability, and prioritization in real time. This release isn’t just big in number — it includes two actively exploited zero-days and a near-perfect CVSSv3-scored RCE vulnerability that requires zero user interaction to trigger.
The Numbers: 569 CVEs, 56 Critical, and 3 Zero-Days
The scale of July 2026’s Patch Tuesday is difficult to overstate. Microsoft addressed 569 CVEs in a single release cycle, with the severity breakdown falling as follows:
- 56 Critical
- 510 Important
- 3 Moderate
- 0 Low
Three of those vulnerabilities were zero-days — meaning they were either publicly disclosed or actively exploited before Microsoft had a patch available. Two of the three were confirmed exploited in the wild, making them the highest-priority items in this entire release cycle.
Why This Release Shatters Every Previous Record
The previous record for a single Patch Tuesday stood at 198 CVEs, set just one month prior in June 2026. July’s release nearly triples that figure. While some of the CVE count can be attributed to consolidated reporting methods, the operational reality is the same: 56 critical vulnerabilities across Windows and related products demand immediate triage from every security team running Microsoft infrastructure.
How Microsoft’s AI-Powered MDASH Tool Changed the Game
Part of what drove the unprecedented volume this month is Microsoft’s internal use of its AI-powered vulnerability discovery system, known as MDASH. By automating large portions of the vulnerability identification pipeline, MDASH enabled Microsoft’s security researchers to surface and catalog flaws at a speed and scale that manual processes simply can’t match. The July 2026 release is a direct reflection of that accelerated discovery capability — and it signals that future Patch Tuesdays may regularly carry larger CVE counts than what the industry has historically expected. For businesses looking to enhance their cybersecurity measures, understanding the differences between cloud security solutions and on-premise cybersecurity is crucial.
Critical vs. Important vs. Moderate: What the Severity Ratings Mean
Microsoft’s severity ratings aren’t arbitrary labels. Critical means the vulnerability can be exploited remotely without user interaction and could allow full system compromise. Important covers flaws that are serious but require either user interaction or specific conditions to exploit. Moderate vulnerabilities carry meaningful risk but are mitigated by default configurations or other factors. With 56 Critical-rated CVEs in this release alone, prioritizing by severity is essential — but don’t let the 510 “Important” flaws fall off your radar either.
The Two Actively Exploited Zero-Days: CVE-2026-56155 and CVE-2026-56164
When Microsoft flags a vulnerability as exploited in the wild, that’s not a warning to schedule for next week’s patching window — that’s a signal to act today. Both CVE-2026-56155 and CVE-2026-56164 were being actively leveraged by attackers before patches were available, which means real organizations were already at risk by the time this release dropped.
CVE-2026-56155: Active Directory Federation Services Elevation of Privilege
CVE-2026-56155 affects Active Directory Federation Services (AD FS) and is classified as an Elevation of Privilege vulnerability. In practical terms, an attacker who already has a foothold in your environment can exploit this flaw to escalate their access privileges — potentially moving from a low-privilege account to full administrative control. Given how widely AD FS is deployed in enterprise single sign-on and identity federation architectures, the blast radius of this vulnerability is enormous. It was actively exploited in the wild prior to the patch release.
CVE-2026-56164: SharePoint Server Elevation of Privilege
CVE-2026-56164 targets SharePoint Server with a similar Elevation of Privilege class of attack. SharePoint environments that are internet-facing or connected to critical business workflows are especially exposed. Like CVE-2026-56155, this one was confirmed as exploited in the wild before July 14, meaning threat actors had already built and deployed working exploits. Organizations running on-premises SharePoint Server installations should treat this patch as a fire-drill priority.
What “Exploited in the Wild” Actually Means for Your Systems
The phrase “exploited in the wild” means attackers have moved beyond theoretical proof-of-concept and are running active campaigns using that vulnerability. It does not require that your organization has already been targeted — but it does mean the exploit code exists, is operational, and is being used. The window between patch release and widespread attack campaigns is measured in hours to days, not weeks. Every system still unpatched after a confirmed in-the-wild exploit disclosure is a system actively at risk.
CVE-2026-55944: The 9.8-Scored RCE Flaw in Dynamics NAV
Of all the non-zero-day vulnerabilities in this release, CVE-2026-55944 demands the most urgent attention after the two exploited zero-days. This Remote Code Execution flaw sits in Microsoft Dynamics NAV — the enterprise resource planning platform used by thousands of businesses for financials, supply chain, and operations management — and carries a CVSSv3 score of 9.8 out of 10.
- Affected product: Microsoft Dynamics NAV
- Vulnerability type: Remote Code Execution (RCE)
- CVSSv3 score: 9.8 (Critical)
- User interaction required: None
- Authentication required: None (network-accessible attack vector)
A CVSSv3 score of 9.8 puts CVE-2026-55944 in the rarest and most dangerous category of vulnerabilities. The scoring reflects the combination of remote exploitability, no user interaction, no authentication requirement, and high impact across confidentiality, integrity, and availability. In plain terms: an unauthenticated attacker on the network can run arbitrary code on your Dynamics NAV server without anyone clicking a link or opening a file. For more details, you can read about Microsoft’s July 2026 Patch Tuesday.
Organizations running Dynamics NAV in any internet-facing or intranet-accessible configuration should treat this as a patch-now situation, not a patch-this-cycle situation. Given that Dynamics NAV often holds sensitive financial and operational data, successful exploitation could result in data exfiltration, ransomware deployment, or complete server takeover.
Why a CVSSv3 Score of 9.8 Demands Immediate Action
The CVSSv3 scoring system evaluates six base metrics: attack vector, attack complexity, privileges required, user interaction, scope, and impact across confidentiality, integrity, and availability. A score of 9.8 means this vulnerability scores at the maximum or near-maximum level across nearly every single one of those metrics. Only a perfect 10.0 — which requires a scope change component — ranks higher. When a vulnerability reaches 9.8, the gap between “patched” and “unpatched” is the difference between a secure system and a fully compromised one.
No User Interaction Required: Why This Makes It Especially Dangerous
Most high-severity vulnerabilities still rely on some form of human error to trigger — a user clicking a malicious link, opening an attachment, or visiting a compromised site. CVE-2026-55944 requires none of that. An attacker can reach a vulnerable Dynamics NAV instance over the network and execute code autonomously, making social engineering defenses completely irrelevant here.
This attack profile is particularly dangerous in enterprise environments where Dynamics NAV servers are accessible across internal networks or connected to cloud infrastructure. A single vulnerable server becomes a pivot point for lateral movement across the broader environment.
If your organization cannot patch immediately, the short-term mitigation is to restrict network access to Dynamics NAV servers at the firewall level — limiting connections to only trusted hosts — until the patch can be deployed. This is a workaround, not a solution, and patching remains the only true remediation.
The Publicly Disclosed BitLocker Bypass
The third zero-day in July’s release is a publicly disclosed BitLocker bypass vulnerability. Unlike the two actively exploited zero-days, this one has not been confirmed as exploited in the wild — but public disclosure means proof-of-concept details are available, and the timeline to active exploitation is now significantly compressed. BitLocker is Microsoft’s built-in disk encryption tool, widely deployed across enterprise endpoints to protect data at rest. A bypass vulnerability in BitLocker undermines the fundamental security guarantee that encryption provides — that a stolen or lost device cannot be accessed without the proper credentials or recovery key. Any organization relying on BitLocker as a primary data-at-rest protection control should prioritize this patch accordingly, especially in the context of evolving cybersecurity compliance requirements.
DHCP Vulnerabilities: A Widespread Risk Hiding in Plain Sight
Beyond the headline zero-days, July 2026’s release contains a cluster of vulnerabilities affecting the Windows DHCP Server — the service responsible for automatically assigning IP addresses to devices across a network. DHCP servers are infrastructure-level components that exist in virtually every Windows-managed network, often overlooked precisely because they run quietly in the background.
Multiple CVEs in this release target DHCP with Remote Code Execution potential, meaning a compromised DHCP server isn’t just a connectivity problem — it’s a full network-layer attack surface. Because DHCP requests are inherently broadcast-based and processed before much of the network security stack is engaged, these vulnerabilities represent a particularly stealthy class of attack vector.
Which Systems Are Affected
The DHCP vulnerabilities in this release affect Windows Server environments running the DHCP Server role — which covers a broad swath of enterprise and mid-market infrastructure. Windows Server 2019, Windows Server 2022, and Windows Server 2025 installations with the DHCP role enabled are all in scope. If your organization runs its own DHCP infrastructure rather than offloading to a router or third-party appliance, these patches are directly relevant to you.
The Attack Scenario You Need to Understand
An attacker positioned on the same network segment as a vulnerable DHCP server — whether through a compromised endpoint, a rogue device, or VPN access — can send specially crafted DHCP packets designed to trigger the vulnerability. If successful, this results in remote code execution on the DHCP server itself, giving the attacker control over a core piece of network infrastructure. From there, an attacker can manipulate IP assignments, intercept traffic, or use the server as a launching point for further lateral movement across the environment.
