Microsoft’s July 2026 Patch Tuesday is the largest in company history: 570 vulnerabilities patched across Microsoft products, including 59 rated Critical and 3 zero-days — two of them already being actively exploited in the wild. The surge is directly attributed to Microsoft’s AI-powered vulnerability detection system, which is now finding bugs in Windows faster than attackers can exploit them.
- 570 total vulnerabilities patched — the most in a single Patch Tuesday in Microsoft’s history
- 59 Critical: 48 Remote Code Execution, 9 Elevation of Privilege, 1 Security Bypass, 1 Spoofing
- 3 zero-days: 2 actively exploited in the wild, 1 publicly disclosed but not yet exploited
- Count is almost triple last month and 4× the typical annual average from 2025
- Microsoft’s AI vulnerability scanner is credited with the unprecedented spike
Why AI Is Behind the Record-Breaking Patch Count
Microsoft’s internal AI-powered vulnerability detection system has been scanning Windows source code and test pipelines continuously since late 2024. The result: the company is now surfacing security flaws proactively — before attackers discover them — at a rate that dwarfs the old quarterly security review model.
According to reporting by Windows Latest, the July 2026 count is 4× the typical monthly count from last year, and Bleeping Computer confirms it is “almost triple” the record set last month. This is not a coincidence or an anomaly — it is a direct output of AI-assisted code scanning running at scale on one of the largest codebases in the world.
The implications are significant for the industry. AI security tooling is now a first-class patch generation pipeline, not a future experiment. Claude Mythos separately caused a 3.5× spike in critical CVE disclosures earlier this year — the pattern of AI accelerating vulnerability discovery is repeating across the industry. The same AI capabilities driving demand for more compute are now patching the attack surface those systems expose.
The Two Zero-Days Being Actively Exploited Right Now
Of the three zero-days in this update, two have confirmed in-the-wild exploitation — meaning attackers are already using these vulnerabilities in real attacks before the patch was available:
CVE-2026-56155 — Active Directory Federation Services Elevation of Privilege. This is the most urgent patch for enterprise IT teams. ADFS handles Single Sign-On (SSO) for Microsoft 365 environments — an elevation of privilege on ADFS means an attacker who gains initial access anywhere in a Microsoft cloud tenant can move laterally across the entire Microsoft 365 stack. Per Zecurit’s analysis, active exploitation is confirmed. Enterprise teams should treat this as Priority 1.
CVE-2026-50661 — Windows BitLocker Security Feature Bypass. This vulnerability allows an attacker with physical access to a signed-in Windows device to bypass BitLocker encryption and access protected volumes. The practical threat is concentrated in shared physical spaces — laptops in cafes, airports, and coworking spaces. It requires physical access, but for organizations with a distributed workforce, “physical access” is a routine risk, not a theoretical one.
The third zero-day was publicly disclosed before this Patch Tuesday but has not been observed in active exploitation at time of publication.
What IT Teams Need to Do This Week
The Kerberos enforcement change included in this update is separate from the zero-days but carries its own risk: Microsoft is turning on mandatory Kerberos signing by default. Legacy Windows Server configurations that have not been updated to support Kerberos signing will experience authentication failures after this update is applied. Per Cybernews, IT teams should test the Kerberos enforcement change in a staging environment before broad deployment — the authentication failure mode can disrupt entire domain login flows.
For prioritization: patch CVE-2026-56155 (ADFS) immediately on any environment using Microsoft 365 SSO. Apply CVE-2026-50661 (BitLocker) on all managed endpoints. Test the Kerberos enforcement change before rolling it out org-wide.
Microsoft’s ongoing AI investment in internal tooling is now measurably affecting the volume and cadence of security updates — IT teams should expect sustained high-volume Patch Tuesdays for the foreseeable future as the AI scanner continues to surface the existing vulnerability backlog in Windows source code.
Frequently Asked Questions
How many vulnerabilities did Microsoft patch in July 2026?
Microsoft patched 570 vulnerabilities in the July 2026 Patch Tuesday update — the largest Patch Tuesday in the company’s history. The total includes 59 Critical-rated flaws and 3 zero-days, two of which were being actively exploited in the wild before the patches were released.
Which zero-days are being actively exploited in July 2026?
Two zero-days are confirmed as actively exploited: CVE-2026-56155 (Active Directory Federation Services Elevation of Privilege) and CVE-2026-50661 (Windows BitLocker Security Feature Bypass). ADFS is the higher-severity risk for enterprise environments due to its role in Microsoft 365 SSO. BitLocker bypass requires physical device access.
Why did Microsoft patch a record number of vulnerabilities this month?
Microsoft attributes the increase to its AI-powered internal vulnerability detection system, which continuously scans Windows source code and test pipelines. The system is discovering flaws proactively at 4× the rate of prior years. The July 2026 count is also almost triple the previous month’s count — reflecting an accelerating AI-driven scanning cadence, not a sudden worsening of code quality.
What is CVE-2026-56155 and why is it critical?
CVE-2026-56155 is an Elevation of Privilege vulnerability in Active Directory Federation Services (ADFS), which handles Single Sign-On for Microsoft 365 environments. An attacker who exploits this flaw can escalate privileges and move laterally across a Microsoft 365 tenant. Active exploitation is confirmed, making it Priority 1 for enterprise security teams using Microsoft cloud services.
What does the Kerberos enforcement change in July 2026 Patch Tuesday mean?
Microsoft is enabling mandatory Kerberos signing by default in this update. Legacy Windows Server configurations that do not support Kerberos signing will experience authentication failures after applying this patch. IT administrators should test the change in a staging environment before deploying it organization-wide to avoid disrupting domain login flows in production.
