On July 14, 2026, Microsoft released its largest Patch Tuesday in the program's history 622 CVEs, more than triple June's previou...
.webp "Microsoft July 2026 Patch Tuesday record 622 CVEs two exploited zero-days")
The number tripling in a single month is not a coincidence. Microsoft VP of engineering Tom Gallagher warned in May that AI-driven vulnerability discovery would increase the volume of monthly patches. Windows executive VP Pavan Davuluri confirmed this week that Microsoft is using MDASH a multi-model agentic scanning harness to surface bugs faster across the Windows codebase. What looked like a one-month spike in June is now confirmed as a new baseline. The era of manageable monthly patch counts may be over.
The Two Zero-Days You Need to Patch Today
CVE-2026-56164 — SharePoint Server: This is the one to act on first. An unauthenticated attacker can exploit this vulnerability over the network without credentials and without any user interaction to escalate privileges on SharePoint Server. Microsoft credits incident responders for discovering it, which means it was found in a real attack, not a research environment. It is on CISA's KEV list with a July 17 federal deadline. If you run SharePoint Server on-premises and have not patched it, you should treat it as actively under attack because it is.
CVE-2026-56155 — Active Directory Federation Services: This one requires a low-privilege foothold first, but what it gives an attacker after that is administrator control over AD FS the box that signs every identity token in your organization. An attacker who compromises AD FS can forge authentication tokens for any user in your directory. Microsoft credits incident responders here too. It is the quieter of the two zero-days but potentially the more consequential one if it runs in your identity infrastructure. Also on CISA's KEV list with the same July 17 deadline.
CVE-2026-50661 — BitLocker Security Feature Bypass: The third zero-day is different in character. It requires physical access to the device and allows an attacker to bypass BitLocker encryption. Microsoft says it is not being actively exploited, but the vulnerability was publicly disclosed before the patch was available which is what makes it a zero-day by Microsoft's classification. Tenable's Satnam Narang notes this may be connected to a flurry of vulnerabilities disclosed by the researcher known as Nightmare-Eclipse or Chaotic-Eclipse, though no official confirmation has been made. Physical-access requirement reduces risk for most deployments but matters significantly for lost laptops, shared workstations, and devices handled by untrusted personnel.
What 622 CVEs Actually Looks Like The Breakdown
The full breakdown by vulnerability type from BleepingComputer: 254 elevation of privilege, 145 remote code execution, 102 information disclosure, 35 denial of service, 17 security feature bypass, and 16 spoofing. By severity: 59 Critical, 557 Important or lower. Windows accounted for 416 of the 622 vulnerabilities. Office followed with 82. Microsoft Edge contributed 46.
CrowdStrike's analysis puts the scale in context: this is roughly triple June's count and nearly five times May's. Dark Reading notes that when Tom Gallagher warned in May that AI-driven discovery would increase patch volumes, almost nobody anticipated crossing 600 within two months. The 59 Critical-rated vulnerabilities include 48 remote code execution bugs the category that typically demands the most urgent response from security teams.
The Kerberos RC4 change deserves attention separately from the CVE count. Microsoft is beginning mandatory enforcement of Kerberos RC4 deprecation this month. Organizations still using legacy Kerberos RC4 encryption for service accounts will start seeing authentication failures. This is not a vulnerability fix it is an enforcement action that has been telegraphed for years but which may catch organizations that have not fully audited their Kerberos configurations. The July update is the forcing function.
Why AI Is the Reason the Number Tripled
MDASH Microsoft's multi-model agentic scanning harness is the specific tool Pavan Davuluri named as the driver of increased vulnerability discovery. The system uses multiple AI models working together in an agentic loop to scan the Windows codebase for security flaws. Davuluri's statement is worth quoting directly: "We continue to evolve our internal systems and practices so that vulnerability discovery is not treated as a separate activity, but as part of how we build, review, and improve Windows before new features or updates are released."
