Patch Tuesday July 2026: what should teams patch first now?

TL;DR: Microsoft’s July 2026 Patch Tuesday includes 570 CVEs, two already exploited zero-days, and several high-risk Windows and SharePoint flaws that turn endpoint patching into an identity, access, and configuration problem as much as a vulnerability one, according to Automox. Patch order should follow exploitability and privilege impact, not CVSS alone.

Editorial analysis by NHI Mgmt Group, based on content published by Automox: “570 CVEs, two exploited zero-days, and the network bugs to patch tonight”.

Key questions

Q: What breaks when an exploited identity system flaw is left in the patch queue?

A: When an exploited flaw sits in ADFS or a similar identity tier, the issue is no longer just a host compromise.

Q: Why do active exploitation and identity-layer impact matter more than CVSS in patch prioritisation?

A: CVSS scores measure technical severity, but they do not show whether attackers are already using a flaw or whether the vulnerable system sits on a trust path.

Q: What are the signs that client-side protocol exposure is being underestimated?

A: The clearest signs are patch queues that focus on servers while ignoring clients, unmanaged devices that still participate in the protocol, and traffic that can be redirected to unexpected internal sources.

Practitioner guidance

• Prioritise active-exploitation patches first Move exploited identity and collaboration-system flaws ahead of higher-scoring but unexploited issues.
• Treat ADFS and SharePoint as tier-zero assets Review who can reach identity and collaboration infrastructure locally, and separate those systems from normal application patch workflows.
• Patch every endpoint, not just servers Include DHCP clients, unmanaged laptops, and BYOD endpoints in the same remediation pass.

Bottom line: This Patch Tuesday shows that exploited flaws in identity and collaboration systems can matter more than higher-scoring but unexploited bugs.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →