622 CVEs in One Day: The 4 July 2026 Patch Tuesday Fixes Houston Businesses Must Install First

Before the triage, understand why the number exploded, because it tells you what the next twelve months look like.

Microsoft has attributed a large share of the July volume to its own AI-driven vulnerability discovery work, specifically a multi-model agentic scanning harness the company refers to as MDASH, which is now continuously auditing Microsoft's own codebase. In plain English: Microsoft pointed AI at Windows and it found an enormous number of latent bugs, faster than human researchers ever could.

That is genuinely good news for defenders in the long run. In the short run it means the era of the light 40-CVE Patch Tuesday is over. Vulnerability volume is now a throughput problem, and any patching process that depends on a human reading release notes each month will fall behind permanently. The breakdown for July was 254 elevation-of-privilege flaws, 145 remote code execution flaws, 102 information disclosure, 35 denial of service, 17 security feature bypasses and 16 spoofing bugs.

You cannot patch 600 things thoughtfully. You can patch four things immediately and let an automated ring-based process handle the rest. Here are the four.

CVE-2026-56164 is a missing-authentication flaw (CWE-306) in on-premises SharePoint Server affecting SharePoint Enterprise Server 2016, SharePoint Server 2019 and Subscription Edition. It requires no credentials, no user interaction, and it is reachable over the network. Microsoft confirmed it was exploited in the wild as a zero-day before the patch existed.

The discovery credit tells you how serious this is. Microsoft credited Jayson Frost of Mandiant, Genwei Jiang of Google Cloud, the FLARE OTF team, and an anonymous researcher. Translation: this was not found in a quiet lab exercise. Incident-response people were involved.

CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on July 14, the same day the patch shipped, as one of four KEV additions that day. The catalog due date for federal civilian agencies was July 17. Three days.

Here is the part that trips people up. Microsoft, as the CNA, assigned CVE-2026-56164 a CVSS 3.1 base score of 5.3, which reads as "Medium." The National Vulnerability Database independently scored the same bug at 9.8 Critical. If your patching process filters on "Critical and High only," a pre-authentication, actively exploited SharePoint bug just sailed straight past your queue with a Medium label.

Two more things make this worse for on-premises shops. SharePoint Server 2016 and 2019 reached end of extended support on July 14, 2026, the same day the patch shipped, with no Extended Security Updates pathway announced, so this is close to the last free ride. And Rapid7 separately disclosed CVE-2026-55040, a critical SharePoint authentication bypass that can be chained with a second, embargoed flaw for unauthenticated remote code execution, patched in the same release.

If you still run SharePoint on a server in your own building, and plenty of Houston engineering, energy services and legal firms do because of document-heavy workflows, this is your emergency. Microsoft's interim mitigation is enabling AMSI integration with Request Body Scan set to Full mode, which can block known exploit payloads. That buys you hours, not safety. Patch it.

CVE-2026-56155 AD FS Elevation of Privilege: A Foothold Becomes Domain Control

CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services caused by insufficient granularity of access control. It carries a CVSS 7.8 and was exploited in the wild as a zero-day. The specific weakness sits in permissions on the AD FS Distributed Key Manager container, which holds the symmetric key material protecting AD FS token-signing and token-decryption certificate private keys. Microsoft credited its own Detection and Response Team (DART), which again means it surfaced during real incident response. Eight additional Important-rated AD FS vulnerabilities shipped alongside it.

CISA added CVE-2026-56155 to KEV on July 14 with a due date of July 28.

Why this matters for a mid-sized Texas business: AD FS is what a lot of companies still use to federate single sign-on into Microsoft 365. It is the trust bridge between your on-premises identity and your cloud tenant, and the keys this bug exposes are the ones that sign the tokens your tenant trusts. An attacker who gets any low-privilege foothold, one phished user, one unpatched workstation, can use this to elevate, and from there your Microsoft 365 tenant is downstream of a system they control. If you are still running AD FS rather than modern cloud authentication, this bug is a strong argument for finally retiring it. Our Microsoft 365 managed services team sees federated legacy AD FS deployments regularly, and they are almost always the oldest, least-monitored server in the rack.

