TL;DR: Microsoft's July 2026 Patch Tuesday delivers a record 622 CVEs, 56 Critical issues, and three zero-days, with two already exploited in the wild, according to Senserva, so teams should triage by exploitation and exposure rather than patch volume. When vulnerability discovery accelerates, ranking by risk becomes the only defensible operating model.
At a glance
What this is: Microsoft's July 2026 Patch Tuesday is a record 622-CVE release with three zero-days, two of them already exploited, and the practical lesson is to triage by risk rather than count.
Why it matters: Patch teams, IAM teams, and platform owners need to prioritise exploited identity and collaboration surfaces first, because a release this large makes volume an unreliable guide to operational urgency.
By the numbers:
- Microsoft's July 2026 security release includes 622 CVEs, including 56 rated Critical.
Context
Microsoft's July 2026 Patch Tuesday is a vulnerability management problem, not a simple patch list. When a monthly release contains hundreds of CVEs, the control gap is prioritisation: teams cannot treat every item as equally urgent, especially when exploitation status and exposure vary across internet-facing services, collaboration platforms, and endpoint estate.
For identity and access teams, the intersection is direct. AD FS and SharePoint sit close to authentication, federation, and collaboration workflows, so exploit activity against those services can create immediate access risk, token abuse, or lateral movement opportunities. That makes the release a governance test for patch triage, not just a change-management exercise.
Key questions
Q: What should security teams do first when Patch Tuesday includes exploited zero-days?
A: Start with the vulnerabilities confirmed in active exploitation, then move to systems that are internet-facing, privilege-bearing, or support authentication and administration. KEV status should override raw CVE volume because it reflects real attacker interest. After that, sequence lower-risk fixes by business criticality and change-window capacity.
Q: Why do actively exploited vulnerabilities create more urgent risk than high CVSS scores alone?
A: Actively exploited vulnerabilities are urgent because they show attackers are already using the flaw in the wild, so the risk is immediate rather than theoretical. CVSS describes severity, but it does not tell you whether adversaries are targeting the issue now. Combining exploitation intelligence with severity scoring helps teams avoid underestimating high-impact flaws that are already being weaponised.
Q: What breaks when Kerberos protocol changes are deployed without dependency testing?
A: Legacy clients, service integrations, and authentication workflows can fail if they still depend on the older behaviour. That turns a security fix into an operational outage, which is why protocol changes need ring-based validation and explicit dependency mapping before broad deployment.
Q: How should security teams decide whether to trust a Patch Tuesday severity count?
A: Use the count as a workload indicator, not a decision rule. The better question is whether any item is known to be exploited, whether it is exposed to the internet, and whether it protects a critical identity or collaboration service. Those signals tell you what must move first.
Technical breakdown
Why exploitability beats CVE volume in patch triage
Patch Tuesday counts are inventory data, not risk data. A release with 622 CVEs can hide the small subset that actually changes attacker opportunity, which is why exploitation status, internet exposure, and business-critical placement matter more than the headline total. In practice, CVSS tells you severity in isolation, but not whether a vulnerability is already being used or whether it sits on a reachable service. That distinction is especially important for identity-adjacent systems, where one exploited control plane issue can affect authentication, federation, or access pathways far beyond the patched host.
Practical implication: Rank patch queues by exploitability and exposure before you let severity scores drive sequencing.
What the AD FS and SharePoint zero-days change for identity surfaces
AD FS is a federation service, so exploitation there can affect authentication pathways and downstream trust decisions. SharePoint is a collaboration surface, but it often connects to enterprise identity, file access, and internal workflow data, which makes it a high-value path for attackers once code execution or privilege abuse is available. The article's point is not that every identity platform is equally exposed, but that identity-adjacent services amplify impact when they are internet-facing and actively targeted. That is why the exploited zero-days belong at the top of any patch list, regardless of the rest of the month's volume.
Practical implication: Treat internet-facing federation and collaboration services as first-class patch priorities when exploitation is confirmed.
Why the Kerberos RC4 change needs controlled rollout
Kerberos RC4 support changes are different from ordinary fixes because compatibility decisions can create authentication failure before administrators fully understand the blast radius. When a vendor ships a breaking change with no simple rollback, the risk is not only technical breakage but also hidden dependency exposure across older clients, legacy integrations, and service-to-service trust. This is a classic example of why identity change management has to account for protocol behaviour, not just patch installation. The article correctly flags testing because authentication stack changes can be more disruptive than a straightforward vulnerability fix.
Practical implication: Stage protocol changes in rings and verify legacy authentication dependencies before broad deployment.
Threat narrative
Attacker objective: Attackers want reliable footholds on exposed identity and collaboration services that can expand into authentication abuse, access disruption, or internal compromise.
- Entry occurs through internet-facing identity and collaboration services once an exploitable flaw exists in AD FS or SharePoint Server.
- Credential or trust abuse follows when attackers can use the vulnerable service to reach authentication-adjacent functions or privileged workflows.
- Impact lands in the identity plane because compromised federation or collaboration surfaces can expose access paths, internal data, or downstream systems.
Breaches seen in the wild
- ShinyHunters FBI breach claim 2026: ShinyHunters claims it used a PeopleSoft flaw to breach the FBI and pivot into AWS GovCloud; the FBI has confirmed only an investigation.
- Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Risk-based triage is now the core patch governance control, not a reporting preference. A release of this size makes manual enumeration meaningless unless teams can rank by exploitability, exposure, and business criticality. That is a governance problem as much as an operations problem, because patch queues now decide where organisational risk is allowed to persist. Practitioners should treat triage logic as a standing control, not an emergency workaround.
