Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Summary: Microsoft released its largest Patch Tuesday on record, covering 622 of its own CVEs by its Security Update Guide count, more than triple June's previous high of around 200. Two of the fixes address flaws already under attack: CVE-2026-56164, an unauthenticated network privilege-escalation bug in on-premises SharePoint Server credited to Mandiant and Google's FLARE team, and CVE-2026-56155, a local privilege-escalation flaw in Active Directory Federation Services credited to Microsoft's DART unit.
Key Takeaway: Neither exploited bug is a headline critical, and Microsoft rates the SharePoint flaw fairly low on severity, yet both are already in use and neither is on CISA's KEV catalog as of this writing. The same day, SharePoint Server 2016 and 2019 reach end of extended support with no paid ESU program to fall back on.