Which Windows Updates to Install Right Now
Knowing which patches to apply first is just as important as knowing that patches exist. July 2026’s release spans a wide range of products and update packages, but for most Windows environments, the critical path runs through two Windows 11 cumulative updates and targeted patches for Active Directory and SharePoint infrastructure.
Windows 11 Users: KB5101650 and KB5099414
- KB5101650 — Cumulative update for Windows 11 Version 24H2, addressing the highest-priority CVEs in this release including components tied to the zero-day patches
- KB5099414 — Cumulative update for Windows 11 Version 23H2, covering the same critical CVE set for systems still running the prior feature release
Both updates are available through Windows Update, Microsoft Update Catalog, and Windows Server Update Services (WSUS). For organizations using Microsoft Intune or Configuration Manager, the updates are available for deployment through standard patch management workflows.
To verify whether your system has already received one of these updates, navigate to Settings → Windows Update → Update History and look for the KB number in the installed updates list. Alternatively, run winver from the Run dialog and cross-reference the build number against Microsoft’s published update history for your Windows 11 version.
If Windows Update is showing your system as current but you don’t see the July 2026 cumulative update listed, manually check the Microsoft Update Catalog at catalog.update.microsoft.com using the KB number directly. Delivery timing through Windows Update can vary based on device eligibility and update ring configurations, so manual verification is the most reliable method for confirming patch status at scale.
Priority Patches for Active Directory and SharePoint Administrators
For administrators managing Active Directory Federation Services environments, the patch for CVE-2026-56155 is delivered as part of the cumulative security update for AD FS — available through Windows Server Update Services and the Microsoft Update Catalog. Given that this vulnerability was actively exploited before the patch release, AD FS servers should be prioritized above all other infrastructure in your patching queue this cycle. Verify patch installation on every AD FS server in your federation farm, not just primary nodes.
SharePoint Server administrators should apply the July 2026 SharePoint Server cumulative update, which contains the fix for CVE-2026-56164. For on-premises SharePoint farms, this requires running the SharePoint update package followed by the SharePoint Products Configuration Wizard on each server in the farm — a process that must be completed in the correct sequence to avoid service disruption. Internet-facing SharePoint deployments should be taken offline or placed behind additional access controls until the patch is fully deployed and verified across all farm members.
How to Check if Your System Is Already Patched
Don’t assume your systems received July’s updates automatically. Delivery timing through Windows Update varies based on device eligibility, update rings, and organizational policy settings — and in enterprise environments managed through WSUS or Configuration Manager, updates may be held in approval queues. The fastest way to confirm patch status is to check directly on each system or query your patch management platform for deployment status against the July 2026 KB numbers. For a deeper understanding of security measures, explore the SIEM and SOAR security operations platforms that can enhance your IT team’s capabilities.
Quick Patch Verification Checklist for July 2026:
Method Steps What to Look For Windows Settings Settings → Windows Update → Update History KB5101650 or KB5099414 listed as installed Command Line (PowerShell) Run Get-HotFix -Id KB5101650Returns installation date if patch is present Microsoft Update Catalog Search KB number at catalog.update.microsoft.com Confirms package availability for manual download WSUS / SCCM Console Query compliance report for July 2026 updates Deployment status across all managed endpoints Microsoft Intune Devices → Monitor → Windows update rings Patch compliance percentage per update ring
For AD FS and SharePoint specifically, patch verification goes beyond checking a KB number. After applying the SharePoint cumulative update, you must confirm that the SharePoint Products Configuration Wizard completed successfully on every server in the farm. An incomplete configuration run can leave the farm in a partially updated state — technically showing the update as installed while still exposing the CVE-2026-56164 vulnerability at the application layer.
For Dynamics NAV environments affected by CVE-2026-55944, verify the patch through the Dynamics NAV Administration Shell or your ERP management console. Check the build version of your NAV installation against Microsoft’s published July 2026 cumulative update version numbers for Dynamics NAV to confirm you’re running a patched build. If your Dynamics NAV instance is managed by a third-party partner or hosted vendor, escalate patch confirmation to them directly and request written verification — don’t assume managed environments are patched on your behalf without confirmation.
Why July 2026’s Release Volume Will Likely Become the New Normal
The 569-CVE July release isn’t an anomaly to forget once the patching cycle closes — it’s a preview of where Patch Tuesday is heading. Microsoft’s integration of AI-powered vulnerability discovery tools like MDASH fundamentally changes the throughput at which internal security research can identify, catalog, and route flaws for remediation. What previously required months of manual code review can now be surfaced in days. The result is a compression of the vulnerability discovery-to-patch pipeline that is going to push CVE counts higher on a sustained basis. Security teams that still operate on monthly patching cadences with multi-week deployment windows are already behind the curve — and that gap is only going to widen.
