Microsoft Patches Record 622 Vulnerabilities Including Two Actively Exploited Zero-Days
Critical flaws in SharePoint and Active Directory Federation Services under attack.
1Record-Breaking Patch Release
Microsoft has shipped its largest Patch Tuesday update to date, addressing 622 security vulnerabilities. This number more than triples June's previous record of around 200 CVEs. The update covers a wide range of Microsoft's products and services listed in its Security Update Guide.
2Two Zero-Days in Active Exploitation
Among the patches are fixes for two zero-day vulnerabilities currently being exploited in attacks. One is a privilege escalation flaw in SharePoint Server (CVE-2026-56164), the other in Active Directory Federation Services (CVE-2026-56155). Both target identity and collaboration infrastructure components.
3SharePoint Emergency
The SharePoint Server vulnerability allows unauthenticated attackers to escalate privileges over the network. Microsoft credits Mandiant and Google's FLARE team for discovering this flaw during active attacks. Coincidentally, extended support for SharePoint Server 2016 and 2019 also ends on this patch Tuesday.
4AD FS Local Privilege Issue
The AD FS flaw enables authenticated attackers to elevate privileges locally through weak access controls. As AD FS signs tokens trusted across the enterprise, this vulnerability carries significant risk despite being labeled as 'local'. Microsoft's DART team identified this threat.
5RC4 Encryption Support Ends
The update completes Microsoft's multi-year phase-out of RC4 encryption in Kerberos. Only accounts explicitly configured for RC4 will retain support. Service accounts without AES keys may experience authentication failures unless passwords are rotated before applying the update.
6Other Critical Fixes
The release also addresses a BitLocker bypass (CVE-2026-50661) and Rapid7's SharePoint JWT authentication bypass (CVE-2026-55040). Windows received 416 patches, Office 82, and Edge 46, totaling 622 vulnerabilities fixed. Remote code execution flaws feature prominently across all product families.
7Urgent Action Required
Microsoft's exploitability ratings confirm active exploitation of two zero-days. Organizations shouldn't wait for CISA's KEV catalog listing and should prioritize patching immediately. SharePoint and AD FS implementations require particular attention due to their critical role in enterprise infrastructure.
Original article: The Hacker News — Microsoft Rekor Kıran 622 Güvenlik Açığını Kapattı