570 vulnerabilities in a single Patch Tuesday release is a record, and 63 of them are rated Critical. For a Canadian SMB without a dedicated IT team, a number like that can feel paralyzing — where do you even start? You don't start by reading all 570. You start by identifying the handful being actively exploited right now, confirming whether they touch a system you actually run, and patching those within days. Everything else can follow your normal monthly cycle.
This guide breaks down what "Critical" and "Important" actually mean in Microsoft's rating system, walks through the three confirmed zero-days in this release — including an AD FS flaw that matters enormously for hybrid Microsoft 365 identity setups — a comparison table of severity levels against realistic SMB response-time targets, a printable patch checklist, guidance on testing before you deploy broadly, three Canadian SMB case studies, and what managed patch management actually costs versus what a breach costs.
Who wrote this guide
Written and reviewed by IT Cares certified technicians who handle patch deployment and vulnerability triage for Canadian SMB clients every month — the actual decision process a competent IT provider runs every Patch Tuesday, so you can either run it yourself or know what to expect from whoever manages it for you.
What Actually Happened: July 2026 Patch Tuesday by the Numbers
Microsoft's July 2026 security release addressed 570 CVEs across Windows, Windows Server, Microsoft 365 Apps, Exchange Server, SharePoint Server, .NET, Azure components, and Active Directory Federation Services — the largest single-month total Microsoft has published to date. Of those, 63 carry a Critical severity rating, meaning Microsoft assesses them as remotely exploitable with limited or no preconditions. The rest split across Important, Moderate, and a small number of Low-severity classifications.
The number that should drive your actual patching decisions isn't 570, and it isn't even 63 — it's 3. Three vulnerabilities in this release have confirmed active exploitation in the wild, meaning attackers were already using them before or at the moment the patch became available. That status — zero-day, actively exploited — is what separates "patch on your normal schedule" from "patch today," regardless of the CVSS score attached.
📊 IT Cares field note: Every month we talk to business owners who see a headline like "570 vulnerabilities patched" and either panic and try to review all of them, or shrug and assume it's an IT problem to worry about "eventually." Both reactions miss the actual job: identify what's exploited right now, confirm what you run, patch that fast, and let a normal cycle handle the rest. That's the entire discipline.
This release also lands during a stretch where ransomware groups move faster than ever from disclosure to working exploit, sometimes within 48-72 hours — precisely why the severity distinctions and response targets in this guide matter more now than a few years ago. Our guide to how ransomware works covers the attacker's side; this guide covers the defensive response.
Want someone else carrying this risk every month?
IT Cares triages every Patch Tuesday release against your specific systems and deploys the fixes that matter — from $119.99 for a one-time review, or bundled into ongoing managed IT.
The 3 Actively Exploited Zero-Days
These three vulnerabilities are the ones that actually warrant an emergency, out-of-cycle response this month. Everything below is written for a business owner or IT generalist, not a security researcher — the goal is to help you recognize whether each one applies to your environment.
1. AD FS Token-Forgery Flaw (CVE-2026-33131, CVSS 9.1)
Active Directory Federation Services (AD FS) is the on-premises identity component many businesses use to let employees sign into Microsoft 365, internal web apps, and partner portals with a single set of credentials — a hybrid setup common among businesses that adopted Microsoft 365 gradually from an existing on-premises Active Directory environment. This vulnerability lets an attacker who can reach a vulnerable AD FS server forge authentication tokens and impersonate any federated user, including Global Administrators, across every application that trusts that server — without needing that user's password.
This is as severe as identity vulnerabilities get, because it compromises the trust relationship your entire Microsoft 365 tenant and any federated partner applications rely on. If your business runs an on-premises AD FS server, this is your single highest priority from this entire release, full stop.
2. Windows CLFS Driver Elevation of Privilege (CVE-2026-33144, CVSS 7.8)
The Common Log File System (CLFS) driver is a low-level Windows component, and this flaw lets an attacker who already has a foothold — even a low-privilege account, often obtained through phishing — escalate to full SYSTEM privileges. On its own this isn't a way in; it's the second step, the move that turns "we got a user to click something" into "we now control the machine." This class of CLFS bug has been a recurring favourite in ransomware deployment chains for exactly this reason.
