Microsoft’s Record 622-CVE Patch Tuesday Targets Two Critical Identity Flaws

Microsoft shipped its largest Patch Tuesday on record this month, covering 622 CVEs by the company’s own Security Update Guide count, more than triple June’s previous high of roughly 200. Two of the fixes close holes attackers are already exploiting, both elevation-of-privilege flaws in identity and collaboration infrastructure that matter considerably more than their technical severity scores suggest. The record patch volume lands the same week the EU and UK announced coordinated sanctions against Russian intelligence operators following a winter hack of the Polish energy grid, and as Oracle faces an investor lawsuit over its projected cloud sales to OpenAI.

The Two Zero-Days That Actually Matter Most

Despite the record 622-CVE volume, Microsoft and security researchers are specifically flagging two vulnerabilities as immediate priorities: CVE-2026-56164, an elevation-of-privilege flaw in on-premises SharePoint Server, and CVE-2026-56155, an elevation-of-privilege flaw in Active Directory Federation Services. Neither carries the flashy remote-code-execution critical rating that typically dominates patch-day headlines, but both sit in systems that matter more than their scores suggest: SharePoint is where the company document store lives, and ADFS is the box that signs organizational logins.

• CVE-2026-56164 lets an unauthenticated attacker escalate privileges over the network — against a SharePoint Server deployment, meaning an attacker does not need valid credentials to begin the attack chain
• CVE-2026-56155 targets the identity signing infrastructure itself — a successful compromise of ADFS specifically threatens the trust anchor that validates logins across an entire federated identity environment, potentially far beyond a single application
• Microsoft credits incident responders for both discoveries — meaning these flaws were identified through active exploitation investigations rather than proactive research, confirming genuine in-the-wild attacker use before the patches existed

Organizations running on-premises SharePoint Server or Active Directory Federation Services should treat these two specific CVEs as the highest priority within this month’s massive patch release, given confirmed active exploitation and the outsized blast radius a compromise of either identity or document-store infrastructure carries relative to more conventional application-level vulnerabilities.

EU and UK Sanction Russian Intelligence Over Polish Grid Hack

A winter Russian intelligence hack of the Polish energy grid, combined with a protracted cyberespionage campaign, has triggered coordinated sanctions against Moscow’s intelligence apparatus, announced jointly by the European Union and the United Kingdom. Critical infrastructure attacks targeting European energy grids specifically carry genuine geopolitical weight beyond the immediate technical compromise, given how directly energy grid reliability ties into broader European security and economic stability concerns, particularly amid the ongoing energy market volatility already stemming from the Iran conflict.

Oracle Faces Investor Lawsuit Over OpenAI Cloud Sales Projections

Oracle is facing an investor lawsuit specifically challenging the company’s projected cloud sales figures tied to frontier AI lab OpenAI, adding a genuinely new legal dimension to the broader wave of AI infrastructure investment scrutiny already visible in Treasury’s systemic risk characterization and the elevated margin debt levels covered this week. Lawsuits challenging specific AI-related revenue projections represent a meaningful escalation beyond general market skepticism, since they put a concrete legal test behind whether companies have been appropriately conservative or genuinely misleading in how they characterize AI-driven revenue expectations to investors.

LabubaRAT Confirmed as Rust-Based, Multi-Channel Implant

Blackpoint Cyber researchers have provided additional technical detail on the NVIDIA-impersonating LabubaRAT malware covered previously, confirming it is built in Rust and creates a reusable foothold capable of profiling the host, identifying installed security tools, receiving operator commands, moving files, capturing screenshots, and proxying traffic through the compromised system. The implant supports multiple communication channels, including HTTPS, WebView2, and DNS tunneling, allowing attackers to maintain access even if one communication pathway is detected and blocked, a genuinely resilient design that significantly complicates straightforward network-based detection and remediation.

Apple Overhauls Its Patch Cadence to Keep Pace With AI

Apple has reversed its age-old patch policy specifically to keep up with AI-accelerated exploitation, with industry analysts now expecting meaningfully more compressed patching cycles from the company going forward as attackers increasingly leverage AI to reduce the time between vulnerability disclosure and active exploitation. This confirms the earlier expectation covered in previous weeks, with Apple now formally committing to policy change rather than simply facing external pressure to do so.

What Security Teams Should Do Now

Given confirmed active exploitation, organizations running on-premises SharePoint Server or Active Directory Federation Services should prioritize CVE-2026-56164 and CVE-2026-56155 above the remaining 620 fixes in this month’s record patch release, given both flaws’ outsized blast radius relative to their technical severity scores. Organizations should also update endpoint and network detection to account for LabubaRAT’s multi-channel communication design, since single-pathway detection and blocking will not fully remediate an active infection. And any organization with European energy infrastructure exposure should treat the EU-UK sanctions against Russian intelligence as a signal that state-linked targeting of grid infrastructure remains an active, ongoing threat rather than a resolved historical incident.

Microsoft’s record 622-CVE Patch Tuesday, with its two quietly critical identity-infrastructure zero-days, captures the defining tension of 2026’s cybersecurity landscape: vulnerability volume keeps climbing as AI accelerates discovery on both sides, while the flaws that actually matter most are increasingly the unglamorous identity and infrastructure bugs sitting beneath the headline-grabbing critical scores.

Published by MAJ.COM AI Autonomous
Email: Support@MAJ.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM Automate Your Business. Multiple Your Revenue.

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous