Microsoft's July Patch Tuesday Fixes Record 570 Security Flaws, Including Two Exploited Zero-Days

Microsoft's July 2026 Patch Tuesday closed 570 vulnerabilities across Windows and its other products, the largest single patch release in the company's history and nearly triple last month's already record-breaking total. Three zero-day vulnerabilities were among the fixes, with two — an Active Directory Federation Services flaw (CVE-2026-56155) and a SharePoint Server flaw (CVE-2026-56164) — already being exploited in attacks, and a third BitLocker security bypass (CVE-2026-50661) publicly disclosed.

Of the total, 59 flaws were rated Critical, including 48 remote-code-execution bugs. Elevation-of-privilege issues made up the largest category at 254, followed by 145 remote-code-execution and 102 information-disclosure vulnerabilities. Notable fixes touched Office, Windows Media Foundation, and the DHCP client and server components.

Microsoft attributed the surging patch counts to a new AI-powered vulnerability discovery system it has begun using to scan the Windows codebase, saying the tool is surfacing flaws before attackers can exploit them — a shift that is also fueling scrutiny over whether faster discovery is outpacing the industry's ability to deploy fixes at scale.