Tracking current vulnerabilities isn't just for large enterprises with dedicated security teams. For small and mid-sized businesses, staying aware of the latest threats is a critical part of maintaining a strong security posture.
Record-Breaking Patch Tuesday: 622 CVEs Fixed
Microsoft's July 2026 Patch Tuesday was the largest in the company's history, addressing 622 vulnerabilities across Windows, Office, Azure, and other products — including 63 critical-severity flaws. This shattered June's record of 206 CVEs and underscores the accelerating pace of security threats facing organizations today.
Among the most significant findings:
- Two actively exploited zero-days — vulnerabilities that attackers were already exploiting before patches were available
- A publicly disclosed BitLocker bypass — allowing physical attackers to read encrypted data
- Kerberos RC4 enforcement begins — a long-anticipated security hardening step that could break service account authentication
- Multiple SharePoint Server flaws — including bugs demonstrated at Pwn2Own Berlin
Zero-Day #1: Active Directory Federation Services (CVE-2026-56155)
CVE-2026-56155 is an elevation of privilege vulnerability in Active Directory Federation Services (AD FS) that allows an attacker with local low-privileged access to escalate to administrative control over the AD FS farm. Microsoft assigned it a CVSS score of 7.8 (Important), but because it was actively exploited before a patch was available, CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026.
What this means for your business: AD FS is the authentication backbone for many organizations using federated identity with Microsoft 365 and other cloud services. An attacker who compromises a single low-privileged workstation on your network could use this vulnerability to gain administrative control over your entire federation infrastructure — potentially allowing them to authenticate as any user in your organization.
The July update also begins the first phase of hardening the Distributed Key Manager (DKM) container ACL, which is the underlying mechanism that CVE-2026-56155 exploits.
Zero-Day #2: SharePoint Server Remote Code Execution (CVE-2026-56164)
CVE-2026-56164 is a critical remote code execution vulnerability in Microsoft SharePoint Server that was also actively exploited as a zero-day. This flaw affects all supported on-premises SharePoint versions — Subscription Edition, 2019, and 2016.
Critical context: SharePoint Server 2016 and SharePoint Server 2019 reached the end of extended support on July 14, 2026 — the same day this final scheduled security release shipped. Organizations still running these versions need to plan their upgrade path immediately, as no further security updates will be provided.
Attackers exploiting this vulnerability can establish remote code execution on affected SharePoint servers, steal IIS machine keys, and perform deserialization techniques to gain persistence. CISA added this to the KEV catalog on July 14 with a remediation deadline of July 28, 2026 for federal agencies.
Additional SharePoint Flaws Hit CISA KEV
The SharePoint attacks didn't stop there. Two additional SharePoint vulnerabilities were added to CISA's KEV catalog later in the month:
- CVE-2026-58644 (CVSS 9.8, Critical) — Added July 17. A deserialization of untrusted data RCE flaw that was demonstrated at Pwn2Own Berlin and subsequently exploited in the wild. Microsoft revised its bulletin to confirm active exploitation.
- CVE-2026-50522 (CVSS 9.8, Critical) — Added July 22. Another deserialization RCE vulnerability affecting SharePoint Server 2016, 2019, and Subscription Edition. CISA gave federal agencies until July 25 to patch.
The takeaway: If your organization runs on-premises SharePoint, this was the most dangerous month in recent memory. Three separate critical RCE vulnerabilities were exploited or added to the KEV catalog within a single month.
BitLocker Security Feature Bypass (CVE-2026-50661)
CVE-2026-50661 is a security feature bypass vulnerability in Windows BitLocker that allows an attacker with physical access to a device to bypass BitLocker encryption and read or modify data on encrypted drives. While Microsoft has not confirmed active exploitation, the vulnerability was publicly disclosed before the patch was released.
What this means for your business: If you rely on BitLocker to protect data on laptops — especially for mobile workers, field employees, or devices that leave the office — this vulnerability is significant. An attacker who steals or gains physical access to a laptop could bypass the encryption that is supposed to protect your data. Apply the July security update to all Windows devices, particularly laptops and mobile workstations.
