Microsoft Fixes Record 570 Flaws in July 2026 Patch Tuesday

July 2026 Patch Tuesday brings security updates for Windows 11, Windows 10, SharePoint Server, Active Directory Federation Services, BitLocker, and other Microsoft products.

According to BleepingComputer, Microsoft addressed a record 570 vulnerabilities this month, including two zero-day flaws that attackers actively exploited. The company also fixed a third zero-day vulnerability that researchers had publicly disclosed before the updates arrived.

Windows 11 users received the KB5101650 and KB5099414 cumulative updates. Windows 10 devices enrolled in the Extended Security Updates program received KB5099539.

Microsoft Fixes 59 Critical Vulnerabilities

Microsoft classified 59 of the vulnerabilities fixed this month as Critical.

The Critical vulnerabilities include:

• 48 remote code execution flaws
• Nine elevation-of-privilege vulnerabilities
• One security feature bypass
• One spoofing vulnerability

July 2026 Patch Tuesday Vulnerability Breakdown

The July security updates address vulnerabilities across several categories:

• 254 elevation-of-privilege vulnerabilities
• 145 remote code execution vulnerabilities
• 102 information disclosure vulnerabilities
• 35 denial-of-service vulnerabilities
• 17 security feature bypass vulnerabilities
• 16 spoofing vulnerabilities

The total includes only vulnerabilities Microsoft fixed as part of the July 2026 Patch Tuesday release.

Active Directory Federation Services Zero-Day Exploited

Microsoft fixed an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services, tracked as CVE-2026-56155.

The vulnerability results from insufficiently granular access controls. An authorized attacker with local access could exploit the flaw to obtain administrative privileges on a vulnerable system.

Microsoft confirmed that attackers had used the vulnerability in real-world attacks but did not reveal details about the exploitation methods or affected organizations.

SharePoint Server Zero-Day Allows Remote Attacks

CVE-2026-56164 is another actively exploited elevation-of-privilege vulnerability. It affects Microsoft SharePoint Server.

The flaw results from missing authentication for a critical function. An unauthenticated attacker could exploit it remotely over a network and gain elevated privileges.

Microsoft recommends that organizations install the available security updates immediately.

Administrators should also enable the Antimalware Scan Interface and configure Request Body Scan mode to Full. These measures can help reduce the risk while organizations complete their update deployments.

Microsoft has not explained how attackers exploited the flaw in active attacks.

Publicly Disclosed BitLocker Zero-Day Fixed

Microsoft also addressed CVE-2026-50661, a publicly disclosed security feature bypass vulnerability in Windows BitLocker.

An attacker with physical access to a vulnerable device could bypass BitLocker protection on the system drive. Successful exploitation could allow the attacker to access data stored on the encrypted drive.

The vulnerability requires direct access to the targeted computer, but it creates a serious risk for lost, stolen, or unattended devices.

Microsoft Uses AI to Find More Windows Vulnerabilities

Microsoft recently warned that future Patch Tuesday releases could include larger numbers of security fixes.

The company has started using an AI-powered system to search for vulnerabilities across the Windows codebase. The system can help Microsoft identify security weaknesses before attackers discover and exploit them.

This approach could result in more vulnerabilities appearing in monthly security updates, but it may also reduce the number of flaws that remain hidden inside Windows and other Microsoft products.

Microsoft warns that organizations should not delay security updates, because attackers are using AI to find and exploit vulnerabilities faster than before.