{"id":692262,"date":"2026-07-15T03:02:10","date_gmt":"2026-07-15T03:02:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/692262\/"},"modified":"2026-07-15T03:02:10","modified_gmt":"2026-07-15T03:02:10","slug":"patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/692262\/","title":{"rendered":"Patchpocalypse Now: Microsoft tops last month’s record with 622 Patch Tuesday CVEs"},"content":{"rendered":"

Remember last month when we were awed by Microsoft\u2019s record-setting Patch Tuesday<\/a> that addressed 206 CVEs? That was a quaint era compared to this month: Redmond just rolled out patches for 622 CVEs specific to its products, slightly more than tripling last month\u2019s all-time high.<\/p>\n

Redmond\u2019s Patch Tuesday release<\/a> is once again one for the record books, with everything under the sun getting some security fixes \u2013 including 428 non-Microsoft Chromium CVEs affecting Edge that aren\u2019t included in that 622 count. Fifty-eight of those are critical, two are under active exploit, and one has already been publicly disclosed, meaning it could join those other two in short order.<\/p>\n

There is a lot to dig through, and we can hardly cover the whole gamut given the size of this release. As we noted last month, there was concern in the infosec community that AI-enabled bug hunting<\/a> might mean massive patch volumes are the new normal<\/a>. Microsoft didn\u2019t disclose how much AI may have contributed to the massive patch list this month, but given the volume it\u2019s safe to say human contributors probably had some assistance.\u00a0<\/p>\n

Microsoft\u2019s massive month<\/p>\n

To start, let\u2019s cover the pair of actively exploited issues that Microsoft patched.\u00a0<\/p>\n

The first, CVE-2026-56155<\/a>, is an Active Directory Federation Services elevation of privilege vulnerability. Attackers who exploit the issue, which Microsoft only described as being due to \u201cinsufficient granularity of access control on ADFS,\u201d could gain administrator privileges. They do need to have access already and be local, however, which is why this is only rated with a CVSS score of 7.8.\u00a0<\/p>\n

The second actively exploited vulnerability, CVE-2026-56164<\/a>, is another privilege elevation issue, this time in Microsoft SharePoint. SharePoint is apparently missing authentication for a critical function, which could let an unauthorized attacker on a network elevate their SharePoint permissions. As with the other issue under exploit, this one is somewhat limited, earning it a CVSS of just 5.3.\u00a0<\/p>\n

With both under active exploitation, that score doesn\u2019t matter as much as eliminating the vulnerability through good patch management, however.\u00a0<\/p>\n

As for the publicly reported but not-yet-exploited issue, CVE-2026-50661<\/a>, that involves BitLocker being able to have its security measures physically bypassed by anyone with local access to a BitLocker-secured machine.\u00a0<\/p>\n

Now let\u2019s round up a few of those 58 critical issues.<\/p>\n

Everyone\u2019s favorite untrustworthy AI<\/a> is packing a CVSS 9.6 remote code execution vulnerability. CVE-2026-48561<\/a> finds Copilot improperly neutralizing its input, allowing an unauthorized attacker to execute code with nothing but low-privileged Hyper-V guest access. Exploiting the vulnerability can be done without user awareness by, for example, hosting a malicious website that prompts the many embedded Copilot features<\/a> of Windows machines to process a prompt upon landing on the page.\u00a0<\/p>\n

Microsoft Exchange is suffering from a CVSS 9.6 spoofing vuln due to failure to neutralize input, leading to cross-site scripting being possible from within a maliciously crafted email. CVE-2026-55008<\/a> allows an unauthorized attacker to perform spoofing over a network by sending said malicious email to a target, allowing arbitrary JavaScript execution.<\/p>\n

Finally, we\u2019re not picking out one vulnerability for your third notice in this massive list, but are highlighting a full 16 remote code execution vulnerabilities in Microsoft Office and its associated applications. They\u2019re caused by a variety of issues in the Office suite, like heap-based buffer overflow and use after free vulns, and all are scored around a CVSS 7.8.\u00a0<\/p>\n

Needless to say, we recommend following Microsoft\u2019s advice and getting all those hundreds of security patches installed ASAP.\u00a0<\/p>\n

Adobe throws mud at critical issues in multiple products<\/p>\n

Microsoft tends to command the headlines on Patch Tuesday (it\u2019s hard not to when you address more than 600 CVEs in a single day), but Adobe released a bunch of patches across its ecosystem too, 64 unique CVEs across seven bulletins for Commerce<\/a>, Experience Manager<\/a>, Creative Cloud Desktop<\/a>, Illustrator<\/a>, Content Credentials SDK<\/a>, ColdFusion<\/a>, and Animate<\/a>. Every one of the bulletins included at least a couple of critical CVEs.\u00a0<\/p>\n

The highest-severity issue among Adobe\u2019s many Patch Tuesday entries comes in the form of a CVSS 9.9 path traversal vulnerability in ColdFusion that can allow arbitrary code execution. CVE-2026-48318 does not yet appear in online CVE directories, but even with limited information, we\u2019d say a 9.9-level issue is one you want to address with a quickness.\u00a0<\/p>\n

The second-worst issue that Adobe addressed today is in its Commerce suite. CVE-2026-48356 is a CVSS 9.6 privilege escalation vulnerability that an attacker can trigger thanks to Commerce failing to restrict the upload of dangerous file types.<\/p>\n

Adobe Experience Manager also includes a pair of CVSS 9.6 issues (CVE-2026-48259 and CVE-2026-48359). Both allow arbitrary code execution: one because of a server-side request forgery vulnerability, and the other because of improper restriction of XML external entity references.<\/p>\n

Other notable Patch Tuesday releases<\/p>\n

Broadcom addressed seven CVEs<\/a> in its Avi Load Balancer today, which it rates from 7.1 to 9.8 on the CVSS scale. The vulnerabilities include authentication bypass, RCE, privilege escalation, and directory traversal.\u00a0<\/p>\n

SAP published<\/a> 16 security updates and one GitHub advisory today; nine of those updates have a CVSS score of 8.1 or higher. CVE-2026-44747<\/a>\u00a0(CVSS 9.9) is a memory corruption issue in SAP NetWeaver Application Server ABAP that could allow an authenticated attacker to gain unauthorized access to system data; CVE-2026-27690<\/a>, CVSS 9.1, would let an unauthenticated attacker smuggle an HTTP request through SAP Approuter leading to system unavailability; and CVE-2026-44761, CVSS 9.1, involves the retention of a sample OAuth2 client in SAP Commerce Cloud that isn\u2019t documented and, if known, could let an attacker break in.\u00a0<\/p>\n

Let\u2019s hope August is a bit quieter, though, given the fact the past two months have set consecutive records for the number of vulnerabilities Microsoft patched; we have our doubts. Godspeed, sysadmins and security teams. \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"Remember last month when we were awed by Microsoft\u2019s record-setting Patch Tuesday that addressed 206 CVEs? That was…\n","protected":false},"author":2,"featured_media":692263,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[59,86,56,54,55],"class_list":["post-692262","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-gb","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/692262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=692262"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/692262\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/692263"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=692262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=692262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=692262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}