Microsoft releases record 622-vulnerability Patch Tuesday

Microsoft released its largest-ever monthly security update on Tuesday, July 14, 2026, addressing a record-breaking 622 vulnerabilities across its product portfolio, including two flaws already being exploited by attackers. The update, known as Patch Tuesday, more than tripled the previous record set in June and included fixes for 61 critical flaws and three zero-day vulnerabilities.

The two exploited zero-days are privilege escalation flaws. The first, tracked as CVE-2026-56164, affects on-premises SharePoint Server and allows an unauthenticated attacker to elevate privileges over a network. The second, CVE-2026-56155, is a weakness in Active Directory Federation Services (AD FS) that permits an authenticated attacker to gain higher privileges locally. Microsoft credited its own and external incident response teams for discovering these flaws in active attacks. A third zero-day, CVE-2026-50661, is a publicly disclosed BitLocker security feature bypass that requires physical access to a device; Microsoft stated it is not currently under active exploitation.

The sheer volume of patches is unprecedented, with 416 vulnerabilities addressed in Windows, 82 in Office, and 46 in...