Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days 微软修补创纪录的622个漏洞，包括两个被利用的零日漏洞

TL;DR

• Microsoft patched a record-breaking 622 vulnerabilities in its July 2026 Patch Tuesday release, significantly exceeding previous annual totals.
• Two actively exploited zero-day flaws were addressed: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server, both allowing privilege escalation.
• The high volume of fixes is attributed to Microsoft's adoption of AI-driven security tools, specifically the multi-model agentic scanning harness (MDASH), to accelerate vulnerability discovery.
• Critical severity issues included a CVSS 9.9 flaw in Windows VMSwitch and a CVSS 9.8 vulnerability in SharePoint, alongside RCE bugs in Remote Desktop Protocol and DHCP Server.

Why It Matters

This event highlights a paradigm shift in enterprise software maintenance, where AI-integrated security scanning is becoming a primary driver for identifying and resolving code defects at scale. For security practitioners, the sheer volume of patches necessitates urgent prioritization strategies, particularly for widely deployed components like Active Directory and SharePoint that are currently under active exploitation.

Technical Details

• Active Directory & SharePoint Zero-Days: CVE-2026-56155 allows local privilege escalation in AD FS, while CVE-2026-56164 enables unauthenticated network-based privilege escalation in SharePoint Server.
• High-Severity Flaws: Windows VMSwitch contains a critical remote code execution vulnerability (CVE-2026-57092, CVSS 9.9), and SharePoint has another critical flaw (CVE-2026-50522, CVSS 9.8).
• AI-Driven Discovery: Microsoft utilizes MDASH (Multi-model Agentic Scanning Harness) to automate bug surfacing across the Windows codebase, integrating vulnerability discovery directly into the development lifecycle rather than treating it as a post-build activity.
• Breadth of Impact: The update covers 416 Windows vulnerabilities and 164 Office suite issues, along with critical patches for Azure, Defender, Exchange Server, Edge, SQL Server, and third-party integrations like Minecraft Bedrock Dedicated Server.

Industry Insight

The integration of agentic AI into the SDLC suggests that future patch cycles will likely see even higher volumes of discovered vulnerabilities, requiring organizations to adopt automated, continuous compliance monitoring rather than relying on periodic manual audits. Security teams should prioritize immediate remediation of Active Directory and SharePoint exploits due to their active exploitation status and high impact on identity management and collaboration infrastructure.

TL;DR

• 微软发布创纪录的622个漏洞补丁，其中包含两个已在野外利用的Active Directory和SharePoint零日漏洞。
• 微软宣布使用多模型智能体扫描工具（MDASH）加速漏洞发现，将安全检测融入Windows开发全流程。
• 此次更新涵盖Windows、Office、Azure等广泛产品线，Adobe同期也发布了88个漏洞修复。
• 高危漏洞包括Windows VMSwitch（CVSS 9.9）、SharePoint远程执行及BitLocker物理绕过风险。

为什么值得看

本文揭示了大型软件供应商在应对海量安全威胁时的规模化响应能力，特别是微软通过AI自动化手段提升漏洞发现效率的战略转型。对于安全从业者和IT管理者而言，了解这些关键零日漏洞的影响范围及修复优先级是保障企业基础设施安全的当务之急。

技术解析

• 大规模补丁发布：本月共修复622个CVE，其中Windows占416个，Office占164个，创下历史新高。重点修复了Active Directory Federation Services (AD FS) 的本地提权漏洞 (CVE-2026-56155) 和无需认证的SharePoint网络提权漏洞 (CVE-2026-56164)。
• AI驱动的安全工程：微软引入多模型智能体扫描框架 (MDASH)，利用AI加速Windows代码库中的漏洞挖掘。这种“安全左移”策略旨在将漏洞发现从独立活动转变为构建和审查流程的一部分。
• 关键高危组件：除零日漏洞外，还修复了CVSS评分高达9.9的Windows VMSwitch漏洞 (CVE-2026-57092)、Exchange Server XSS (CVE-2026-55008) 以及多个远程代码执行 (RCE) 漏洞，涉及RDP、DHCP Server和网络驱动程序。
• 第三方联动影响：Adobe同期修复了88个漏洞，包括ColdFusion和Illustrator中的严重缺陷；SAP、Palo Alto Networks等厂商也发布了相关安全更新，显示行业整体面临严峻的安全挑战。

行业启示

• AI重塑安全开发生命周期：微软利用AI自动化扫描不仅提高了效率，更标志着安全测试正从“事后修补”向“开发内嵌”转变，其他厂商可能跟进类似的多模型智能体审计策略。
• 供应链与生态协同防御：单一厂商的大规模漏洞爆发往往伴随整个软件生态的风险，企业和安全团队需建立跨平台（如Windows、Adobe、SAP）的统一补丁管理和监控机制。
• 零日攻击常态化下的应急准备：鉴于已有两个零日漏洞被利用，组织应立即验证关键资产（如AD域控、SharePoint服务器）的补丁状态，并加强针对特权提升和远程执行的边界防护。