Kerberos RC4 Enforcement Begins
One of the most impactful changes in the July 2026 update is the removal of the temporary RC4 rollback key for Kerberos authentication. Microsoft has been phasing out the deprecated RC4 encryption type for years, and this update makes RC4 enforcement mandatory.
What this means: Service accounts, legacy applications, and integrations that still rely on RC4 for Kerberos authentication will stop working after this update. Organizations need to ensure all service accounts and domain-joined systems support AES encryption.
Action items: - Audit service accounts for RC4 dependency using PowerShell - Update legacy applications that hard-code RC4 - Verify Azure Files AD DS integrations support AES-256 - Test in a pilot group before broad deployment
Our managed IT services include proactive testing of patch Tuesday updates to identify and resolve compatibility issues before they impact your operations.
SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410)
On July 1, CISA added two SonicWall SMA1000 vulnerabilities to the KEV catalog. CVE-2026-15409 and CVE-2026-15410 affect the SMA1000 SSL VPN appliance and were being actively exploited in zero-day attacks. SonicWall assigned the advisory an overall CVSS score of 10.0 (Critical).
These flaws allow unauthenticated attackers to gain a foothold on internet-facing SMA1000 appliances and ultimately take them over. If your organization uses SonicWall SMA1000 for remote access, these patches should be treated as urgent.
Unauthenticated RDP Server RCE (CVE-2026-56190)
CVE-2026-56190 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in Windows Remote Desktop Services caused by an uninitialized resource. This flaw requires no authentication or user interaction — an attacker only needs to send a specially crafted request to an exposed RDP server.
Action item: Audit which of your RDP servers are internet-facing. If any are exposed to the public internet, they should be behind a VPN or Azure AD Application Proxy immediately — regardless of whether the patch is applied.
Common Patterns We're Seeing
Across the vulnerabilities reported this month, a few patterns stand out:
- SharePoint is under heavy attack — three separate critical RCE vulnerabilities in a single month, with active exploitation confirmed
- End-of-support deadlines create risk — SharePoint 2016 and 2019 reached end of extended support on July 14, meaning no more security patches
- Authentication infrastructure is a prime target — AD FS, Kerberos, and VPN appliances all had critical flaws this month
- Physical access attacks are being addressed — the BitLocker bypass is a reminder that encryption isn't a set-and-forget control
Practical Steps SMBs Can Take This Month
You don't need a massive security budget to stay ahead. Here are actionable steps:
- Apply the July Patch Tuesday updates immediately — prioritize the AD FS, SharePoint, and RDP fixes. Our [managed IT services](/services/it-managed-services) include automated patch management and continuous vulnerability monitoring.
- Audit your SharePoint environment — if you're running on-premises SharePoint 2016 or 2019, plan your migration to SharePoint Subscription Edition or SharePoint Online now
- Check your SonicWall SMA1000 appliances — if you use them for remote access, apply the latest firmware immediately
- Review RDP exposure — ensure no RDP servers are directly accessible from the internet
- Test Kerberos authentication — run a pilot group to identify service accounts that will break with RC4 enforcement
- Update BitLocker-managed devices — apply the July update to all laptops and mobile workstations
- Run a vulnerability scan — even a basic scan can reveal obvious gaps
Conclusion
July 2026 was an extraordinary month for security vulnerabilities. The record-breaking Patch Tuesday, multiple actively exploited zero-days, and critical flaws in widely used infrastructure like SharePoint, AD FS, and SonicWall appliances mean that organizations cannot afford to delay patching.
A comprehensive cybersecurity program that includes regular vulnerability assessments, managed detection and response, and compliance-aligned controls can keep your business protected without requiring a dedicated internal security team.
Need help assessing your current vulnerability management program? Contact Virtue Technology Solutions for a no-pressure consultation.