Microsoft Patches a Record 570 Flaws, Two Zero-Days Already Under Attack

On Tuesday, July 14, Microsoft shipped the largest set of fixes in Patch Tuesday history, closing 570 vulnerabilities at once. Attackers are already exploiting two of them in the wild, and a third was publicly disclosed before the patch landed.

The most serious of the exploited bugs is CVE-2026-56164 in Microsoft SharePoint Server. A missing authentication check in a critical function lets an unauthenticated attacker escalate privileges across the network, with no password at all. Researchers at Mandiant and Google Cloud reported it. Until the update is installed, Microsoft recommends enabling AMSI (Antimalware Scan Interface) and switching request body scanning to Full mode.

The second exploited zero-day, CVE-2026-56155, sits in Active Directory Federation Services (ADFS). Insufficient granularity in its access controls lets an already authenticated user escalate to administrative privileges locally. Microsoft's DART team found it.

The third flaw, CVE-2026-50661, was disclosed publicly before the patch, though no exploitation has been seen yet. It bypasses BitLocker encryption: an attacker with physical access to a device can reach the encrypted data. Its finder stayed anonymous.

The remaining fixes break down as 254 elevation of privilege, 145 remote code execution (RCE), 102 information disclosure, 35 denial of service, 17 security feature bypass, and 16 spoofing. Fifty-nine are rated Critical, 48 of them RCE. Affected products include Office, Exchange Server, SQL Server, Windows Media Foundation, the Remote Desktop client, Microsoft Defender, and Hyper-V.

The priority for administrators is clear: patch the two exploited zero-days in SharePoint and ADFS first, and apply the AMSI workaround for SharePoint until the update is deployed.

Based on reporting by BleepingComputer.