Skip to content
NewsIncident

Microsoft July 2026 Patch Tuesday fixes record 570 CVEs, two zero-days actively exploited

· by Pondero Newsdesk

The short version

Microsoft patched a record 570 vulnerabilities on July 15, nearly triple the June count, with two actively exploited zero-days in Active Directory Federation Services and SharePoint Server. Microsoft attributed the surge to AI-powered internal vulnerability scanning.

Microsoft July 2026 Patch Tuesday fixes record 570 CVEs, two zero-days actively exploited

Microsoft patched 570 vulnerabilities in its July 15, 2026 Patch Tuesday release, the highest single-month total on record and nearly triple the volume it addressed in June. Two of those flaws were already being exploited in the wild before patches shipped. The company confirmed that AI-powered fuzz testing and static analysis tools now drive a larger share of internal discovery, a structural shift it said explains the jump in volume rather than a sudden expansion of the Windows attack surface.

What

The July release included 59 vulnerabilities rated Critical, with 48 of those enabling remote code execution, per BleepingComputer's tracker. The full 570 breaks across six categories: 254 elevation of privilege issues, 145 remote code execution flaws, 102 information disclosure bugs, 35 denial of service vulnerabilities, 17 security feature bypasses, and 16 spoofing flaws.

Three zero-days received patches. Two were actively exploited at ship time: CVE-2026-56155, an insufficient access-control flaw in Active Directory Federation Services that allows privilege elevation; and CVE-2026-56164, a missing-authentication bug in SharePoint Server that attackers used for unauthorized privilege escalation. A third, CVE-2026-50661, is a Windows BitLocker security bypass that was publicly disclosed before July 15 but had no confirmed exploitation in the wild, per Help Net Security. Microsoft also patched CVE-2026-55040, a separate SharePoint flaw that chains with another vulnerability to enable unauthenticated remote code execution.

The AI discovery shift

The week before the release, Microsoft warned publicly that patch volumes would climb. The company has deployed AI-powered vulnerability discovery tools across the Windows codebase to surface bugs before external researchers or adversaries find them. Per Krebs on Security's analysis, Microsoft described adversaries now applying similar automated techniques at "machine speed of discovery," and the volume increase as a deliberate response.

The practical read: 570 CVEs does not mean Windows became dramatically less secure in one month. It means Microsoft's internal tooling is catching and shipping fixes for more vulnerabilities per cycle than manual review ever produced. The question that matters long-term is whether the scanning program continues to find new classes of bugs or whether counts plateau once the existing backlog is cleared.

Why it matters

For teams running Active Directory Federation Services or SharePoint Server, the two actively exploited zero-days require priority patching. ADFS is authentication infrastructure. A privilege-elevation flaw there can let an attacker move from a low-privileged initial foothold to domain control without touching the primary domain controller. SharePoint's CVE-2026-56164 is remotely exploitable under low-complexity conditions, meaning it does not require unusual server configuration to trigger.

Microsoft updated its remediation guidance alongside this release. The company now recommends deploying quality updates within less than three days, compared to the 30-day patching windows many enterprise programs currently run. That guidance applies across the full release, not only to the exploited zero-days.

Security teams tracking vendor disclosure velocity should note the structural context: if AI-assisted scanning at Microsoft's scale runs continuously, monthly CVE counts across the industry may rise across other vendors running comparable programs.

What to watch next

Proof-of-concept code for CVE-2026-56155 is the immediate signal to track. An ADFS privilege bypass with working exploit code would push remediation from standard priority to emergency-change territory for most enterprise environments. Neither that flaw nor CVE-2026-56164 had public proof-of-concept code as of the July 15 release, but both attract rapid external research attention once a patch ships and reverse engineering begins.

Independent confirmation of Microsoft's AI-discovery attribution is also worth watching. Epoch AI flagged a CVE severity spike in June data; if their dataset or other researchers corroborate the structural link between AI scanning programs and monthly CVE volume, that has implications for how enterprises model future patch cadence.

Sources