Loading story…
Microsoft released its largest Patch Tuesday update on record, fixing 569 vulnerabilities across Windows, Office, SharePoint, Exchange, SQL Server, Defender, Hyper-V, DHCP, TCP/IP, Remote Desktop, and other products. The release included 56 Critical, 510 Important, and 3 Moderate flaws, with three zero-days highlighted and two confirmed as exploited in the wild. Elevation of privilege bugs accounted for the largest share of fixes, while remote code execution issues made up roughly a quarter of the total.
Among the most significant issues were exploited zero-days affecting Microsoft SharePoint Server and Active Directory Federation Services (ADFS), a publicly disclosed BitLocker security feature bypass, and a critical unauthenticated deserialization RCE impacting Microsoft Dynamics NAV and Dynamics 365 Business Central on-premises. Microsoft also addressed multiple serious DHCP Server and Client vulnerabilities and 20 Windows Kernel elevation of privilege flaws, six of which were assessed as more likely to be exploited; SharePoint defenders were also pointed to Microsoft guidance on enabling AMSI integration to strengthen server-side malware detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA warned that three SharePoint Server vulnerabilities—CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164—were being actively exploited, added them to the Known Exploited Vulnerabilities catalog, and directed federal agencies to secure systems affected by CVE-2026-56164 by July 17 or discontinue them if mitigations could not be applied.
Microsoft's July 2026 Patch Tuesday released fixes for a record-setting volume of vulnerabilities across its products. Coverage in the references notes 569-570 flaws addressed, including three zero-days and active exploitation of SharePoint Server and AD FS issues.
A CVE record for CVE-2026-45659 was published in the CVE database, documenting the vulnerability as a distinct disclosure prior to Microsoft's July 2026 Patch Tuesday release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
38 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecybersecuritynews.com
Open sourcethecybersecguru.com
Open sourcecybersecuritynews.com
Open sourcemicrosoft.com
Open sourcelearn.microsoft.com
Open sourcecwe.mitre.org
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **163 vulnerabilities** in its April Patch Tuesday update, marking one of its largest security releases on record. The bundle includes **8 Critical** flaws, **154 Important** issues, and **1 Moderate** bug, with seven of the Critical vulnerabilities enabling remote code execution across products and components including **Windows TCP/IP**, **Windows IKE Service Extensions**, **Active Directory**, **Remote Desktop Client**, **Microsoft Office**, and **Microsoft Word**. Belgian authorities urged organizations to apply the updates immediately. The most urgent issues include **`CVE-2026-32201`**, an actively exploited **Microsoft SharePoint Server** vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalog, and **`CVE-2026-33825`** in **Microsoft Defender**, a publicly disclosed zero-day tied to proof-of-concept code associated with the **BlueHammer** exploit. Microsoft also shipped Windows 11 cumulative updates with security hardening changes, including safer handling of **`.rdp`** files and improved visibility into **Secure Boot** certificates, while the broader patch set addressed numerous elevation-of-privilege and security feature bypass flaws that could support post-compromise escalation.
Jun 29, 2026
Microsoft released fixes for **163 CVEs** across 17 product families, including **8 Critical** vulnerabilities, **1 publicly disclosed** flaw, and **1 vulnerability under active exploitation**. The exploited issue, `CVE-2026-32201`, is a **Microsoft SharePoint Server spoofing vulnerability** that can let an unauthenticated attacker impersonate a user and read or modify certain data. Microsoft also patched `CVE-2026-33825`, a **publicly disclosed Microsoft Defender elevation-of-privilege flaw** that affects systems only when Defender is enabled; the company said customers using Defender automatic updates are remediated automatically. Among the most severe issues, Microsoft highlighted `CVE-2026-33824`, a **Critical Windows Internet Key Exchange (IKE) Service Extensions remote code execution vulnerability** with a **CVSS 9.8**, and advised defenders to restrict **UDP ports 500 and 4500** until patching is complete. Elevation-of-privilege bugs made up the largest share of the release with **94 CVEs**, while **Windows** accounted for **131** of the patched vulnerabilities. Microsoft said **24 flaws** were more likely to be exploited within 30 days, **18** carried CVSS scores of **8.0 or higher**, and the release also included **80 Edge-related advisories**, most inherited from Chrome.
Jun 29, 2026
Microsoft released its July 2026 security updates covering **622 CVEs** across Windows, Office, Edge, Azure, Exchange Server, SharePoint Server, SQL Server, Defender, and developer tools, with Windows accounting for **416** of the fixes. The company highlighted **CVE-2026-56155** vulnerabilities affecting **Active Directory Federation Services** and **Microsoft SharePoint Server** as having detected exploitation, and said **CVE-2026-50661**, a **Windows BitLocker** security feature bypass flaw, was publicly known at release. Microsoft also republished **428** non-Microsoft Chromium CVEs as part of the update cycle. The release includes several high-impact enterprise issues that defenders are likely to prioritize, including critical unauthenticated remote code execution in **SharePoint** (**CVE-2026-50522**, **CVE-2026-58644**), **Remote Desktop Client** (**CVE-2026-54990**, CVSS **9.8**), and the **Windows FTP Service** (**CVE-2026-49172**, CVSS **9.8**), alongside network-reachable flaws in **SQL Server**, **Exchange Server**, **Windows TCP/IP**, **RMCAST**, **SSTP**, **Print Spooler**, **ASP.NET Core**, **.NET**, **Configuration Manager**, and **Windows Admin Center**. The breadth of affected server and workstation products means organizations running exposed Microsoft services, especially SharePoint, FTP, RDP-related components, and identity infrastructure, face an urgent patching and exposure-reduction task.
Jul 15, 2026