3. SharePoint Server Remote Code Execution (CVE-2026-33158, CVSS 8.8)
This flaw affects on-premises SharePoint Server (not SharePoint Online, patched centrally by Microsoft) and lets an unauthenticated attacker execute code on the server simply by reaching it over the network — no login required. Businesses running an internet-facing SharePoint Server for client portals or partner document sharing are the highest-risk group; internal-only deployments behind a firewall carry lower exposure, though never zero once any other foothold exists.
The pattern across all three
Notice what these three have in common: an identity system (AD FS), a privilege-escalation primitive (CLFS), and an internet-facing application (SharePoint) — mapping almost exactly onto a typical ransomware attack chain: get in, escalate, move laterally through identity. That's exactly why all three earned zero-day status simultaneously, and why they deserve a faster response than the other 567 items in this release.
Critical vs Important: What Severity Ratings Actually Mean
Microsoft assigns every CVE a severity rating, and understanding what those ratings actually describe — not just the label — is the single most useful skill for prioritizing without a dedicated security team. A rating is a statement about exploitability and impact under typical conditions; it is not, on its own, a statement about whether an attacker is using it right now. That second fact — zero-day status — is layered on top of severity, and the two together determine urgency.
| Severity Level | What It Actually Means | SMB Response Time Target |
|---|---|---|
| Critical + Actively Exploited (Zero-Day) | Remotely exploitable with little or no precondition, and confirmed in-the-wild use by attackers before or at patch release | 24–48 hours on any affected, reachable system — emergency, out-of-cycle deployment |
| Critical (Not Yet Exploited) | Remotely exploitable with little or no precondition, no confirmed active exploitation yet, but high likelihood of becoming weaponized quickly | 72 hours to 7 days — short, targeted testing window, then deploy |
| Important | Typically requires a precondition — authentication, specific configuration, or user interaction like opening a file | 2–3 weeks — standard monthly patch cycle, tested via pilot group first |
| Moderate | Limited impact even if exploited, often requiring significant preconditions or providing minimal attacker benefit | Next scheduled monthly cycle — no need to rush or deploy out-of-band |
| Low | Minimal real-world impact under realistic conditions; frequently theoretical or requiring physical access | Opportunistic — apply at next reimage, refresh cycle, or routine maintenance window |
The table points to a simple triage rule: check zero-day status first, severity second. A Critical-but-not-yet-exploited flaw and an Important-but-actively-exploited flaw both deserve faster attention than the raw severity label alone suggests — in practice, actively-exploited zero-days are disproportionately rated Critical, exactly the case with all three in this July release.
How to Prioritize Patching Without a Dedicated IT Team
You don't need a security operations center to run a sound patching program — you need a repeatable, honest process you actually follow every month. Below is the version built for a business where patching is one part-time responsibility rather than a full-time job.
Patch Management Checklist for SMBs
Before Patch Tuesday (ongoing hygiene)
☐ Automatic updates enabled on all workstations, with no user able to permanently defer
☐ Complete inventory of internet-facing systems (VPN, RDP, SharePoint, AD FS, webmail)
☐ A designated pilot group of 3–5 non-critical devices identified for test deployment
Day 1 — Release day
☐ Check the Microsoft Security Update Guide for any Critical + actively-exploited items
☐ Cross-reference exploited CVEs against your actual system inventory (does this apply to us?)
☐ If a zero-day applies to a reachable system, begin emergency deployment immediately
Days 2–4 — Testing
☐ Deploy standard (non-emergency) patches to the pilot group only
☐ Confirm pilot devices boot normally and line-of-business apps still function
☐ Check Microsoft's Windows Release Health dashboard for known issues before broad rollout
Days 5–14 — Broad deployment
☐ Roll out to the remaining fleet in stages, not all at once
☐ Track which devices have and haven't received the update — a spreadsheet is enough
Ongoing
☐ Any system still unpatched after 30 days is flagged and escalated, not forgotten
☐ End-of-life software (no longer receiving patches at all) is on a documented replacement timeline
Patch Testing Before Deployment: The Staged Rollout
Cumulative updates occasionally break something — a driver conflict, a line-of-business application that doesn't play well with a new component, a printer that stops responding. That risk is real, but manageable with a staged approach rather than the two extremes businesses default to: deploying everything the moment it's released, or delaying for weeks out of general caution.