The operational implication is direct: your patch management process, risk prioritization frameworks, and staffing models all need to be re-evaluated against a world where 500-plus CVE releases become routine. Organizations that invested in automated patch deployment, continuous compliance monitoring, and vulnerability-based prioritization systems are far better positioned to absorb this new volume without compromising on speed. Those still relying on manual triage spreadsheets and quarterly patching cycles are facing a structural problem that July 2026 just made impossible to ignore.
Patch Now — Every Hour of Delay Is a Window for Attackers
With two confirmed in-the-wild zero-days, a 9.8-scored RCE requiring no user interaction, a public BitLocker bypass, and 56 critical vulnerabilities across the board, July 2026’s Patch Tuesday leaves no room for a relaxed response. Threat actors don’t wait for your next change control window. The moment a patch releases, reverse engineering begins — and for vulnerabilities already being exploited, that work was done before you even opened this article. Prioritize CVE-2026-56155 and CVE-2026-56164 first, then CVE-2026-55944, then the BitLocker and DHCP patches. Move fast, verify thoroughly, and don’t assume automation handled it for you.
Frequently Asked Questions
The July 2026 Patch Tuesday release generated significant questions from security teams and IT administrators across the industry. Below are the most common questions, answered with the specific detail this release demands.
Whether you’re triaging for a large enterprise environment or managing a smaller infrastructure, these answers are designed to give you clear, actionable guidance — not generic advice.
What is Patch Tuesday and why does it happen every month?
Patch Tuesday is Microsoft’s scheduled monthly security update release, occurring on the second Tuesday of every month. Microsoft formalized this cadence in October 2003 to give IT administrators a predictable window to plan, test, and deploy security updates rather than dealing with unpredictable emergency releases. Each Patch Tuesday release addresses security vulnerabilities discovered in Windows, Microsoft Office, Azure, Exchange, SharePoint, and a wide range of other Microsoft products. Outside of Patch Tuesday, Microsoft also releases out-of-band updates for critical zero-days that cannot wait until the next scheduled cycle.
How do I know if CVE-2026-56155 or CVE-2026-56164 affects my organization?
CVE-2026-56155 affects systems running Active Directory Federation Services. If your organization uses AD FS for federated identity, single sign-on, or SAML-based authentication — whether on Windows Server 2019, 2022, or 2025 — you are in scope for this vulnerability. Check with your identity team or directory services administrator to confirm whether AD FS is deployed in your environment. If it is, patching is not optional.
CVE-2026-56164 affects on-premises SharePoint Server installations. If your organization runs SharePoint Server 2019 or SharePoint Server Subscription Edition on-premises, you are affected. SharePoint Online (Microsoft 365) environments are managed by Microsoft and were patched on the backend without requiring action from tenant administrators. To confirm your SharePoint version and patch status, open the SharePoint Central Administration console and navigate to Upgrade and Migration → Check product and patch installation status.
What is a CVSSv3 score and how should I use it to prioritize patching?
The Common Vulnerability Scoring System version 3 (CVSSv3) is a standardized framework for rating the severity of security vulnerabilities on a scale from 0.0 to 10.0. The score is calculated based on six base metrics that evaluate how a vulnerability can be exploited and what the potential impact is. A higher score means a more severe vulnerability — but CVSSv3 alone shouldn’t be your only prioritization signal. For a comprehensive understanding, you might explore different cybersecurity testing methods.
Use CVSSv3 as a starting point, not a final answer. A vulnerability with a 9.8 score that affects software not deployed in your environment is lower priority than an 8.1 score on a system you’re running in production. Layer CVSSv3 against your own asset inventory, exploit availability, and whether the vulnerability has been confirmed as exploited in the wild to build a prioritization model that reflects actual risk to your organization.
- 9.0 – 10.0 (Critical): Patch immediately, no exceptions. These represent near-maximum exploitability and impact.
- 7.0 – 8.9 (High): Patch within 24–72 hours for internet-facing systems; within the week for internal systems.
- 4.0 – 6.9 (Medium): Include in your standard patching cycle, prioritizing based on asset exposure and business criticality.
- 0.1 – 3.9 (Low): Address in routine maintenance windows; monitor for any change in exploit status.
