Microsoft’s July 2026 Patch Tuesday, released July 14, fixed 570 flaws by BleepingComputer’s count, then the largest monthly batch on record. It included two zero-days already exploited in attacks. Five days earlier Microsoft had said AI-assisted discovery would raise these numbers, which changes how the headline should be read.
Key Takeaways
- Microsoft’s July 2026 Patch Tuesday fixed 570 vulnerabilities by BleepingComputer’s count (CyberScoop: 622), including 59 rated Critical and three zero-days: two exploited in attacks and one publicly disclosed.
- The exploited flaws are CVE-2026-56164 (SharePoint Server) and CVE-2026-56155 (Active Directory Federation Services). The disclosed one is CVE-2026-50661 (Windows BitLocker). CISA gave federal agencies until July 17 and July 28 to fix the first two.
- Microsoft said on July 9 that AI-assisted discovery would raise update volumes. The record did not last: BleepingComputer counted 400 flaws in August and 966 in September, while exploited zero-days stayed at one or two a month.
What happened
Microsoft’s July 2026 Patch Tuesday addressed 570 flaws by BleepingComputer’s count, nearly triple June’s roughly 200. BleepingComputer counts only fixes Microsoft released that day, so the total excludes flaws fixed earlier in July and 468 Edge/Chromium flaws fixed by Google.
CyberScoop counted 622 and quoted Dustin Childs of Trend Micro’s Zero Day Initiative: “The mother of all releases.” Its tally includes 46 Edge flaws, but neither article explains the full 52-flaw gap. CyberScoop also counted 63 Critical flaws to BleepingComputer’s 59.
| Measure | BleepingComputer | CyberScoop |
|---|---|---|
| Total flaws | 570 | 622 |
| Critical-rated | 59 | 63 |
| Exploited zero-days | 2 | 2 |
| Publicly disclosed zero-days | 1 | Not stated |
BleepingComputer’s category counts sum to 569, one short of its 570 headline, which it calls approximate. The shares below use 569.
| Flaw type | Count | Share of 569 |
|---|---|---|
| Elevation of privilege | 254 | 44.6% |
| Remote code execution | 145 | 25.5% |
| Information disclosure | 102 | 17.9% |
| Denial of service | 35 | 6.2% |
| Security feature bypass | 17 | 3.0% |
| Spoofing | 16 | 2.8% |
Elevation of privilege makes up nearly 45% of the batch and remote code execution about 25%. Of the 145 remote code execution flaws, 48 (33%) were rated Critical, and those 48 are most of the 59 Critical flaws in total.
The three zero-days
| CVE and product | Status | What Microsoft says |
|---|---|---|
| CVE-2026-56164, SharePoint Server 2016, 2019, Subscription Edition | Exploited | Elevation of privilege over a network by an unauthorized attacker. CVSS 5.3, severity Moderate |
| CVE-2026-56155, Active Directory Federation Services (Windows Server 2012 to 2025) | Exploited | Elevation to administrator by an authorized local attacker. CVSS 7.8, severity Important |
| CVE-2026-50661, Windows BitLocker | Publicly disclosed, not exploited | Bypass of device encryption with physical access. CVSS 6.1, Important, exploitation less likely |
Microsoft has not said how attackers used either exploited flaw. The AD FS flaw was credited to Microsoft’s own Detection and Response Team, which BleepingComputer reads as a sign it surfaced during an incident investigation.
The SharePoint flaw was credited to Mandiant Incident Response, Google Cloud, FLARE OTF and an anonymous researcher.
Score and urgency diverged. The SharePoint flaw has the lowest CVSS score of the three (5.3, from MSRC’s CVSS 3.1 data) yet is exploited and has the earliest CISA deadline. Its vector rates integrity impact as low and confidentiality and availability impact as none, which keeps the score modest.
What to patch first
This order is 2mind’s reading of Microsoft and CISA data, not Microsoft guidance. It ranks by exploitation status first, then by CISA’s deadline, then by how exposed the system is.
| Order | What | Why |
|---|---|---|
| 1 | SharePoint Server: KB5002891 (2016), KB5002883 (2019), KB5002882 (Subscription Edition) | Exploited, no login needed, reachable from the internet per MSRC, CISA deadline July 17 |
| 2 | AD FS hosts on Windows Server 2012 to 2025 | Exploited, grants administrator rights, CISA deadline July 28 |
| 3 | BitLocker devices, starting with laptops that leave the office | Disclosed, not exploited, needs physical access; Windows 11 24H2 and 25H2 fix is KB5101650 |
| 4 | The 59 Critical-rated flaws, 48 of them remote code execution | Normal test-and-deploy cycle, filtered by what you run |
AD FS fixes by Windows Server version: KB5099444 (2012 R2), KB5099445 (2012), KB5099535 (2016), KB5099538 (2019), KB5099540 (2022) and KB5099536 (2025). These are the July packages listed by MSRC; check the Security Update Guide for newer updates that supersede them.
If SharePoint cannot be patched at once, Microsoft lists a mitigating factor: enable the Antimalware Scan Interface (AMSI) and set Request Body Scan mode to Full. Microsoft presents it as a help, not a fix.
CISA also attaches its forensic-triage requirement to this entry, but not to the AD FS one.
Microsoft’s own advice is to take security updates as soon as possible and to use Security Update Guide data to “build a risk map for their own estate, prioritize protections for high-value targets and accelerate deployment where exposure is greatest.”