- Ring 1 — Pilot (3–5 devices, days 1–3): A small group representing your hardware and software mix but not business-critical if something goes wrong — ideally including any less-common hardware more likely to surface a compatibility issue.
- Ring 2 — Early adopters (days 4–7): A broader group, perhaps 20-30% of the fleet, once the pilot ring has run a few days with no issues.
- Ring 3 — Full deployment (days 8–14): The remaining fleet, once both prior rings show a clean track record.
- Emergency exception: A confirmed, actively-exploited zero-day on a reachable system skips this staged timeline. The risk of a known exploit in active use outweighs the smaller risk of an untested compatibility issue — testing compresses to hours, not weeks.
Before broad deployment of anything non-emergency, check Microsoft's Windows Release Health dashboard for known issues reported by other organizations — a five-minute check that has saved countless businesses from deploying a patch with a documented problem that simply hadn't been fixed yet.
Why SMBs Are Especially at Risk from Unpatched Systems
It's tempting to assume attackers target large enterprises and ignore small businesses, but the pattern runs the other way for exactly the vulnerabilities in this release. Ransomware operators and initial-access brokers overwhelmingly use automated scanning to find any internet-reachable system running a known-vulnerable version of AD FS, SharePoint, RDP, or a VPN appliance — they aren't hand-picking targets by size, they're scanning entire IP ranges, and a small business's server answers that scan the same way a large enterprise's does.
Three factors compound this for SMBs. Patch delay is more common without dedicated IT staff, not from negligence but because nobody owns the monthly review as a defined job. SMBs are disproportionately likely to still run on-premises AD FS or SharePoint Server rather than having fully migrated to cloud-native Microsoft 365, since that migration takes budget many haven't yet allocated. And the consequence of a successful compromise is proportionally larger — an incident that costs a large enterprise a rough quarter can genuinely close a small business permanently, given thinner cash reserves and less capacity to absorb weeks of lost operations.
The uncomfortable truth about "we're too small to be a target"
Automated exploitation doesn't check company size before it runs. If your AD FS server, SharePoint deployment, or RDP endpoint is reachable and unpatched, it will be found by the same scanning infrastructure that finds enterprise targets — the only difference is what happens to your business afterward, and that difference tends to run against the smaller company, not in its favour.
Real-World Examples: How This Plays Out for Canadian SMBs
These three examples are composite, illustrative case studies representative of the kinds of outcomes seen across Canadian SMBs during major Patch Tuesday cycles — not accounts of specific named clients. They're included because the details make the stakes concrete in a way general warnings don't.
Case study 1: Bordeaux Fiscal Group, Laval, QC — 34 employees
Bordeaux, an accounting and tax preparation firm, had allowed RDP access to a file server for two remote bookkeepers, protected only by a password — no MFA, no VPN gateway in front of it. The firm's usual pattern was to apply Windows updates "whenever IT gets to it," typically 4-6 weeks after release. Within nine days of the July 2026 release, an automated scan found the exposed RDP endpoint, and an attacker deployed the CLFS privilege-escalation exploit after gaining an initial foothold through a stolen credential from an unrelated earlier breach. The firm lost access to client tax files during peak season and paid roughly $38,000 CAD in recovery costs, alongside eleven days of severely disrupted operations. A same-day patch, combined with basic RDP hardening already recommended but not yet implemented, would have closed this path entirely.
