2026 · JUL 15 · Patch Management
July Patch Tuesday
Microsoft's July 2026 Patch Tuesday ships 570 fixes and 59 critical flaws, including three zero-days, a mandatory AD FS patch and a permanent Kerberos RC4 sunset for domain controllers.
By Vishal Vashisht
July 2026 Patch Tuesday Breakdown
Scale & Severity
Microsoft released fixes for 570 vulnerabilities this month, including 59 critical flaws, a record-breaking release that dominates the standard 200-300 range most months have settled into. Of the critical issues, 48 are remote code execution, with the remainder spread across elevation of privilege, security feature bypass, and spoofing categories.
The volume reflects Microsoft's deployment of multi-model agentic scanning harness (MDASH) to identify vulnerabilities faster. Expect this cadence to persist: Microsoft has signalled that monthly releases of this magnitude are now normal.
Three Zero-Days
Two are actively exploited in the wild; one is publicly disclosed:
CVE-2026-56155 (Active Directory Federation Services EoP)
An authorized attacker can exploit insufficient access control granularity in AD FS to elevate privileges locally and gain administrative access. This is being weaponised. CISA added this to its Known Exploited Vulnerabilities Catalog with a mandatory patch deadline of 28 July 2026.
CVE-2026-50661 (Windows BitLocker Bypass)
A publicly disclosed flaw allowing attackers with physical access to bypass BitLocker Device Encryption and access encrypted data. The attack surface is laptops and servers removed from secure premises. Exploitation requires physical access but no authentication, which is significant for organisations tracking lost or stolen devices.
The Third
Less detail is public, but appears to be a lower-severity disclosure.
Priority Impact Areas
Organisations running Exchange Server, SharePoint Server, SQL Server, DHCP Server, and Hyper-V should prioritise this month's updates due to concentrations of critical network-exploitable flaws in those roles.
Critical Architecture Changes
Kerberos RC4 Sunset
The July update permanently removes the RC4DefaultDisablementPhase rollback control from all supported Windows Server domain controllers. This is the safety valve organisations have used since January 2026. If you haven't audited Kerberos RC4 usage, do so immediately before patching, because Windows generates AES keys automatically on password change, but authentication will fail for any legacy service accounts still bound to RC4.
RDP Certificate Migration
SHA-1 certificate thumbprint support is being retained for backward compatibility but SHA-2 is now mandatory for new deployments, with SHA-1 planned for future removal.
TDI Transport Registration Enforcement
A security hardening change now enforces TDI transport registration requirements, which means applications using sockets over unregistered third-party TDI transports will break after installation. Inventory your network appliances, printers, and legacy systems before rolling out.
Windows Versions & Build Numbers
Windows 11 25H2 updates to build 26200.8875; Windows 11 24H2 to 26100.8875; Windows 11 23H2 to 22631.7376.
Windows 10 updates to build 19045.7548 (consumer) and 19044.7548 (Enterprise LTSC 2021).
Features Bundled In
Point-in-time restore reaches broad rollout in Windows 11, allowing rollback to automatic snapshots from the last 72 hours. Not essential security-wise, but useful for recovery testing post-patch.
Deployment Order
Don't treat this as a standard rollout. Priority sequence: audit Kerberos RC4 first (via Windows Event Viewer), patch service accounts before cumulative updates, apply Windows Update, verify the July 9 emergency patch (CVE-2026-50656, RoguePlanet) is already installed on Defender-heavy environments. The researcher Nightmare-Eclipse has been dropping zero-days steadily, so stay alert on MSRC feeds throughout deployment.