Record Microsoft Patch Tuesday Highlights the Need for Prioritization During Active Exploitation

Microsoft released an unusually large July 2026 security update. According to public reporting and Microsoft Security Update Guide counts, the release covers more than 600 vulnerabilities across multiple product families, including Windows, SharePoint Server, Active Directory Federation Services, Office, Edge, SQL Server, Exchange Server, Defender, Azure and developer tools.

The most important point is not only the number of vulnerabilities. Two of them are marked as actively exploited:

• CVE-2026-56164 — an elevation of privilege vulnerability in Microsoft SharePoint Server;
• CVE-2026-56155 — an elevation of privilege vulnerability in Active Directory Federation Services.

Both affect components with high organizational value: SharePoint as a document and collaboration environment, and Active Directory Federation Services as part of identity and trust infrastructure.

What Happened

The July Microsoft Patch Tuesday includes fixes for a large volume of vulnerabilities, some rated high or critical. The release includes remote code execution, elevation of privilege, security feature bypass, spoofing, denial of service and information disclosure issues.

The response priority should focus on the vulnerabilities already exploited in attacks. In this release, those are SharePoint Server and Active Directory Federation Services.

CVE-2026-56164 in SharePoint Server allows elevation of privilege over the network. Microsoft marks the vulnerability as exploited, and public reporting notes that it affects on-premises SharePoint environments. This is especially important for organizations that still maintain self-hosted SharePoint servers.

CVE-2026-56155 affects Active Directory Federation Services. It is also marked as exploited and allows elevation of privilege by an already authenticated attacker. Although it is classified as a local vulnerability, the affected system is critical because it participates in issuing and validating access tokens.

Why These Two Vulnerabilities Are Priority

During a large patch release, attention can easily be distributed only by CVSS score. That approach is not enough.

The two actively exploited vulnerabilities are not simply two more fixes in a large list. They affect systems that often have access to sensitive data, internal documents, identities and trust relationships.

SharePoint Server often contains:

• internal documents;
• contracts;
• financial files;
• HR information;
• project documentation;
• internal procedures;
• sensitive applications and integrations.

Active Directory Federation Services participates in access control and trust between applications, users and services. Compromise or privilege escalation in such an environment may enable broader access, token abuse or movement toward other systems.

Prioritization should therefore consider not only the technical rating, but also the role of the affected component in the real environment.

SharePoint Server: Why On-Premises Environments Remain Sensitive

SharePoint Server remains important in many organizations, especially where internal collaboration, documents and workflows are managed locally. This includes public sector organizations, finance, manufacturing, healthcare, energy and environments with specific regulatory or architectural requirements.

On-premises SharePoint environments have several characteristics:

• they are often connected to Active Directory;
• they process large volumes of internal documents;
• they support integrations with other systems;
• they may be accessible via the internet or VPN;
• they sometimes run legacy configurations;
• they require careful planning during updates.

For an actively exploited vulnerability in such a system, response should not stop at patching. Teams need to check whether there are already signs of access, changes, unusual requests or new files.

Microsoft also notes Antimalware Scan Interface (AMSI) in Full Mode as a mitigation for SharePoint Server. This should not be treated as a replacement for patching, but as an additional control that may reduce risk in specific scenarios.

Active Directory Federation Services: A Local Vulnerability With Broader Context

CVE-2026-56155 is an elevation of privilege vulnerability in Active Directory Federation Services. It requires an already authenticated attacker, which may make it appear less urgent at first glance. In a real environment, however, AD FS is not just another server.

AD FS participates in issuing and managing tokens that other applications and services trust. If an attacker already has access to such a system and can elevate privileges, the risk may affect the broader trust model.

Organizations should review:

• where AD FS is used;
• which applications rely on it;
• which administrative accounts have access;
• whether there were recent unusual logons;
• whether configuration changes occurred;
• whether token issuance or usage activity looks unusual.

An AD FS incident should not be viewed only as local privilege escalation. The identity context is central.

Large Patch Volumes Change the Operating Model

The July release reflects a problem many teams already feel: vulnerability volume is growing faster than the capacity for manual prioritization, testing and deployment.

When one cycle includes hundreds of fixes, teams cannot work only from a list and CVSS scores. More mature prioritization logic is needed:

• actively exploited vulnerabilities;
• publicly disclosed vulnerabilities;
• internet-facing systems;
• identity infrastructure;
• systems with sensitive data;
• remote code execution exposure;
• availability of public exploits;
• criticality of the affected asset;
• compensating controls;
• business risk if remediation is delayed.

This is especially important during high-volume patch cycles. If everything looks important, the organization must still identify what is urgent.

Kerberos RC4 Changes: The Risk of Service Disruption

The July updates are important not only because of vulnerabilities. They also include changes related to Kerberos RC4 hardening. Microsoft continues the process of limiting RC4 in Kerberos authentication, which may affect environments with older service accounts, legacy clients or configurations that still depend on RC4.

This is not a typical breach risk. It is an operational risk: after updating, some services may fail to authenticate correctly if they still depend on RC4.

Before deployment, organizations should review:

• which accounts still use RC4;
• whether any service accounts are missing AES keys;
• whether legacy applications do not support newer algorithms;
• whether service account passwords need to be rotated;
• which critical services could be affected.

This part of the update shows why patch management is not only “installing patches.” It includes testing, understanding dependencies and coordinating with teams that support business applications.

Priority Actions

Organizations should not treat the July release as a standard monthly update. A clearer order of action is needed.

First priority:

• identify all on-premises SharePoint Server installations;
• check whether SharePoint Server is internet-facing or externally reachable;
• apply the fixes for CVE-2026-56164;
• verify whether AMSI is enabled and configured appropriately;
• review SharePoint logs for unusual requests, files and administrative actions;
• check for signs of prior access.