Case study 2: Northshore Dental Partners, Halifax, NS — 5 clinics, 38 employees
Northshore runs a hybrid Microsoft 365 setup with an on-premises AD FS server for single sign-on across its five clinics. Their managed IT provider flagged the AD FS zero-day within six hours of Microsoft's advisory, cross-referenced it against Northshore's known deployment, and deployed the emergency patch within 30 hours — well inside the 24-48 hour target this guide recommends. No exploitation was detected. Northshore's practice manager credited the speed to having a contract that explicitly included zero-day monitoring, rather than a general "we'll get to Windows updates eventually" arrangement — a distinction she hadn't previously realized was worth asking about.
Case study 3: Prairie Fabrication Ltd., Regina, SK — 58 employees
Prairie Fabrication, a metal fabrication company, ran an internet-facing SharePoint Server for a client-facing project portal used by contractors to review drawings and schedules. With no dedicated IT staff and only a part-time consultant for occasional support, the SharePoint RCE vulnerability from this release went unpatched for 22 days. An opportunistic scan found the vulnerable server, and the resulting intrusion attempt was caught by the company's endpoint detection tool before ransomware deployment could complete — a near-miss that prompted Prairie's leadership to move to a managed patch management agreement with defined response-time commitments the following month.
What these three cases have in common
None of these businesses were careless — all three had reasonable day-to-day IT habits. The difference between Bordeaux's costly incident, Northshore's clean save, and Prairie's near-miss wasn't diligence in general, it was whether the business had a defined, fast response for actively-exploited zero-days versus treating every update as equally low-urgency.
What Does Managed Patch Management Cost vs a Breach?
For a business weighing whether to handle patching internally or bring in a managed service, the honest comparison is between a small, predictable monthly cost and a large, unpredictable one.
- Managed patch management (Canada, small business): Typically bundled into a broader managed IT agreement, commonly $25–$60 CAD per device per month depending on device count, whether servers are included, and whether 24/7 zero-day response is part of the package. For a 20-device business, that generally lands around $500–$1,200 CAD per month.
- Standalone patch review (one-time): A scoped triage and deployment pass against a specific release — useful for a business that self-manages routine patching but wants a professional check on emergency items — typically runs a few hundred dollars CAD.
- Cost of a moderate ransomware incident (illustrative): Once downtime, recovery, notification, and reputational impact are factored in, even a moderate incident regularly runs into five or six figures for a 20-100 employee business — consistent with the roughly $38,000 CAD outcome in the Bordeaux case study above, itself on the lower end.
Framed that way, the comparison resolves most budget hesitation on its own: a managed patch service costing a few hundred to just over a thousand dollars a month is a rounding error next to even a moderate breach, and it's a cost you control rather than one that arrives without warning on the worst possible week.
Want this handled every month, not just this one?
IT Cares bundles patch triage and staged deployment into our managed IT services and cybersecurity services — scoped and quoted for your actual device count, with zero-day response built in rather than sold as a separate emergency call. If you want a one-time check specifically against this July release first, that's available too, starting from $119.99.
Where Patching Fits Into a Broader Security Program
Patch management is necessary but not sufficient on its own — it's one category among several a complete security posture needs to cover, alongside backups, access control, MFA, and endpoint protection. Our IT security audit checklist for business walks through all eight categories a real audit examines. If ongoing patch review feels like more than your business wants to own internally, our guide to what managed IT services includes covers how patching typically fits into that relationship. And if the AD FS zero-day has you rethinking how much implicit trust your identity infrastructure grants by default, our zero trust security explainer covers limiting how far a compromised account can reach.
Frequently Asked Questions
Ready to Find Out Exactly What Needs Patching in Your Business?
IT Cares runs a same-day triage against this exact release and every Patch Tuesday after it — a prioritized, honest action plan, not a sales pitch for tools you don't need.
Comments (3)
We do run AD FS for our multi-location setup and had no idea this was even in the release until reading this. Patched within the day. The severity table alone was worth bookmarking this page.
The "570 doesn't mean 570 decisions" framing is exactly what I needed to stop feeling overwhelmed every Patch Tuesday. Sharing this with our part-time IT consultant.
Checked our SharePoint server after reading the third case study — we were exposed the same way. Getting a real managed patch arrangement in place now instead of waiting for a near-miss of our own.
Leave a Comment