Microsoft's July 2026 Patch Tuesday Addresses Record 570 Security Flaws
Microsoft's July 2026 Patch Tuesday delivers security updates for a record-breaking 570 vulnerabilities across its product ecosystem. The update addresses 59 flaws rated as Critical, including 48 remote code execution vulnerabilities. The breakdown spans 254 elevation of privilege bugs, 145 remote code execution flaws, 102 information disclosure issues, 35 denial of service vulnerabilities, 17 security feature bypasses, and 16 spoofing vulnerabilities. These figures exclude additional flaws in Azure services, Edge, and other products that Microsoft patches separately throughout the month.
This month's release tackles three zero-day vulnerabilities, with two actively exploited in real-world attacks and one publicly disclosed. Among the exploited flaws is CVE-2026-56155, an elevation of privilege vulnerability in Active Directory Federation Services that allows attackers to gain administrative privileges. Microsoft classifies zero-days as flaws that are either publicly disclosed or under active exploitation before an official fix becomes available, making them priority targets for immediate patching.
The surge in identified vulnerabilities stems from Microsoft's deployment of an AI-powered vulnerability discovery system that scans the Windows codebase more thoroughly than previous methods. The company warns that Patch Tuesday update sizes will likely continue increasing as this technology surfaces more security flaws before attackers can leverage them. IT administrators should prioritize deploying the Critical fixes and zero-day patches immediately to reduce exposure to active threats.