Second priority:

• identify all AD FS servers;
• apply the fixes for CVE-2026-56155;
• review administrative access to AD FS;
• check recent configuration changes;
• review authentication events and token-related activity;
• investigate unusual logons or local activity.

Third priority:

• review the remaining critical vulnerabilities in Windows, SQL Server, Exchange Server, Defender, Office, Edge and developer tools;
• prioritize internet-facing systems;
• check whether vulnerabilities are publicly disclosed;
• assess which systems support critical business processes;
• plan testing, deployment and validation;
• document decisions, especially when remediation is delayed.

DIAMATIX Perspective

This Patch Tuesday shows why vulnerability management needs to be an operational function, not only a monthly IT task. When a single cycle includes hundreds of fixes and two vulnerabilities are already exploited, maturity is visible in prioritization.

For organizations, the question is not whether they can install all updates. The question is whether they can quickly identify which updates affect their most critical systems, which vulnerabilities are already used by attackers and which create the highest business risk.

For cybersecurity providers, this is a capacity and context question. SOC (Security Operations Center), MDR (Managed Detection and Response) and vulnerability management teams need to connect vulnerability information with the customer’s real environment: assets, exposure, identities, logs, business criticality and available compensating controls.

DIAMATIX reviews patch cycles like this across three levels:

• what is already being exploited;
• where the affected system exists in the real environment;
• what should be done if patching cannot be completed immediately.

This is especially important for SharePoint Server and AD FS. Both systems can hold high value for an attacker, even when the specific CVSS score does not look like the highest number in the list.

Patch management increasingly requires coordination between IT operations, security, risk management and leadership. Delay in actively exploited vulnerabilities is not only a technical delay. It can become a risk to data, access, service continuity and regulatory accountability.

CISO Analysis

For CISOs, the July Microsoft Patch Tuesday raises several concrete questions.

The first area is prioritization. When there are hundreds of vulnerabilities, the team needs a process that quickly separates active exploitation from the overall volume.

Key questions include:

• Do we have an inventory of all affected Microsoft assets?
• Do we know which of them are internet-facing?
• Do we use Microsoft exploited flags, CISA KEV, EPSS and threat intelligence for prioritization?
• Do we prioritize by business criticality, not only CVSS?
• Can we define which fixes need to be deployed within hours or days?
• Do we document reasons when critical remediation is delayed?

The second area is SharePoint Server. If the organization maintains on-premises SharePoint, this environment should be reviewed immediately.

Key questions include:

• Do we run on-premises SharePoint Server?
• Is the version supported or close to end of support?
• Is it accessible from the internet or via external channels?
• Is AMSI enabled and in which mode?
• Are there unusual requests, file changes or administrative actions?
• Is there a modernization plan if the environment is already outside active support?

The third area is AD FS. A vulnerability in identity infrastructure should be assessed by the role of the system, not only by its formal rating.

Key questions include:

• Do we use AD FS and for which applications?
• Which accounts have administrative access?
• Were there recent configuration changes?
• Is authentication or token activity unusual?
• Are AD FS servers segmented and administratively restricted?
• What would the impact be if AD FS were compromised?

The fourth area is operational update risk. Kerberos RC4 changes may affect legacy environments if there is no prior assessment.

Key questions include:

• Do we have service accounts that still use RC4?
• Have RC4 audit events been reviewed?
• Have passwords been rotated for accounts missing AES keys?
• Are there legacy applications that require RC4?
• Were critical business applications tested before deployment?
• Is there a rollback and communication plan for service disruption?

The fifth area is SOC/MDR partner readiness. During a high-volume patch cycle, an external provider should help not only with monitoring, but also with prioritization.

Key questions include:

• Do we receive context on which vulnerabilities are relevant to our environment?
• Is there monitoring for exploitation of SharePoint and AD FS?
• Can the SOC connect a vulnerability with real log events?
• How are actively exploited vulnerabilities escalated?
• How is risk reduction proven after patching?
• Is there a process for compensating controls when patching cannot be completed immediately?

For CISOs, the takeaway is practical: a record number of vulnerabilities does not simply mean more work. It requires a better operating model for prioritization, execution, validation and accountability.

What This Means for Your Environment

• This type of risk relies on delayed patching, especially in high-value systems such as SharePoint Server and AD FS.
• Detection depends on accurate asset inventory, visibility into exposed systems, SharePoint and AD FS logs, identity activity and monitoring for exploitation signs.
• Response requires prioritization based on active exploitation, rapid patching, compensating controls, log review and documented actions.

Key questions to review:

• Do you use on-premises SharePoint Server?
• Do you have AD FS, and is it clear which applications depend on it?
• Can you separate actively exploited vulnerabilities from the overall Patch Tuesday volume?
• Do you have a process for priority deployment during active exploitation?
• Do you check for signs of exploitation after applying patches?
• Have you tested the impact of Kerberos RC4 changes on service accounts and legacy applications?

Prioritize critical Microsoft patches based on real risk

DIAMATIX can help review:

• affected Microsoft assets in your environment;
• SharePoint Server and AD FS exposure;
• prioritization during active exploitation;
• logs and signs of exploitation;
• compensating controls when patching is delayed;
• SOC/MDR readiness for high-volume vulnerability cycles.

Request a Microsoft patch risk prioritization review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Microsoft Security Update Guide.
• Microsoft Windows Release Health.
• Cisco Talos. Microsoft Patch Tuesday for July 2026.
• SecurityWeek. Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days.
• BleepingComputer. Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days.
• Tenable. Microsoft’s July 2026 Patch Tuesday analysis.
• The Hacker News. Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack.

This article is based on publicly available information as of July 2026.