The implication is significant. If Microsoft is finding bugs faster because of AI-assisted code scanning, the monthly CVE count is going to stay elevated not as an anomaly but as the new normal. Security Boulevard's analysis puts it plainly: "The era of small Patch Tuesdays may be over as AI-driven vulnerability discovery ramps up." For security teams that have structured their patch management workflows around historically manageable monthly volumes, this is a structural challenge that requires a different approach, not just faster execution of the existing process.
The flip side is that the same AI capability that is flooding security teams with more CVEs is also the tool those teams need to triage them. Manual review of 622 vulnerabilities with consistent accuracy is not realistic for most security teams. Risk-based prioritization correlating each CVE against internet exposure, network reachability, asset criticality, and active exploitation evidence is what separates a useful patch management program from an impossible one. The two actively exploited zero-days plus their July 17 federal deadline make the prioritization obvious this month. Most months will not be that clear.
What to Do Right Now In Priority Order
Microsoft's own updated deployment guidance recommends deferring Windows quality updates for fewer than three days and setting update deadlines to zero or one day with a grace period of no more than two days. That is a meaningfully tighter timeline than previous guidance and reflects the reality of the current threat environment. Intune and Windows Autopatch are the recommended deployment options.
Priority order for this month: First, patch CVE-2026-56164 on any internet-facing or internal SharePoint Server instance treat July 17 as your hard deadline regardless of whether you are a federal agency. Second, patch CVE-2026-56155 on AD FS servers the privilege escalation path from low-privilege to administrator on your identity signing infrastructure is not a risk to carry past this week. Third, audit Kerberos RC4 configurations before the RC4 enforcement causes authentication failures in your environment this is operational continuity, not just security. Fourth, address the 59 Critical-rated CVEs using exposure and reachability as your triage criteria. The remaining 560-plus Important and lower severity patches should follow normal cadence.
The broader lesson from this month's release applies every month from here: with AI-driven vulnerability discovery keeping patch volumes elevated, risk-based triage is no longer a best practice. It is a requirement. Teams that try to treat 622 CVEs with uniform urgency will be paralyzed. Teams that correctly identify the two CVEs that matter most and patch those in 48 hours are doing the job correctly.
Frequently Asked Questions
Q: How many vulnerabilities did Microsoft patch in July 2026?
622 CVEs on July 14, 2026 the largest Patch Tuesday in Microsoft's history, more than triple June's record of 206. The release includes 59 Critical vulnerabilities, three zero-days, and fixes across Windows, Office, SharePoint, Exchange, Azure, and Visual Studio. Windows alone accounted for 416 vulnerabilities.
Q: Which two zero-days are being actively exploited?
CVE-2026-56164 in SharePoint Server unauthenticated network privilege escalation, no credentials needed. CVE-2026-56155 in AD FS low-privilege to administrator escalation on your identity signing infrastructure. Both are on CISA's KEV list. Federal agencies had until July 17 to remediate the SharePoint flaw.
Q: Why did July's patch count triple from June?
Microsoft is using MDASH a multi-model agentic AI scanning harness to find vulnerabilities faster across the Windows codebase. Pavan Davuluri confirmed it. Tom Gallagher warned in May that AI-driven discovery would increase volumes. The July count confirms elevated patch volumes are the new normal.
Q: What is the Kerberos RC4 change and does it affect me?
Microsoft is beginning mandatory enforcement of Kerberos RC4 deprecation. Organizations using legacy RC4 encryption for service accounts will see authentication failures after applying the July update. This is an enforcement action, not a vulnerability fix. Audit your Kerberos configurations before or immediately after applying this month's patches.
References
- SecurityWeek. Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days. July 15, 2026. securityweek.com
- The Hacker News. Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack. July 2026. thehackernews.com
- CrowdStrike. July 2026 Patch Tuesday: Updates and Analysis. July 2026. crowdstrike.com
- Dark Reading. Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes. July 2026. darkreading.com
- Malwarebytes. July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days. July 15, 2026. malwarebytes.com
.webp)
