Microsoft Patch Tuesday Analysis – July 2026

Executive Summary

On Tuesday, July 14, 2026, Microsoft released its monthly security update, addressing 622 vulnerabilities across its products.

By Severity:

• Critical - 62;
• Moderate - 6;
• Important - 553;
• Low - 1.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Particular attention should be paid to the following 3 vulnerabilities. Addressing them is the highest priority:

• CVE-2026-56155 (CVSS 7.8; Important) - Active Directory Federation Services Elevation of Privilege Vulnerability (Elevation of Privilege). This vulnerability is caused by insufficient access control granularity (CWE-1220) in Active Directory Federation Services (AD FS). An authorized, low-privileged attacker can exploit this flaw to locally bypass access restrictions and elevate their privileges to administrator level.
• CVE-2026-56164 (CVSS 5.3; Moderate) - Microsoft SharePoint Server Elevation of Privilege Vulnerability (Elevation of Privilege). This vulnerability is caused by a missing authentication for a critical function (CWE-306) in Microsoft SharePoint Server. A remote, unauthorized attacker can exploit this flaw over the network with low complexity and without any user interaction, allowing them to elevate privileges in the system. To protect against and detect potential attacks, it is recommended to enable AMSI (Antimalware Scan Interface) integration and configure full scanning of POST request bodies for IIS worker processes.
• CVE-2026-50661 (CVSS 6.1; Important) - Windows BitLocker Security Feature Bypass Vulnerability (Security Feature Bypass). This vulnerability is related to a protection mechanism failure in Windows BitLocker (CWE-693). An attacker with direct physical access to the target device can exploit this vulnerability to bypass the BitLocker Device Encryption feature, allowing unauthorized access to protected and encrypted data on the system drive.

General Trends

The July 2026 Patch Tuesday was an unprecedented event in the history of Microsoft updates. The company released patches for a record-breaking 622 vulnerabilities, 62 of which are rated "Critical." This massive volume—effectively replacing three to four standard monthly updates—places an extreme workload on system administration and cybersecurity teams. Key trends of this large-scale release include:

• Releasing over 600 patches at once indicates either the discovery of a major systemic issue in Windows base libraries or the accumulation of findings from long-term security audits. In either case, organizations are required to adjust their patch prioritization strategies.
• Active attacks on identity and collaboration services: Special attention must be paid to two vulnerabilities that are already actively exploited by attackers (Zero-Days). The first is CVE-2026-56155 in AD FS (Active Directory Federation Services). Compromising a Single Sign-On (SSO) entry point allows attackers to gain access to dozens of linked enterprise services. The second is another flaw in SharePoint Server (CVE-2026-56164), which requires not only a patch but also deep configuration of POST request scanning via AMSI for adequate protection.
• Impact on cloud AI platforms and virtualization: Microsoft addressed critical elevation of privilege vulnerabilities (CVSS 9.9) in Azure OpenAI (CVE-2026-45499) and the Microsoft Entra directory service (CVE-2026-57100). A dangerous flaw was also fixed in the VMSwitch virtual switch (CVE-2026-57092), which could potentially allow a virtual machine escape to the host system (Hyper-V escape).
• Infrastructure RCE threats: The network services sector remains highly vulnerable. Critical RCE bugs (CVSS 9.8) were fixed in the DHCP Server, FTP Service, the Windows Server network card driver, as well as in SQL Server and RDP.
• Physical security questioned: The publicly disclosed BitLocker bypass vulnerability (CVE-2026-50661) continues a series of spring and summer disclosures concerning methods to bypass disk encryption. This is critical for protecting information on employees' mobile devices in the event of loss.

Full List of Vulnerabilities

Below is a table listing all the vulnerabilities addressed this month.

Retrospective Vulnerability Analysis

• CVE-2026-26114 - Microsoft SharePoint Server Remote Code Execution Vulnerability (Remote Code Execution). An untrusted data deserialization vulnerability that allows an authorized attacker with minimal site member privileges to execute arbitrary code on the server. The published PoC demonstrates a full-chain exploit: using a SQL injection in the Taxonomy component to inject a specially crafted object into a system table, which is then automatically deserialized by the background SharePoint service (OWSTIMER). This vulnerability was patched in March 2026.

