Microsoft July 2026 Patch Tuesday Fixes 570 Flaws Including 3 Zero-Days

Microsoft's July 2026 Patch Tuesday addressed approximately 570 vulnerabilities (569 in Tenable's precise tally), nearly triple June's previous single-month record of around 198 and the largest Patch Tuesday release Microsoft has ever shipped. Included were 3 zero-days: 2 actively exploited in the wild before patches were ready, and a third publicly disclosed ahead of a fix.

Last updated August 4, 2026: added the record-breaking context (nearly triple the prior monthly record), technical detail on how Microsoft's MDASH AI scanning system found some of these flaws, and noted that both CISA federal-patching deadlines below have now passed.

What Happened: July 2026 Patch Tuesday Breakdown

Microsoft released its monthly security updates on July 14, 2026, across Windows, Office, Azure, and other products, with roughly 56 rated critical. One actively exploited zero-day, CVE-2026-56155, was added to CISA's Known Exploited Vulnerabilities catalog — an elevation-of-privilege flaw (CVSS 7.8) in Active Directory Federation Services, credited to researchers on Microsoft's own Detection and Response Team, with a federal patching deadline CISA set for July 28, 2026.

The second actively exploited zero-day, CVE-2026-56164 (CVSS 5.3), is an elevation-of-privilege flaw in SharePoint Server 2016, 2019, and Subscription Edition, with a federal deadline of July 17, 2026. Both deadlines have now passed; any organization that hadn't patched by those dates has been running exposed systems for weeks. The third zero-day, CVE-2026-50661 (CVSS 6.1), is a security-feature bypass in Windows BitLocker that was publicly disclosed before a patch existed, though it wasn't confirmed as actively exploited, and importantly requires physical access to the target device, a meaningfully different risk profile than the two remotely exploitable flaws above.

Why 570: Microsoft's AI Scanning at Production Scale

The volume increase isn't incidental. Microsoft has attributed part of the record count to MDASH, its Multi-Model Agentic Scanning Harness, which by July was running in production across the full Windows codebase using more than 100 specialized AI agents to analyze code, flag potential vulnerabilities, and cross-validate findings against each other to reduce false positives before a human researcher reviews them. Microsoft has said this system contributed to finding vulnerabilities in networking and authentication components, including remote-code-execution flaws in the Windows TCP/IP stack and IKEv2 service. Microsoft has told customers directly to expect this volume to become the new normal, not a one-time spike.

Running more than 100 AI agents against the same codebase and cross-validating their findings against each other is a specific design choice aimed at a known weakness of AI-assisted code analysis: a single model reviewing code for vulnerabilities tends to produce a meaningful rate of false positives, flagging patterns that look suspicious but aren't actually exploitable. Having multiple agents independently analyze the same code and requiring agreement, or a structured escalation path when they disagree, before a finding reaches a human researcher is meant to filter out that noise before it consumes review time. Whether that cross-validation approach scales cleanly as Microsoft expands MDASH's coverage, or whether it introduces new failure modes of its own, correlated blind spots shared across agents built on similar underlying models, is a real open question security researchers are watching.

Why It Matters

The record-breaking scale matters less on its own than what's driving it: if AI-assisted scanning is now finding vulnerabilities faster than they can be triaged and shipped in normal cycles, "hundreds of CVEs in one release" may become routine across the industry, not just at Microsoft. For IT teams, that changes the patching calculus, sorting 570 items by exploitability and blast radius, rather than assuming every Patch Tuesday looks like the last one, is now the baseline skill required.

That sorting problem is not trivial at this scale. A 570-item release can't realistically be triaged item by item within a normal patch window, which is why CVSS severity scores, exploitability status, and whether a flaw is already in CISA's Known Exploited Vulnerabilities catalog matter more than the raw count. The two actively exploited zero-days in this release, both remotely exploitable with no user interaction required, warranted immediate attention regardless of the other 568 items; the BitLocker bypass, requiring physical device access, is a real vulnerability but a lower practical priority for most organizations' immediate response. Building that kind of triage discipline into a routine process, rather than treating every Patch Tuesday as an undifferentiated pile of updates, is what Microsoft's "expect this to be the new normal" warning is really asking IT teams to do.

What Happens Next

The two federal patching deadlines have already passed as of this update; any unpatched systems on those two CVEs specifically are now overdue. Security researchers will continue analyzing whether MDASH-discovered vulnerabilities follow different exploitation patterns than traditionally-discovered ones, and whether Microsoft's warning about "busier Patch Tuesdays" going forward holds through the rest of 2026.

Final Takeaway

This wasn't just a large Patch Tuesday, it was nearly triple the prior record, and Microsoft's own explanation points to AI-assisted scanning becoming a standing part of its security pipeline rather than a one-off. The 3 zero-days needed immediate attention when this shipped; the volume increase is the part that should change how security teams plan for every release after this one.

Key Points

Prioritizing Patch Deployment

With 570 fixes to work through, security frameworks generally recommend addressing actively exploited vulnerabilities first, then critical and high-severity flaws, then medium and low-priority issues on a normal testing cycle. The 3 zero-days here needed immediate attention regardless of an organization's usual testing cadence, since each represented a known, already-in-use attack vector.

Patch deployment at this scale isn't simple in practice: enterprise environments have complex dependencies where a single patch can affect multiple systems, and testing in non-production environments is essential but time-consuming. Automated patch management tools help, but a poorly tested automated deployment can cause its own outages if a patch conflicts with a critical business application, which is exactly the tradeoff that gets harder to manage as monthly patch volumes keep growing.

FAQs