The two exploited zero-days in July 2026’s release — CVE-2026-56155 and CVE-2026-56164 — illustrate exactly why exploit status must be weighted alongside the raw CVSSv3 score. Both are Elevation of Privilege vulnerabilities, which typically score lower than Remote Code Execution flaws on the CVSSv3 scale, yet their confirmed in-the-wild exploitation status makes them the highest operational priority in the entire release.
CISA’s Known Exploited Vulnerabilities (KEV) catalog is a reliable supplementary resource for confirming which vulnerabilities have been confirmed as actively exploited across government and critical infrastructure environments. Cross-referencing your patch prioritization against the KEV catalog adds a threat-intelligence layer that pure CVSSv3 scoring doesn’t provide.
Does Microsoft’s July 2026 patch count include Chromium/Edge vulnerabilities?
This is a common source of confusion in CVE counts. Microsoft’s Patch Tuesday totals historically have excluded Chromium-based vulnerabilities patched in the Microsoft Edge browser, because those patches follow Chromium’s own upstream release schedule rather than Microsoft’s monthly cadence. Edge receives Chromium security updates continuously and independently of Patch Tuesday.
The 569 CVEs reported in July 2026’s release reflect vulnerabilities in Microsoft’s own products and codebases — Windows OS components, server products, Microsoft 365 applications, Azure services, and Microsoft Dynamics — not the underlying Chromium engine. If you’re tracking Edge security separately, monitor Microsoft’s Edge release notes and the Chromium project’s security advisory feed alongside Patch Tuesday disclosures.
For organizations where Edge is a primary browser in managed environments, ensure that your browser update policies allow automatic Chromium updates independent of your Patch Tuesday deployment cycle. Blocking all automatic updates at the network or policy level to control patch timing can inadvertently freeze Edge on unpatched Chromium versions between Patch Tuesday cycles — a risk that operates entirely separately from the Windows CVE pipeline.
July 2026 CVE Scope at a Glance
Category Included in 569 CVE Count Windows OS Components ✓ Yes Microsoft SharePoint Server ✓ Yes Active Directory / AD FS ✓ Yes Microsoft Dynamics NAV ✓ Yes Azure Services ✓ Yes Microsoft 365 Apps ✓ Yes Chromium / Edge Browser Engine ✗ No (separate release cadence)
How does Microsoft’s MDASH AI system find vulnerabilities faster than before?
MDASH is Microsoft’s internal AI-powered security research platform designed to automate significant portions of the vulnerability discovery process. Traditional vulnerability research relies heavily on manual code auditing — skilled security researchers reading through millions of lines of code line by line, looking for logic flaws, memory corruption opportunities, and boundary condition errors. That process is thorough but inherently slow, and human capacity is finite. For more details on the latest updates, check out Microsoft’s July 2026 Patch Tuesday.
MDASH accelerates this by applying machine learning models trained on historical vulnerability patterns to scan codebases at scale. The system can identify code constructs that statistically correlate with known vulnerability classes — things like improper input validation patterns, use-after-free conditions, and privilege escalation pathways — and flag them for human review far faster than manual auditing alone. This doesn’t replace human researchers; it dramatically increases the volume of candidate findings they can evaluate in a given time period.
The practical result of MDASH’s integration into Microsoft’s security research pipeline is exactly what July 2026 demonstrated: a release cycle that surfaced nearly three times as many CVEs as the previous month. Some of those CVEs represent newly discovered vulnerabilities; others may represent flaws that existed in older codebases but were never surfaced by previous manual review cycles — now caught by MDASH’s pattern recognition at scale.
For the broader security industry, MDASH represents a meaningful shift in the economics of vulnerability discovery. When AI can surface flaws faster than attackers can find and weaponize them, the defensive side gains a genuine advantage in the race between patch release and exploit development. That advantage is only as valuable as the speed with which organizations apply the patches that result from it. To further understand the implications of AI in cybersecurity, you can read about how the FBI stops AI phishing service with 1 million URLs.
The July 2026 Patch Tuesday release is a direct call to action for every organization running Microsoft infrastructure — and Tenable provides the vulnerability management tools and real-time CVE analysis that security teams need to prioritize, track, and verify patch deployment at the speed this new era of AI-driven vulnerability discovery demands.
July 2026 Patch Tuesday has brought significant updates, as Microsoft addresses 569 CVEs, including CVE-2026-56155 and CVE-2026-56164. These updates are crucial for maintaining system security and protecting against potential vulnerabilities. Staying informed about such updates is essential for IT professionals and organizations to ensure their systems are secure and up-to-date.
