Microsoft July 2026 Patch Tuesday hits record scale with exploited zero-days and hundreds of CVEs

Microsoft's July 2026 Patch Tuesday was one of the largest security releases in company history, with reports ranging from 570 to 622 vulnerabilities fixed depending on the counting method. Multiple outlets confirmed that two or three of the flaws were already being exploited in the wild, pushing organizations to prioritize emergency patching rather than routine maintenance. The affected products included Windows components as well as SharePoint, RDP, Hyper-V, and Active Directory Federation Services, making the blast radius broad across enterprise environments. Security researchers and Microsoft both emphasized that this release raised triage stakes because many critical bugs were bundled together with the exploited ones. The event matters because mass patch cycles often become the moment when attackers weaponize the most widely deployed enterprise software. It also reinforces how difficult remediation has become when a single monthly update can contain hundreds of issues and active exploitation is already underway.

Sources

• July 2026 Patch Tuesday: Microsoft Patches 622 Vulnerabilities Including Two Exploited Zero-Days — CrowdStrike Blog
• AI-driven bug hunting fuels record Microsoft Patch Tuesday — Help Net Security
• Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month — Security Affairs
• Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days — /r/cybersecurity
• Microsoft Patch Tuesday July 2026 – The AI Acopolypse is Here — SANS Internet Storm Center, InfoCON: green