Microsoft Patch Tuesday exposes 570 CVEs and three zero-days

At a glance

What this is: This is an independent analysis of Microsoft’s July 2026 Patch Tuesday, highlighting 570 CVEs, three zero-days, and a heavy concentration of remote code execution risk.

Why it matters: It matters because identity-adjacent systems like AD FS, Exchange, SharePoint, and BitLocker can become privilege, spoofing, or authentication breakout points if patch prioritisation is not tied to access risk.

By the numbers:

• Microsoft’s July 2026 Patch Tuesday includes 570 CVEs, including three zero-day vulnerabilities.
• There are 143 remote code execution CVEs in this release, and 34% of them are rated Critical.

👉 Read Expel's analysis of Microsoft Patch Tuesday's zero-days and CVE priorities

Context

Patch volume is only useful if teams can translate it into remediation priority. A release with hundreds of vulnerabilities can hide the few issues that create the fastest path to privilege escalation, authentication abuse, or lateral movement, especially when exposed services sit close to identity infrastructure. In Microsoft environments, those issues often intersect directly with IAM-adjacent systems such as AD FS, Exchange, and SharePoint.

The identity angle is not that every patch is an IAM issue. It is that some vulnerabilities sit on systems that anchor trust, authentication, or privileged access, so missing them can widen the blast radius far beyond a single server. That makes this release a useful reminder that patch management and identity governance cannot be treated as separate disciplines.

Key questions

Q: How should security teams prioritise patching when Microsoft vulnerabilities affect identity and cloud controls?

A: Prioritise the systems that broker trust first, especially domain controllers, authentication proxies, and cloud runtime components that can expand a single exploit into tenant-wide access. Then move outward to user endpoints and lower-impact servers. The rule is simple: patch in order of identity blast radius, not by the longest vulnerability list or the noisiest alert source.

Q: Why do Microsoft server vulnerabilities create identity risk even when they are not IAM bugs?

A: Because many Microsoft services sit on the path that users and workloads use to prove identity, exchange trust, or obtain privileged access. A flaw in AD FS, Exchange, or SharePoint can become a way to harvest credentials, alter trust, or reach sensitive data. The security issue becomes identity-adjacent as soon as the service brokers access.

Q: What do teams get wrong about remote code execution on enterprise servers?

A: They often treat it as a single-host issue instead of a potential trust-boundary breach. On systems connected to identity, mail, or collaboration services, RCE can lead to credential theft, token abuse, persistence, and lateral movement. The right assumption is that execution on the right server can become access across multiple systems.

Q: Who is accountable when exploited Microsoft vulnerabilities affect authentication or privilege?

A: Accountability usually sits across platform, infrastructure, and identity teams because the failure spans patching, privilege control, and trust architecture. Security leadership should assign ownership for emergency remediation, post-exploitation review, and federation integrity checks before the next maintenance cycle closes.

Technical breakdown

Why zero-days change patch triage

Zero-days compress the decision window because defenders are responding before a broad remediation pattern has settled. In practice, that means exploitability, internet exposure, privilege impact, and whether the vulnerable system sits inside an identity path become the real ranking criteria. A zero-day on an authentication or directory service is different from a low-reach local flaw because compromise there can unlock downstream accounts, tokens, or trust relationships. Patch teams should therefore rank zero-days by control plane impact, not by CVSS alone.

Practical implication: build a patch queue that weights identity-adjacent exposure first, especially on directory, federation, and messaging systems.

Why remote code execution dominates operational risk

Remote code execution matters because it turns a vulnerability into an execution foothold, often without requiring prior credentials or physical access. Once code runs on a server, attackers can steal secrets, implant persistence, enumerate trust relationships, or pivot into identity services. Not every RCE becomes a breach, but RCE on a server that handles authentication, mail flow, or document collaboration has a much higher chance of cascading into account compromise or data access. The practical difference is that RCE changes the assumption from isolated host risk to possible domain-wide compromise.

Practical implication: treat RCE on identity-adjacent systems as a potential credential and trust boundary event, not just an application defect.

Why AD FS, Exchange, SharePoint, and BitLocker matter differently

AD FS sits close to federated authentication, so privilege flaws there can affect how users and services prove identity. Exchange and Outlook Web Access can expose phishing and spoofing paths that turn mail interaction into code execution or credential harvesting. SharePoint is often a collaboration and content hub, which makes it a path to data access and privilege elevation when authentication is missing. BitLocker is different because physical access is the prerequisite, but any security feature bypass still weakens endpoint protection assumptions. These systems sit at different layers, but all can influence identity confidence and control integrity.

Practical implication: separate your patch tiers by trust-function impact, not by product family or CVSS alone.

Threat narrative

Attacker objective: The attacker’s objective is to convert a single Microsoft platform weakness into privileged access, trusted spoofing, or broader compromise of identity-linked systems.

