Stay ahead of critical vulnerabilities with our breakdown of this month's Microsoft security patches.
Release Date: Tuesday, July 14, 2026
Release Time: 10:00 AM PST / 1:00 PM EST / 6:00 PM UTC
Status: Released
Last Updated: July 14, 2026
Microsoft has released its July 2026 Patch Tuesday security updates, addressing 621 unique Microsoft CVEs with 1,149 total vulnerabilities when including updates to existing CVEs and related entries. This is the largest single Patch Tuesday release in 2026, significantly exceeding June's 200-vulnerability record.
Release Statistics:
Critical Vulnerabilities Requiring Immediate Attention:
IMMEDIATE ACTIONS REQUIRED:
The July 2026 Patch Tuesday release represents unprecedented scale in Microsoft's monthly security updates:
Volume Context:
The distinction between 621 unique CVEs and 1,149 total vulnerabilities reflects how Microsoft tracks security issues:
Microsoft categorized all 621 CVEs by severity:
Critical-Severity: 62 CVEs (10.0%)
Important-Severity: 552 CVEs (88.9%)
Moderate-Severity: 6 CVEs (0.97%)
Low-Severity: 1 CVE (0.16%)
The high proportion of critical-severity vulnerabilities (62 out of 621) means organizations cannot selectively patch. Nearly 10% of this release requires emergency deployment attention.
Severity: Critical
Component: Windows BitLocker Drive Encryption
Impact: Security Feature Bypass allowing unauthorized access to encrypted data
Affected Systems: Windows systems using BitLocker encryption
Deployment Priority: CRITICAL
Organizations using BitLocker for full-disk or data encryption must deploy CVE-2026-50661 within 24-48 hours. This vulnerability affects the security guarantees of encrypted systems and requires immediate remediation.
Action Items:
Severity: Critical
Component: Active Directory Federation Services (ADFS)
Impact: Elevation of Privilege allowing attackers to gain higher privileges within ADFS environments
Affected Systems: Organizations running ADFS (on-premises or hybrid environments)
Deployment Priority: CRITICAL for Organizations Using ADFS
Active Directory Federation Services handles authentication and authorization in hybrid cloud scenarios. This elevation of privilege vulnerability requires immediate patching for organizations using ADFS.
Action Items:
Severity: Critical
Component: Microsoft SharePoint Server
Impact: Elevation of Privilege within SharePoint environments
Affected Systems: Organizations running SharePoint Server (2016, 2019, on-premises)
Deployment Priority: CRITICAL for SharePoint Environments
Microsoft SharePoint Server stores critical business documents and data. An elevation of privilege vulnerability allows attackers to gain unauthorized access. Organizations running SharePoint Server must deploy this patch within 24-48 hours.
Action Items:
July 14, 2026 marks the effective enforcement date for Kerberos RC4 hardening Phase 2. As of this release:
Organizations that did not complete RC4 remediation before July 14 are now experiencing:
Authentication Failures:
Event Logging:
If You're Experiencing Authentication Failures:
# Query domain controller for RC4 authentication failures
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4771} |
Where-Object {$_.Message -match 'Encryption type'} |
Select-Object TimeCreated, @{Name='System';Expression={$_.Properties[0].Value}} |
Sort-Object TimeCreated -Descending
Determine remediation approach for each affected system:
Implement temporary RC4 fallback only if necessary:
# Temporarily enable RC4 support (emergency only, maximum 30 days)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" `
-Name "SupportedEncryptionTypes" -Value 31
# Value 31 enables: AES256_HMAC_SHA1, AES128_HMAC_SHA1, RC4_HMAC, DES_CBC_MD5, DES_CBC_CRC
Important: Temporary RC4 fallback is an emergency measure only. Permanent solution requires upgrading affected systems.
July 2026 patches affect nearly the entire Microsoft product portfolio:
Hours 0-4 (Immediate):
Hours 4-12 (Pilot Deployment):
Hours 12-24 (Wave 1 Production):
Hours 24-48 (Wave 2 Production):
Days 2-7:
Days 8-14:
Before deploying July patches to production, validate:
System Functionality:
BitLocker Validation (for CVE-2026-50661):
manage-bde.exe -statusADFS/SharePoint Validation (for CVE-2026-56155):
Application Compatibility:
Kerberos and Authentication:
Performance Verification:
Coordinate with third-party updates released concurrently with Microsoft Patch Tuesday:
July 2026 Patch Tuesday establishes a new record with 621 unique Microsoft CVEs and 1,149 total vulnerabilities. The 62 critical-severity flaws, including CVE-2026-50661 (BitLocker bypass) and CVE-2026-56155 (ADFS/SharePoint EoP), require aggressive, immediate deployment.
Critical Action Items:
The Bottom Line:
July 2026 Patch Tuesday is the largest security release of the year, requiring maximum organizational resources and commitment. The critical vulnerabilities affecting BitLocker encryption and ADFS/SharePoint authentication demand immediate deployment priority. However, the 552 Important-severity patches cannot be overlooked and must be systematically deployed across the enterprise within 1-2 weeks.
Organizations should treat this release with the urgency it deserves while implementing systematic, tested deployment procedures to ensure comprehensive coverage and minimize operational disruption.
For comprehensive endpoint management and automated patch deployment with vulnerability scanning and compliance reporting, explore Zecurit Endpoint Manager.
Below is a detailed list of the security patches and CVEs released in this month's Patch. This information is fetched directly from the Microsoft Security Response Center (MSRC) to help you stay protected with the latest patches.
Patch Tuesday is the second Tuesday of each month when Microsoft releases its regular updates for Windows operating systems and other Microsoft products. These updates typically include security patches, bug fixes, and sometimes feature improvements.
Patch Tuesday is crucial for maintaining the security and stability of systems. The updates often address vulnerabilities that could be exploited by attackers, and keeping systems up to date helps protect against these risks.
Microsoft releases Patch Tuesday updates on their website and through Windows Update. For detailed patch notes, you can refer to Microsoft's Security Update Guide or subscribe to update notifications from your device or trusted sources like security blogs.
Yes, you can manually download and install updates through Windows Update, or directly from the Microsoft Update Catalog website, which offers patches for individual downloads.
It’s highly recommended to install all security updates to ensure your system remains protected from known vulnerabilities. However, non-security updates or feature updates might be optional based on your needs.
If you miss a Patch Tuesday update, it’s important to install the updates as soon as possible to avoid potential security risks. Microsoft allows you to download and install any missed updates through Windows Update.
For businesses or IT administrators, you can use Windows Server Update Services (WSUS), System Center Configuration Manager (SCCM), or third-party patch management tools to schedule, approve, and distribute updates across multiple systems.
Not all updates are critical. Patch Tuesday updates include a range of fixes, from critical security patches to optional non-security updates. It’s important to assess which updates are most relevant to your environment.
Failing to apply updates can leave your system vulnerable to exploits and attacks. Many of the updates address critical security flaws that cybercriminals may target, so staying updated is vital for system security.
