Mega Patch Tuesday: Microsoft fixes 3 zero-days

The July 2026 Patch Tuesday is going into the cybersecurity history books. In a volume never seen before, Microsoft shipped update packages covering a frankly frightening number of flaws — 622 vulnerabilities across its products, an absurd spike in the company’s historical curve of monthly patches.

But what matters to IT teams (and to attackers) isn’t the raw count of trivial bugs fixed. What’s flashing red in the threat reports are the three zero-days — flaws that were unknown and are already being actively exploited in real attacks — including a critical vulnerability at the heart of corporate infrastructure: Active Directory.

The highlights of the mega-patch

Of the 622 fixes released, 45 were classified as Critical, in most cases allowing Remote Code Execution (RCE) or Elevation of Privilege (EoP).

The most affected products include Windows itself, Microsoft Office, SQL Server and Azure components. Even so, defensive teams should be focused entirely on the three 0-day vulnerabilities already found in the wild.

1. The Active Directory nightmare (CVE-2026-56155)

This month’s most urgent flaw sits in Active Directory Federation Services (AD FS). The elevation-of-privilege and security-bypass vulnerability lets an unauthenticated attacker who manages to forge a specific ticket or exploit the AD FS endpoint escalate privileges until they take full control of the domain.

AD FS is frequently the backbone of hybrid Single Sign-On (SSO) in companies. Compromising AD FS means the attacker gets the “keys to the kingdom” to issue forged tokens, reaching on-premise and Azure cloud resources without needing to know a single password.

2. Windows MSHTML: code execution (CVE-2026-56157)

Although Microsoft has been trying to retire Internet Explorer for years, the old rendering engine, MSHTML, remains deeply embedded in Windows to render content inside other applications. The flaw lets an attacker craft a malicious Office document or web page and execute remote code without extensive user interaction. Active phishing campaigns have already been detected using it.

3. Win32k elevation of privilege (CVE-2026-56162)

The Windows window-subsystem driver (Win32k) is the system’s eternal Achilles heel. This new elevation-of-privilege vulnerability is the perfect complement for ransomware gangs. Once an attacker gains initial access to the machine (as an ordinary user), they exploit Win32k to obtain SYSTEM privileges, which lets them disable antivirus software and encrypt every disk.

The rollout challenge

Applying 622 fixes at once across thousands of servers and desktops is a logistical nightmare. The risk that a patch breaks some legacy software is inversely proportional to the urgency of closing the holes.

In a year when we still get flashbacks to the global outage caused by a CrowdStrike update in 2024, plenty of administrators hesitate. But the maths is unforgiving: CVE-2026-56155 in Active Directory is already being actively used by APT (Advanced Persistent Threat) groups.

The standard recommendation from cybersecurity agencies such as CISA is clear: apply the patches to Domain Controllers and AD FS servers within the next 48 hours. Test the desktop patches on pilot groups and proceed with the rollout as quickly as possible.

Postponing this particular update has stopped being “caution” and become an open invitation to intruders. Are your Active Directory servers already up to date today?