Notifications
Clear all
Topic starter
18/08/2026 2:36 pm
TL;DR: Microsoft’s July 2026 Patch Tuesday includes 570 CVEs, three zero-days, and 143 remote code execution issues, with 34% of those rated Critical, according to Expel. The volume reinforces that patch triage must be risk-led, because exposure windows and privilege paths matter more than raw fix counts.
NHIMG editorial — based on content published by Expel: Microsoft Patch Tuesday analysis for July 2026
By the numbers:
- Microsoft’s July 2026 Patch Tuesday includes 570 CVEs, including three zero-day vulnerabilities.
- There are 143 remote code execution CVEs in this release, and 34% of them are rated Critical.
Questions worth separating out
A: Prioritise the systems that broker trust first, especially domain controllers, authentication proxies, and cloud runtime components that can expand a single exploit into tenant-wide access.
Q: Why do Microsoft server vulnerabilities create identity risk even when they are not IAM bugs?
A: Because many Microsoft services sit on the path that users and workloads use to prove identity, exchange trust, or obtain privileged access.
Q: What do teams get wrong about remote code execution on enterprise servers?
A: They often treat it as a single-host issue instead of a potential trust-boundary breach.
Practitioner guidance
- Rank identity-adjacent zero-days first Place AD FS, Exchange, SharePoint, and any federation-connected systems at the top of emergency remediation queues when a zero-day can affect privilege, authentication, or spoofing.
- Separate local, physical, and remote exploit paths Do not treat a physical-access bypass like a remote execution issue, but still time its remediation based on endpoint exposure and user mobility patterns.
- Map every critical Microsoft service to a trust function Document whether each system brokers identity, stores sensitive content, relays email, or exposes collaboration workflows so patch priority reflects business trust impact.
What's in the full analysis
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Per-CVE breakdown of the three zero-days and the affected Windows versions
- Exploitability notes for the actively exploited AD FS and SharePoint issues
- Remediation guidance for BitLocker, Exchange, and the subscription server editions
- Vendor-specific patching considerations that help translate triage into change windows
👉 Read Expel's analysis of Microsoft Patch Tuesday's zero-days and CVE priorities →
Patch Tuesday’s 570 CVEs and zero-days: what should teams prioritise?
Explore further
18/08/2026 3:21 pm
Patch volume only becomes meaningful when it is mapped to identity impact. A release with 570 CVEs is a workload problem, but the real security problem is which flaws can alter trust, privilege, or authentication outcomes. AD FS, Exchange, and SharePoint are not ordinary workloads when they sit in the access path. Practitioners should classify patch urgency by whether a system can reshape identity decisions.
A few things that frame the scale:
- From our research: 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Our research also shows that only 5.7% of organisations have full visibility into their service accounts, which leaves identity-linked blast radius hard to contain.
A question worth separating out:
Q: Who is accountable when exploited Microsoft vulnerabilities affect authentication or privilege?
A: Accountability usually sits across platform, infrastructure, and identity teams because the failure spans patching, privilege control, and trust architecture. Security leadership should assign ownership for emergency remediation, post-exploitation review, and federation integrity checks before the next maintenance cycle closes.
👉 Read our full editorial: Microsoft Patch Tuesday exposes 570 CVEs and three zero-days