• CVE-2026-33829 - Windows Snipping Tool Spoofing Vulnerability (Spoofing). A vulnerability in the Snipping Tool application that allows the disclosure of users' Net-NTLM hashes. The issue stems from insufficient input validation in the registered ms-screensketch URI scheme handler. An attacker can trick a victim into clicking a specially crafted link where the filePath parameter points to an external SMB resource. Upon navigating and confirming the application launch, the system automatically attempts to load the file over the network, transmitting the user's NTLM hash to the attacker's server. A detailed analysis of this vulnerability has been published on GitHub. It was patched in April 2026.

• CVE-2026-47291 — HTTP.sys Remote Code Execution Vulnerability (Remote Code Execution). This vulnerability is an integer overflow leading to a heap buffer overflow in the Windows kernel when processing HTTP requests via the HTTP.sys driver. The issue occurs due to incorrect type casting when incrementing the header limit counter, resulting in the allocation of a buffer of insufficient size for the new array. An unauthenticated attacker can send a specially crafted HTTP or HTTP/2 request with a large number of headers, which causes kernel memory overwrite during data copying and allows remote code execution with system privileges. A PoC demonstrating the counter overflow mechanism when sending a high number of headers is available on GitHub. This vulnerability was patched in June 2026.

• CVE-2026-45504 — Microsoft Exchange Server Elevation of Privilege Vulnerability (Elevation of Privilege). A Server-Side Request Forgery (SSRF) vulnerability associated with improper path validation when handling Reference Attachments. An authorized attacker with a low level of privileges and an active mailbox can create a message containing a link to an external, controlled resource that returns an XML response with a local path (such as pointing to system files) when accessed. When the attachment preview function (GetAttachmentPreview) is invoked in OWA, the Exchange server processes this path and returns the contents of the local file to the user, bypassing access restrictions and elevating privileges in the system. A PoC demonstrating this vulnerability is available on GitHub. This vulnerability was patched in June 2026.

• CVE-2026-42980 — Windows NT OS Kernel Elevation of Privilege Vulnerability (Elevation of Privilege). This vulnerability is associated with an integer underflow in the Windows kernel WMI subsystem (ntoskrnl.exe) when calling the WmipQueryAllDataMultiple (IOCTL 0x22812C) and WmipQuerySingleMultiple (IOCTL 0x228130) functions. Due to incorrect subtraction of the data size from the unsigned 32-bit counter of the remaining buffer, the length variable takes on a critically large value. This allows a local user to trigger a kernel heap buffer overflow, overwrite adjacent named pipe structures (NP_DATA_QUEUE_ENTRY), and elevate privileges to SYSTEM. A detailed technical description and PoC for this vulnerability are available on GitHub. This vulnerability was patched in June 2026.

Conclusion

The July update release represents an unprecedented challenge for any organization's IT infrastructure. Processing 622 vulnerabilities within a standard testing cycle is practically impossible, making prioritization critical.

Recommended action plan for July:

1. Urgent patching of Zero-Day vulnerabilities:
   • Immediately update AD FS (CVE-2026-56155) authentication servers to prevent account compromise.
   • Install patches on SharePoint (CVE-2026-56164) servers and configure AMSI integration to inspect incoming web traffic.
2. Protection of cloud systems and virtualization: Update Hyper-V hypervisors (to close the flaw in VMSwitch) and synchronize security policies for Entra and Azure OpenAI cloud platforms.
3. Protection of network services (RCE): Apply updates to critical server roles, specifically DHCP servers and SQL Server databases.
4. Mobile devices: Install cumulative updates on corporate laptops to address the publicly disclosed BitLocker (CVE-2026-50661) vulnerability.

Focus on retrospective analysis: The situation is complicated by the fact that detailed breakdowns and PoC exploits for critical vulnerabilities from June and earlier spring have appeared in the public domain (including GitHub) over the past month. These include: a highly dangerous RCE in HTTP.sys (CVE-2026-47291), an SSRF in Exchange Server (CVE-2026-45504), and logical authentication bypasses in SMB (CVE-2026-24294). If you have not addressed these flaws previously, your network is at significant risk right now, even before analyzing the massive July update package. Clearing patch technical debt from previous months should be performed in parallel with addressing July's Zero-Day vulnerabilities.