# Microsoft Patches Record 622 Vulnerabilities Including Two Actively Exploited Zero-Days Critical flaws in SharePoint and Active Directory Federation Services under attack. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/58edcc45-d0e1-4b8f-85eb-e35aa8e0cf50 ## Record-Breaking Patch Release Microsoft has shipped its largest Patch Tuesday update to date, addressing 622 security vulnerabilities. This number more than triples June's previous record of around 200 CVEs. The update covers a wide range of Microsoft's products and services listed in its Security Update Guide. ## Two Zero-Days in Active Exploitation Among the patches are fixes for two zero-day vulnerabilities currently being exploited in attacks. One is a privilege escalation flaw in SharePoint Server (CVE-2026-56164), the other in Active Directory Federation Services (CVE-2026-56155). Both target identity and collaboration infrastructure components. ## SharePoint Emergency The SharePoint Server vulnerability allows unauthenticated attackers to escalate privileges over the network. Microsoft credits Mandiant and Google's FLARE team for discovering this flaw during active attacks. Coincidentally, extended support for SharePoint Server 2016 and 2019 also ends on this patch Tuesday. ## AD FS Local Privilege Issue The AD FS flaw enables authenticated attackers to elevate privileges locally through weak access controls. As AD FS signs tokens trusted across the enterprise, this vulnerability carries significant risk despite being labeled as 'local'. Microsoft's DART team identified this threat. ## RC4 Encryption Support Ends The update completes Microsoft's multi-year phase-out of RC4 encryption in Kerberos. Only accounts explicitly configured for RC4 will retain support. Service accounts without AES keys may experience authentication failures unless passwords are rotated before applying the update. ## Other Critical Fixes The release also addresses a BitLocker bypass (CVE-2026-50661) and Rapid7's SharePoint JWT authentication bypass (CVE-2026-55040). Windows received 416 patches, Office 82, and Edge 46, totaling 622 vulnerabilities fixed. Remote code execution flaws feature prominently across all product families. ## Urgent Action Required Microsoft's exploitability ratings confirm active exploitation of two zero-days. Organizations shouldn't wait for CISA's KEV catalog listing and should prioritize patching immediately. SharePoint and AD FS implementations require particular attention due to their critical role in enterprise infrastructure. ## Sources covering this story - https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._