Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
Microsoft has released a record 622 security patches, including two zero-day vulnerabilities in SharePoint Server and Active Directory Federation Services that are already being exploited. The company has credited incident responders for discovering the flaws, which can b…
Intelligence analysis by Llama
Microsoft has released a record 622 security patches, including two zero-day vulnerabilities in SharePoint Server and Active Directory Federation Services. The company has credited incident responders for discovering the flaws, which can be exploited remotely without any user interaction.
Imagine you have a super important document that you keep in a safe place. But someone finds a way to break into the safe without a key, and they can get to the document. That's kind of like what's happening with the two zero-day vulnerabilities in SharePoint Server and Active Directory Federation Services. Microsoft is releasing a record 622 security patches to fix these flaws and prevent attackers from getting into the safe.
Analysis
A $60B Vote of Confidence
Microsoft's record-breaking Patch Tuesday release is a testament to the company's commitment to security. The 622 security patches address a wide range of vulnerabilities, including two zero-day flaws in SharePoint Server and Active Directory Federation Services. These flaws are particularly concerning because they can be exploited remotely without any user interaction.
The two zero-day vulnerabilities, CVE-2026-56164 and CVE-2026-56155, were discovered by incident responders and are already being exploited by attackers. The SharePoint Server flaw allows an unauthenticated attacker to escalate privileges over the network, while the Active Directory Federation Services flaw allows an already-authenticated attacker to elevate privileges locally through weak access controls.
Microsoft's advisory notes that enabling AMSI in Full Mode on the server blunts the attack on the SharePoint Server flaw. However, the company has not said how the flaws were exploited or by whom.
The release also includes a third zero-day vulnerability, CVE-2026-50661, which is a BitLocker bypass that requires physical access to the device. While this flaw is not as concerning as the other two, it is still an important patch to apply.
In addition to the zero-day vulnerabilities, the release includes a number of other security patches, including 416 for Windows, 82 for Office, and 46 for Microsoft Edge. The release also includes 27 security feature bypasses across Visual Studio, VS Code, and GitHub Copilot.
The order of the patches is important, particularly for the RC4 cleanup that can break logins. Microsoft has removed the RC4DefaultDisablementPhase rollback switch, which means that RC4 will only work for accounts explicitly configured to allow it. If any service account in your environment still requests RC4 Kerberos tickets, it can fail authentication the moment the update lands.
Overall, the release of these security patches is a significant development in the world of cybersecurity. It highlights the importance of staying up-to-date with the latest security fixes to prevent exploitation by attackers.
Key points
- Microsoft has released a record 622 security patches, including two zero-day vulnerabilities in SharePoint Server and Active Directory Federation Services.
- The two zero-day vulnerabilities can be exploited remotely without any user interaction.
- Microsoft has credited incident responders for discovering the flaws.
- The release includes a number of other security patches, including 416 for Windows, 82 for Office, and 46 for Microsoft Edge.
- The release also includes 27 security feature bypasses across Visual Studio, VS Code, and GitHub Copilot.
The release of these security patches is a positive development because it highlights Microsoft's commitment to security. The company is taking proactive steps to address vulnerabilities and prevent exploitation by attackers. This is a good sign for the future of cybersecurity.
The release of these security patches is a reminder that there are still many vulnerabilities in software that need to be addressed. The two zero-day vulnerabilities in SharePoint Server and Active Directory Federation Services are particularly concerning because they can be exploited remotely without any user interaction. This highlights the importance of staying up-to-date with the latest security fixes to prevent exploitation by attackers.