Identity-adjacent infrastructure deserves special urgency because exploitation there can change trust, not just availability. AD FS is a federation service, which means compromise can affect authentication decisions and downstream trust relationships. SharePoint may look like a content platform, but in practice it sits close to enterprise access and collaboration workflows, so exploitation can widen the blast radius quickly. Teams should recognise these surfaces as access-path infrastructure, not ordinary application endpoints.
Kerberos protocol changes expose the difference between vulnerability remediation and identity dependency management. A fix that breaks RC4 reliance can be operationally safer in the long term but still destabilise authentication if the estate depends on older behaviour. That makes protocol transition planning part of identity governance, not merely a patching task. The practical conclusion is to inventory legacy dependencies before change lands, or the patch programme becomes its own outage source.
Microsoft's AI-assisted discovery comment signals a structural acceleration in vulnerability supply, not a one-off spike. If more flaws are being found faster, the security programme must assume shorter decision cycles and less room for backlog delay. That does not change the need for human judgment, but it does raise the value of automation around scoring, exposure mapping, and service ownership. Practitioners should expect triage pressure to rise even when control maturity stays flat.
Exploited zero-days on federation and collaboration surfaces are a reminder that machine-speed vulnerability discovery collides with human-speed patch governance. The gap is not just technical, it is organisational. Security teams need a prioritisation model that can survive record-sized releases without collapsing into CVSS-only decisions. The lesson for identity and access programmes is to keep federation, collaboration, and authentication dependencies visible in patch governance.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- CrowdStrike's 2026 Global Threat Report said zero-days exploited before public disclosure rose 42% year over year.
- Read next: Top 10 NHI Issues
What this signals
Risk-based triage is becoming the only workable response to oversized monthly patch releases. When a vendor ships hundreds of CVEs at once, the programme that wins is the one that can combine exploitation data, exposure mapping, and service ownership into one ranking model. Identity and collaboration systems should be treated as high-priority control planes because compromise there affects authentication and business flow, not just endpoint hygiene.
Patch governance now has to account for discovery acceleration as a planning assumption. Senserva's own reading of Microsoft's comment on AI-assisted vulnerability discovery points to a future in which backlog pressure grows faster than human review capacity. That makes automated enrichment and service classification more important for every vulnerability management team, especially where federation, collaboration, and workload identity are in scope.
Exploitability is the new scaling variable in vulnerability operations. The number of CVEs matters less than the number of issues that are already reachable, already public, or already being used by attackers. Teams that keep identity surfaces visible in their patch governance model will make better decisions when the next record release arrives.
For practitioners
- Prioritise exploited zero-days first Patch CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server before working through the rest of the month's queue, because both are already being exploited in the wild.
- Use exposure and exploitation signals to rank the remainder Sort the remaining CVEs by CISA KEV status, then EPSS, then severity and reachability instead of processing the list in numeric order.
- Stage Kerberos RC4 changes in test rings Validate the July Kerberos RC4 breaking change against legacy clients, services, and federation dependencies before broad rollout, because the change has no clean rollback.
- Treat out-of-band fixes as separate emergency work Make sure the July 9 RoguePlanet fix is tracked outside the regular Patch Tuesday workflow so emergency releases are not missed when the monthly release arrives.
Key takeaways
- Microsoft's July 2026 Patch Tuesday shows that raw CVE counts are now less useful than exploitation status and exposure when teams decide what to patch first.
- The most urgent fixes in this release sit on identity and collaboration surfaces, which means the blast radius of delay can extend beyond the individual server.
- Patch programmes need a standing risk-ranking model, because record-sized release notes make manual triage too slow to rely on.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0006;TA0008 — Initial Access; Credential Access; Lateral Movement | The article centres on exploitation of internet-facing identity and collaboration services. |
| Recommendation — Map exploited Patch Tuesday items to ATT&CK and prioritise controls around initial access and lateral movement paths. | ||
| NIST CSF 2.0 | ID.RA-01 — Asset vulnerabilities are identified and recorded | The piece is fundamentally about ranking vulnerabilities by risk, not by raw count. |
| PR.PS-04 — Software is maintained, replaced, or removed based on security priorities and criticality | Patch sequencing is the primary operational issue in the article. | |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | AD FS and SharePoint are identity-adjacent systems where access pathways are at risk. | |
| Recommendation — Use ID.RA-01 to keep exposure and exploitability data in the patch-ranking process. Apply PR.PS-04 to drive patch sequencing by criticality and confirmed exploitation. Use PR.AA-05 to review exposure on federation and collaboration services before broad rollout. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The article is a direct example of prioritising vulnerabilities by exploitability and exposure. |
| Recommendation — Use CIS-7 to rank patches by active exploitation, reachability, and asset criticality. | ||
Key terms
- Patch triage: The process of deciding which vulnerabilities to fix first, based on exploitation evidence, exposure, criticality, and operational dependency. Good triage does not try to treat every issue as equal; it aims to remove the attacker’s most realistic options with the least delay.
- Exploited Zero-Day: An exploited zero-day is a software or hardware flaw that attackers are actively using before defenders have a patch or reliable detection. It matters because the weakness is already in play, so exposure exists even when normal security controls appear healthy. In practice, it requires urgent containment, threat hunting, and compensating controls.
- Identity-Adjacent Surface: An identity-adjacent surface is a system that is not itself a directory or IAM platform, but still affects authentication, federation, access, or trust decisions. Federation services and collaboration platforms often fall into this category because compromise there can change downstream access outcomes.
- Out-of-Band Patch: An out-of-band patch is an emergency fix released outside the normal monthly or scheduled update cycle. It usually signals a vulnerability that is urgent enough to require separate operational handling, especially when proof-of-concept code or active exploitation is already present.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suited to practitioners who need to connect federation, service accounts, and access governance to broader security operations.
Published by the NHIMG editorial team on July 22, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org