Microsoft July 2026 Patch Tuesday Fixes 622 Flaws, 2 Zero-Days

A Record-Breaking Patch Load From Redmond

Microsoft's July 2026 Patch Tuesday has landed, and it's a big one. The company shipped fixes for 622 CVEs this month, addressing vulnerabilities across Windows, Office, Azure, and related services. Among the flood of updates, two stand out because attackers are already exploiting them in the wild: bugs in Active Directory Federation Services (AD FS) and SharePoint. Microsoft has also disclosed a BitLocker bypass that, while not yet reported as actively exploited, warrants urgent attention from anyone relying on Windows disk encryption to protect sensitive data.

Patch Tuesday updates happen every month, but the sheer volume this time underscores a trend that's been building for a while. Software ecosystems keep growing more complex, and so does the surface area attackers can probe. Readers who remember when Microsoft patched a then-record 570 bugs will recognize the pattern: each cycle seems to top the last, and the pace of disclosure isn't slowing down.

Two Zero-Days Already Under Attack

The most urgent items in this month's release are the two zero-day vulnerabilities affecting AD FS and SharePoint that Microsoft confirms are being exploited before the patches became available. AD FS is the backbone of identity federation for countless organizations, handling single sign-on and authentication across corporate networks and cloud services. A successful attack against it can let an intruder impersonate legitimate users or gain a foothold across connected systems. SharePoint, meanwhile, sits at the center of document sharing and internal collaboration for businesses of every size, making it an attractive target for anyone looking to access sensitive files or move laterally inside a network.

When a vulnerability is already being exploited before a patch exists, the window between disclosure and real-world attacks effectively disappears. Organizations running AD FS or SharePoint should treat these updates as immediate priorities rather than routine maintenance, since delaying them increases the odds of falling victim to attackers who are actively scanning for unpatched systems.

The BitLocker Bypass and Why Encryption Matters

Alongside the exploited flaws, Microsoft disclosed a bypass affecting BitLocker, the built-in encryption feature many Windows users depend on to protect data on laptops, external drives, and other devices. BitLocker is often the last line of defense if a device is lost or stolen. A bypass undermines that protection, potentially exposing personal files, credentials, and business data even when a machine appears to be securely locked down.

This is where the privacy stakes become clear for everyday users, not just IT departments. Encryption is one of the few tools that gives people real control over their own data, especially on devices that travel with them. A flaw that weakens BitLocker's guarantees matters just as much to a remote worker carrying a company laptop through an airport as it does to a large enterprise managing thousands of endpoints. While Microsoft has not indicated this bypass is being actively exploited, its public disclosure means the technical details are now known, which historically shortens the timeline before attackers attempt to weaponize it.

What This Means For You

For most home users, Windows Update will handle the bulk of this month's fixes automatically once installed, and there's little reason to delay applying them. The bigger concern sits with IT teams and administrators managing AD FS deployments, SharePoint servers, or fleets of encrypted devices. Because two vulnerabilities are already being exploited, patching should move to the top of the queue this week rather than waiting for a routine maintenance window.

It's also worth remembering that a 622-CVE Patch Tuesday isn't necessarily a sign that Windows is getting less secure. Larger patch batches often reflect more thorough vulnerability research, better disclosure practices, and an expanding footprint of services Microsoft now maintains. Still, the practical advice for anyone using Windows systems remains the same every month: patch promptly, verify that automatic updates are actually enabled, and pay closer attention when a vendor flags active exploitation.

Actionable Takeaways

• Apply the July 2026 Patch Tuesday updates as soon as possible, prioritizing systems running AD FS or SharePoint given the confirmed active exploitation.
• If your organization relies on BitLocker for device encryption, check for guidance on the disclosed bypass and apply any related mitigations without delay.
• Confirm that Windows Update is set to install security patches automatically on both personal and work devices.
• IT administrators should review exposure across identity and collaboration infrastructure, since AD FS and SharePoint often connect to multiple downstream systems.
• Keep an eye on follow-up advisories from Microsoft, since additional detail or mitigation steps sometimes emerge in the days after the initial Patch Tuesday release.

This month's record patch load is a reminder that staying current with updates isn't optional busywork. It's one of the most effective steps individuals and organizations can take to protect their data and privacy in an environment where attackers move quickly once a vulnerability becomes public.