Topic starter
22/07/2026 4:36 pm
TL;DR: Microsoft's July 2026 Patch Tuesday delivers a record 622 CVEs, 56 Critical issues, and three zero-days, with two already exploited in the wild, according to Senserva, so teams should triage by exploitation and exposure rather than patch volume. When vulnerability discovery accelerates, ranking by risk becomes the only defensible operating model.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “July 2026 Patch Tuesday: A Record 622 CVEs and Three Zero-Days”.
By the numbers:
- Microsoft's July 2026 security release includes 622 CVEs, including 56 rated Critical.
Key questions
Q: What should security teams do first when Patch Tuesday includes exploited zero-days?
A: Start with the vulnerabilities confirmed in active exploitation, then move to systems that are internet-facing, privilege-bearing, or support authentication and administration.
Q: Why do actively exploited vulnerabilities create more urgent risk than high CVSS scores alone?
A: Actively exploited vulnerabilities are urgent because they show attackers are already using the flaw in the wild, so the risk is immediate rather than theoretical.
Q: What breaks when Kerberos protocol changes are deployed without dependency testing?
A: Legacy clients, service integrations, and authentication workflows can fail if they still depend on the older behaviour.
Practitioner guidance
- Prioritise exploited zero-days first Patch CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server before working through the rest of the month's queue, because both are already being exploited in the wild.
- Use exposure and exploitation signals to rank the remainder Sort the remaining CVEs by CISA KEV status, then EPSS, then severity and reachability instead of processing the list in numeric order.
- Stage Kerberos RC4 changes in test rings Validate the July Kerberos RC4 breaking change against legacy clients, services, and federation dependencies before broad rollout, because the change has no clean rollback.
Bottom line: Microsoft's July 2026 Patch Tuesday shows that raw CVE counts are now less useful than exploitation status and exposure when teams decide what to patch first.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:42 pm
Risk-based triage is now the core patch governance control, not a reporting preference. A release of this size makes manual enumeration meaningless unless teams can rank by exploitability, exposure, and business criticality. That is a governance problem as much as an operations problem, because patch queues now decide where organisational risk is allowed to persist. Practitioners should treat triage logic as a standing control, not an emergency workaround.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- CrowdStrike's 2026 Global Threat Report said zero-days exploited before public disclosure rose 42% year over year.
A question worth separating out:
Q: How should security teams decide whether to trust a Patch Tuesday severity count?
A: Use the count as a workload indicator, not a decision rule. The better question is whether any item is known to be exploited, whether it is exposed to the internet, and whether it protects a critical identity or collaboration service. Those signals tell you what must move first.
👉 Read our full editorial: July 2026 Patch Tuesday shows why risk-based triage beats CVE counts