CVE-2026-50661 BitLocker Bypass: Your Stolen Laptop Is Not Encrypted

CVE-2026-50661 is a Windows BitLocker security feature bypass, publicly disclosed before the patch though not confirmed as exploited at release. Microsoft rates exploitation "Less Likely" and the CVSS sits at 6.1, because it requires physical access to the machine.

Read that again: it requires physical access. That is a low bar in the real world. The default BitLocker configuration on most business laptops uses TPM-only authentication, where the TPM releases the Volume Master Key automatically during pre-boot with no second factor. The flaw is a protection mechanism failure in that workflow, which means an attacker with hands on the device can reach data on the system drive.

This is a Houston problem specifically. Field crews, inspection techs, project managers on construction sites, energy services staff working out of trucks along the I-10 corridor and up 45 toward Conroe. Laptops get stolen out of truck cabs and job trailers constantly, and the standard response has always been "it's fine, it's BitLocker encrypted." Until this patch is deployed, that sentence is not reliably true. The fix ships in the July 14, 2026 cumulative updates for supported Windows client and server releases. Fleet-wide enforcement of the update, plus consideration of a BitLocker PIN or startup key on high-risk mobile devices, is the right response, and it is exactly the kind of policy that Intune device management exists to enforce.

CVE-2026-50661 Aside: The CVSS 9.6 Copilot Command Injection

The fourth is the sleeper. CVE-2026-48561 is a command injection flaw (CWE-77) affecting Microsoft 365 Copilot for iOS and Android, published July 14, 2026 with a CVSS score of 9.6. A malicious website could cause Microsoft Edge for Android to fire crafted prompts at Copilot, and the affected component acted on them without confirming intent or validating where they came from. The result is unintended Copilot actions, including reading or changing data the user has access to.

Nobody clicked "install malware." Somebody visited a webpage. As AI assistants get wired into mail, files and Teams, prompt-injection stops being a research curiosity and becomes a data-access problem. Mobile app updates are the fix here, which means your mobile device management posture is now part of your patch program, not separate from it.

The single most useful lesson from the July 2026 Patch Tuesday is the CVSS 5.3 versus KEV contradiction on the SharePoint bug. A "Medium" vendor score sat on a vulnerability that federal agencies were given three days to fix.

CVSS measures theoretical impact. KEV measures whether criminals are actually using it right now. For a small business with limited change windows, exploitation status is the far better prioritization signal. A boring 5.3 that is being weaponized today is more dangerous to you than a beautiful 9.8 that nobody has figured out how to trigger.

The federal rulebook changed recently in a way worth borrowing. CISA issued Binding Operational Directive 26-04 on June 10, 2026, superseding BOD 22-01 and BOD 19-02. It replaces flat KEV deadlines with a risk-tiered model built on four variables: whether the asset is publicly exposed, whether the flaw is in KEV, whether the exploit can be automated, and what an attacker achieves after exploitation. Remediation windows run from 3 to 60 days, and the most dangerous tier carries a 72-hour clock plus forensic triage to check whether you were already hit.

You are not a federal agency, so BOD 26-04 does not legally bind you. But if you carry cyber insurance, hold contracts with energy majors or the Texas Medical Center, or are working toward a compliance framework, "we patch KEV entries within X days" is the control that auditors and underwriters actually ask about. Build your program around KEV and you will pass most of the questions you get asked.

A 600-CVE month cannot be hand-patched. If your current process is "Windows Update is on and we hope," here is what an actual program contains.

