Microsoft's July 2026 Patch Tuesday Fixes a Record 570 Flaws and 3 Zero-Days

What Microsoft Shipped

Microsoft released fixes for 570 vulnerabilities on July 14, 2026. Its heaviest previous Patch Tuesdays had topped out around 160.

Count the same release differently and you get a different headline. CrowdStrike's analysis of July's updates puts the total at 622 CVEs with 62 rated Critical, against Microsoft's own 570 and 59, because it folds in components that Microsoft tracks and ships on separate schedules, Chromium-based Edge among them. Both figures describe the same month. If you are the person putting a number in front of a board this week, say which count you used.

Microsoft's own breakdown concentrates the weight in two categories.

• 254 elevation of privilege, for an attacker who already has a foothold and wants more.
• 145 remote code execution, the class that turns network access into control of a machine.
• 102 information disclosure, 35 denial of service, 17 security feature bypass, and 16 spoofing account for the rest.

Why the Number Tripled

The interesting question is not how 570 bugs got into Windows. It is who found them.

Microsoft attributed the volume to a new AI-powered vulnerability discovery system it has been running across the Windows codebase, built to surface flaws before attackers reach them. That changes how the number should be read. A record count of vulnerabilities Microsoft found in its own code is a very different signal from a record count of vulnerabilities attackers were caught using. Two of the 570 fall into the second group.

It also means July is probably not an outlier. A discovery pipeline that produced this once will produce it again next month, and the month after. So the operational question is no longer how to survive one enormous release. It is whether a patch process designed around 100 CVEs a month still functions at five times that rate.

The Three Already in Play

Three of the 570 were zero-days, meaning defenders had no advance warning. Two are being exploited now.

• CVE-2026-56164, SharePoint Server, exploited. A missing authentication check on a critical function lets an unauthenticated attacker escalate privileges over the network. No credentials needed, only reachability.
• CVE-2026-56155, Active Directory Federation Services, exploited. Insufficiently granular access control lets an authorized attacker escalate locally. AD FS brokers single sign-on, so privilege gained there is privilege gained everywhere it federates.
• CVE-2026-50661, BitLocker, publicly disclosed. Physical access defeats full-disk encryption. CrowdStrike reports no evidence of exploitation, which ranks it below the other two and well above the remaining 567.

Why SharePoint Is Tonight's Job

SharePoint Server is usually reachable from the internet, usually holds documents somebody would pay for, and is usually wired into the rest of a Microsoft 365 estate. An unauthenticated privilege escalation on that combination is close to the worst shape a bug can take.

On-premises SharePoint also has history. It has been chained with other flaws into full server compromise more than once, by state-linked and financially motivated groups alike, which is why the guidance from Microsoft and independent researchers goes further than "apply the update". Patching closes the door. It does not tell you whether anyone already walked through it, and that answer is in your logs, not in the update guide.

The One With No Patch

This one is worth knowing about precisely because it is not among the 570. CrowdStrike's July analysis flags a publicly disclosed flaw in the Windows User Profile Service, tracked as LegacyHive, with proof-of-concept code already circulating and no fix in this release.

As of July 26, 2026 it is still unpatched. It needs a mitigation rather than an update, and because there is no KB to deploy, it will not show up as missing on any dashboard measuring July patch compliance. That is the kind of gap that survives a clean-looking report.

What to Patch First

At 570 fixes, working down the list in order is how an organization ends up three weeks late on the two that mattered. Sort by exploitability and exposure instead.

• The two exploited zero-days, today. CVE-2026-56164 and CVE-2026-56155, internet-facing instances before internal ones.
• Critical RCE in the network path. CrowdStrike singles out Windows DHCP, network drivers, and VMSwitch. These are what turn a foothold into lateral movement.
• BitLocker on anything that leaves the building. CVE-2026-50661 requires physical access, so laptops and field kit come first; a rack-mounted server is not the exposure here.
• A mitigation for LegacyHive, since there is no patch to deploy.
• Threat-hunt before closing the ticket on any system the exploited bugs applied to.

Per-CVE detail and the affected-product matrices are in Microsoft's Security Update Guide. CrowdStrike's July analysis has the triage view and the wider CVE count.