Two Lenses
Lens one: AI is finding more bugs, which is mostly good news
On July 9, five days before the release, Pavan Davuluri, Microsoft’s executive vice president for Windows and Devices, wrote that AI makes it possible “to find more issues, faster, across more code” and that customers “will see a higher volume of security updates included in each security release.”
Microsoft calls the rise “evidence that defenders are getting better at identifying and addressing issues.” Its scanning system, MDASH, scans critical Windows binaries and validates candidate bugs with multiple AI models before engineers review them.
Tenable’s Satnam Narang told CyberScoop in July that the volume “reflects how good these tools have become at finding bugs, not how many of those bugs actually pose a risk to organizations.” In September he said AI discovery is “creating larger haystacks, but it isn’t finding more needles.”
Lens two: the burden of triage is real
The counter-argument is workload. Even if few flaws reach a typical organization, someone must triage every release. Action1’s Jack Bicer told CyberScoop in September that “the challenge is not simply getting through the patch list but knowing what needs attention first.”
An earlier version of this post read the count as evidence that AI infrastructure spending was outrunning security, and paired it with Reuters reporting on bank fees from AI deals. No source links the two, and Microsoft draws no such link. That juxtaposition was editorial, so it has been removed.
Updates since July 14
Later Patch Tuesdays put July in context. Below are BleepingComputer’s flaw counts and zero-day tallies for June through September.
| Month | Flaws | Zero-days (exploited / disclosed) |
|---|---|---|
| June 2026 | 200 | 1 / 5 |
| July 2026 | 570 | 2 / 1 |
| August 2026 | 400 | 1 / 2 |
| September 2026 | 966 | 2 / 0 |
September’s 966 is about 1.7 times July’s 570, so July’s record lasted until September 8. Exploited zero-days stayed between one and two a month. That is a small sample, but it fits Childs’s September remark: “we have not seen a correlating spike in active exploits — yet.”
Outlets also count differently. CyberScoop reported 974 for September against BleepingComputer’s 966, so compare months using one outlet’s method.
Why it matters
For an IT team, July meant two jobs that could not wait and a long queue that could. The practical test is not the headline count but whether you run SharePoint Server, AD FS, or BitLocker-protected devices that can be lost or stolen.
For a different kind of security failure in the agent era, see our write-up of GPT-5.6 Sol deleting files it was warned not to touch.
FAQ
Q. Were the Microsoft zero-days used in real attacks?
A. Yes — Microsoft marked two of the three zero-days, CVE-2026-56164 (SharePoint Server) and CVE-2026-56155 (AD FS), as exploited before the patch. The third, CVE-2026-50661 (BitLocker), was publicly disclosed but not marked as exploited.
Q. Why was the July 2026 patch count so high?
A. Microsoft said AI-assisted vulnerability discovery finds more issues, so each release carries more fixes. It has not linked the count to AI infrastructure spending, and analysts note that more findings do not mean more risk to a typical organization.
Q. What should an IT team patch first from the July release?
A. Start with the two exploited flaws: SharePoint Server (CVE-2026-56164, CISA deadline July 17) and AD FS (CVE-2026-56155, deadline July 28). Then address BitLocker (CVE-2026-50661) on devices at risk of physical loss.
What would change our view
The reading here is that the count mainly reflects discovery volume, not a spike in attacks. It would weaken if exploited zero-days rise in step with the counts, or if Microsoft or CISA tie exploited flaws to AI-discovered bugs. Neither appears in the sources checked for this update.
Sources
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days] — BleepingComputer
- [Microsoft discloses ‘the mother of all’ vulnerability loads, tripling June’s previous record] — CyberScoop
- Evolving Windows vulnerability management to meet the speed of AI-powered discovery — Microsoft Windows Experience Blog, July 9, 2026
- Microsoft expects more Windows security updates from AI-discovered flaws — BleepingComputer, July 9, 2026
- CVE-2026-56164, Microsoft SharePoint Server Elevation of Privilege Vulnerability — Microsoft Security Response Center, July 14, 2026
- CVE-2026-56155, Active Directory Federation Services Elevation of Privilege Vulnerability — Microsoft Security Response Center, July 14, 2026
- CVE-2026-50661, Windows BitLocker Security Feature Bypass Vulnerability — Microsoft Security Response Center, July 14, 2026
- July 2026 Security Updates, CVRF data feed (CVSS vectors, KB numbers, mitigation text) — Microsoft Security Response Center, read October 2, 2026
- Known Exploited Vulnerabilities Catalog (CVE-2026-56164 and CVE-2026-56155 added July 14, 2026) — CISA
- Microsoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flaws — BleepingComputer, June 9, 2026
- Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days — BleepingComputer, August 11, 2026
- Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days — BleepingComputer, September 8, 2026
- Microsoft discloses two actively exploited zero-days among 974 vulnerabilities — CyberScoop, September 8, 2026
Correction, October 2, 2026. An earlier version said three zero-days were already exploited, treated 48 remote code execution flaws as the total, and said BleepingComputer reported the same count as CyberScoop. Two zero-days were exploited and one was publicly disclosed.
BleepingComputer lists 145 remote code execution flaws, 48 of them Critical-rated. BleepingComputer counted 570 flaws and CyberScoop counted 622.
Update, October 2, 2026. Retitled and revised. The post now names the three zero-days, adds a patch order built from Microsoft and CISA data, adds Microsoft’s explanation for the higher count and the August and September figures, and removes the bank-fee comparison, which no source linked to the patch count.
Leave a Reply