1. Entry occurs through an actively exploited or remotely reachable flaw on a Microsoft server role, or through malicious email interaction in the Exchange case.
2. Escalation follows when the attacker uses the flaw to gain elevated privileges, bypass security features, or run code in a trusted context.
3. Impact is achieved by taking over authentication, spoofing trusted communication, or expanding access into adjacent identity and data systems.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.
• Gravity SMTP CVE-2026-4020 API Keys Exposure — CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Patch volume only becomes meaningful when it is mapped to identity impact. A release with 570 CVEs is a workload problem, but the real security problem is which flaws can alter trust, privilege, or authentication outcomes. AD FS, Exchange, and SharePoint are not ordinary workloads when they sit in the access path. Practitioners should classify patch urgency by whether a system can reshape identity decisions.

Zero-days expose the gap between vulnerability management and access governance. Teams often prioritise by exposure and severity, but identity-linked services require a second lens: what can the attacker do after exploitation. A zero-day that reaches an admin boundary or a federation boundary is materially different from a host-only flaw. The governance gap here is assuming patching and privilege containment are separable.

Identity-adjacent RCE is a credential problem as much as a code problem. Once code execution lands on a server that brokers trust, attackers can pursue secrets, session material, or token paths rather than just system disruption. That is why the security boundary is not the server itself but the identities and trust relationships it can reach. Practitioners should treat these patches as access-risk events.

Credential exposure windows grow when remediation is deferred on collaboration and mail systems. Exchange and SharePoint vulnerabilities matter because they sit near user interaction and shared content, where phishing, spoofing, and privilege elevation can combine. The named concept here is trust-plane compromise: when a service that validates or brokers identity becomes the breach pivot. That is a control failure, not just a software defect.

Patch governance has to be identity-aware to be effective. Microsoft environments often blend endpoint, server, and identity functions, so a uniform patch policy misses the systems that carry the highest trust value. The right response is to map vulnerability classes to trust roles, then prioritise the systems that can authenticate, elevate, or impersonate. That is how patch operations become security governance.

From our research:

• From our research: 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
• Our research also shows that only 5.7% of organisations have full visibility into their service accounts, which leaves identity-linked blast radius hard to contain.
• For a broader breach pattern view, see The 52 NHI breaches Report for recurring compromise modes and governance gaps.

What this signals

Microsoft patch cycles keep reinforcing the same programme lesson: vulnerability management and identity governance now overlap on the same systems. When a patch can affect authentication, federation, or mail trust, the remediation queue becomes an access-control decision as much as an engineering one.

Trust-plane compromise: the next hard problem is not finding more vulnerabilities, but ranking which ones can alter identity outcomes. That means security teams need trust-function inventories, emergency change paths, and post-patch validation for privilege and federation settings.

Practitioners who already map workloads to identity flows will recover faster from high-volume releases because they can focus on systems that broker access, not just systems that look critical on paper.

For practitioners

• Rank identity-adjacent zero-days first Place AD FS, Exchange, SharePoint, and any federation-connected systems at the top of emergency remediation queues when a zero-day can affect privilege, authentication, or spoofing.
• Separate local, physical, and remote exploit paths Do not treat a physical-access bypass like a remote execution issue, but still time its remediation based on endpoint exposure and user mobility patterns.
• Map every critical Microsoft service to a trust function Document whether each system brokers identity, stores sensitive content, relays email, or exposes collaboration workflows so patch priority reflects business trust impact.
• Pair emergency patching with privilege review After remediation on exploited systems, review privileged groups, service accounts, and federation trust settings for evidence of post-exploitation abuse.

Key takeaways

• Microsoft’s July Patch Tuesday is a scale problem, but the real risk sits in the small subset of flaws that touch privilege, federation, and spoofing.
• Remote code execution on identity-adjacent services should be treated as a trust-boundary event because it can turn into credential theft or broader access.
• Teams need patch priority rules that reflect trust function, not just CVSS, because identity impact is what determines blast radius.

Key terms

• Trust-plane compromise: A trust-plane compromise occurs when an attacker targets a system that validates identity, brokers access, or distributes trust across the enterprise. The damage is larger than the host itself because the compromised service can alter authentication, privilege, or session confidence across connected systems.
• Identity-adjacent risk: A communication or system event that is not itself an identity event but can trigger one, such as an approval, reset, delegation, or privilege change. These risks are critical because attackers often exploit trust in process rather than direct technical compromise.
• Patch triage: The process of deciding which vulnerabilities to fix first, based on exploitation evidence, exposure, criticality, and operational dependency. Good triage does not try to treat every issue as equal; it aims to remove the attacker’s most realistic options with the least delay.

What's in the full analysis

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• Per-CVE breakdown of the three zero-days and the affected Windows versions
• Exploitability notes for the actively exploited AD FS and SharePoint issues
• Remediation guidance for BitLocker, Exchange, and the subscription server editions
• Vendor-specific patching considerations that help translate triage into change windows

👉 Expel's full analysis covers the zero-day list, exploit context, and remediation priorities in detail

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to real operational risk.