• Ring-based deployment. A pilot ring of 5 to 10 tolerant users takes updates first, a broad ring follows 3 to 5 days later, and critical servers get a defined window after that. This catches the bad update before it hits the whole company.
• A KEV-driven emergency lane. Anything on the CISA KEV catalog or confirmed exploited jumps the queue and ships in days, not at the next quarterly maintenance weekend. Two of July's four priorities qualified.
• Reboot compliance reporting. Most "patched" fleets are not patched. The update downloaded, the machine never rebooted, and the fix is not active. If your reporting cannot show you which machines are pending reboot and for how long, your compliance number is fiction.
• Coverage for the two machines nobody touches. The owner's laptop, which never reboots because there are 60 tabs open, and the one line-of-business server that "can't go down." Those are the two systems that end up in the incident report.
• An end-of-life inventory. SharePoint Server 2016 and 2019 went out of extended support on July 14, 2026. A patch you cannot get is not a patching problem, it is a migration project, and it needs a date on a calendar.
• Third-party and firmware coverage. Adobe, Java, browsers, VPN clients and NAS firmware are not in Windows Update, and attackers know it.
• Detection behind the patching. Zero-days are, by definition, exploited before a patch exists. Monitored endpoint detection is what covers the gap between exploitation and Patch Tuesday. See our endpoint security services for how automated 24/7 monitoring backstops the patch cycle.

Managed Patching SLA Texas Businesses Should Demand

If you are evaluating an IT provider, the patching SLA is where you find out whether they run a program or run a script. Ask for specifics in writing:

• Standard Microsoft updates deployed within a stated number of days of release, by ring.
• KEV-listed and actively exploited CVEs deployed on an emergency timeline measured in days.
• A monthly compliance report showing percentage patched, percentage pending reboot, and named exceptions with a reason.
• Explicit coverage for servers, laptops, mobile devices and third-party applications, not just Windows.
• A documented rollback plan for when an update breaks a line-of-business application.

Across the Texas market, managed IT with patching, monitoring and endpoint protection bundled commonly falls somewhere in the range of roughly $100 to $250 per user per month depending on scope, compliance requirements and how much legacy infrastructure is in play. That is a general market observation, not a quote. Pricing varies widely by provider and environment, so get the SLA in writing before you compare numbers. A cheaper contract with a vague patching clause is not cheaper.

How many CVEs were in the July 2026 Patch Tuesday?

Microsoft issued fixes for approximately 569 to 570 CVEs of its own, with the total reaching roughly 621 to 622 when bundled and third-party components are counted. Trackers put the Critical count between 56 and 59, and there were three zero-days: two actively exploited and one publicly disclosed. It is the largest Patch Tuesday in Microsoft's history, following June 2026's previous record of 206.

Which July 2026 vulnerabilities are on the CISA KEV catalog?

CVE-2026-56164 (SharePoint Server) and CVE-2026-56155 (AD FS) were both added to CISA's Known Exploited Vulnerabilities catalog on July 14, 2026, the day the patches shipped, as part of a batch of four additions. The SharePoint entry carried a July 17 due date for federal agencies and the AD FS entry a July 28 date.

Do I need to worry about the SharePoint bug if I use SharePoint Online?

No. CVE-2026-56164 affects on-premises SharePoint Enterprise Server 2016, SharePoint Server 2019 and Subscription Edition. Microsoft 365 SharePoint Online is not in scope. If you are unsure which you run, the giveaway is whether there is a physical or virtual SharePoint server in your environment.

Is BitLocker still safe after CVE-2026-50661?

Yes, once the July 14, 2026 cumulative update is installed. The flaw allows an attacker with physical access to bypass BitLocker under default TPM-only configurations, and Microsoft rates exploitation "Less Likely" at CVSS 6.1. Until the update is deployed and the machine has rebooted, treat a lost or stolen laptop as potentially readable, and follow your normal data breach assessment process.

How fast should a small business patch actively exploited vulnerabilities?

Days, not weeks. Under BOD 26-04, CISA gives federal agencies as little as 72 hours for the highest-risk tier. A practical private-sector target is 72 hours for KEV-listed and confirmed-exploited flaws on internet-facing systems, and 7 to 14 days for standard monthly updates deployed through a pilot ring first.

If July's 622-CVE release made you realize nobody can actually tell you what percentage of your fleet is patched and rebooted right now, that is the finding, and it is a common one. LayerLogix runs ring-based patching, KEV-driven emergency deployment and monthly compliance reporting for businesses across Houston, The Woodlands, Katy and the surrounding metro, with local Texas-based support and more than 20 years of experience behind it. Talk to our team about managed IT services in Houston, or reach out through Houston IT support for a straight answer on where your fleet stands before the next record-setting Patch Tuesday.