Microsoft’s July 2026 Windows patches shattered every historical record, delivering fixes for over 600 vulnerabilities in a single Patch Tuesday — the largest release in Microsoft’s history. With 59 critical flaws, 48 remote code execution bugs, and two zero-days already being actively exploited in the wild, this is not a month to hit the snooze button on Windows Update. Here is everything sysadmins need to know to triage and deploy intelligently.
Why the July 2026 Windows patches Tuesday Broke Records
Microsoft addressed a staggering 622 CVEs across its entire portfolio this month, with 570 of those directly affecting Windows and Windows Server components. According to BleepingComputer’s full Patch Tuesday breakdown, the release includes 59 Critical-rated vulnerabilities, 510 rated Important, and 3 rated Moderate. Microsoft’s own security engineering team acknowledged that an AI-assisted vulnerability discovery programme has been running internally, which may partly explain the surge in findings being patched together.
For context: the previous monthly record was itself broken just months earlier in 2026, meaning that the scale of software complexity — and the tools to find flaws — are both accelerating simultaneously. Organisations that delay patching are facing a wider attack surface than ever before.
The Two Actively Exploited Zero-Days You Must Patch First
Of the three zero-days in this month’s Patch Tuesday July 2026 release, two were already being exploited in the wild before Microsoft issued fixes. These must be treated as emergency patches regardless of your organisation’s standard patch cycle.
CVE-2026-56164 — SharePoint Remote Code Execution
This is the highest-priority patch in the entire July 2026 batch. CVE-2026-56164 is a remote code execution vulnerability in Microsoft SharePoint Server that threat actors were actively exploiting at the time of release. An authenticated attacker with site owner permissions can upload a specially crafted file to execute arbitrary code in the context of the SharePoint server process. Organisations running on-premises SharePoint farms are most at risk; SharePoint Online users receive protection automatically.
Action: Apply KB updates to all SharePoint Server 2016, 2019, and Subscription Edition instances immediately. Audit site owner account assignments and reduce privilege where possible.
CVE-2026-56155 — Active Directory Federation Services Elevation of Privilege
The second exploited zero-day targets Active Directory Federation Services (AD FS), the identity platform that underpins single sign-on across thousands of enterprise environments. CVE-2026-56155 abuses the Distributed Key Manager container within AD FS to elevate an attacker’s privileges. Given that AD FS commonly sits at the authentication boundary between on-premises infrastructure and cloud services, exploitation here can enable lateral movement into Azure AD/Entra ID environments. Security analysts at Orca Security noted that organisations should not wait for a CISA KEV listing before deploying this fix — patch now.
Action: Update all AD FS servers immediately. Review federation trust configurations and enable audit logging on token issuance.
CVE — Publicly Disclosed (Not Yet Exploited) Zero-Day
A third zero-day was publicly disclosed before the patch was available, meaning exploit code or technical details were already in the open — a race against time for defenders. While not confirmed as exploited in attacks at the time of writing, publicly disclosed vulnerabilities are historically weaponised within days of a patch landing, as attackers reverse-engineer the fix to understand the underlying flaw. Tenable’s analysis lists this vulnerability in the Windows kernel scope. Prioritise it immediately after the two exploited CVEs above.
Breaking Down the July 2026 Windows patches Vulnerability Categories
Understanding the shape of this month’s Windows security updates helps you allocate engineering effort across your patch window. The 570-plus Windows-specific CVEs break down as follows:
-
254 Elevation of Privilege (EoP) — the single largest category. EoP flaws allow locally authenticated (or already-compromised) users to gain SYSTEM or administrator-level access. Critical in post-breach lateral movement scenarios.
-
Remote Code Execution (RCE) — 48 of the 59 Critical vulnerabilities are RCE flaws. The Remote Desktop Client heap-based buffer overflow is among the most severe, as it requires no local access to trigger.
-
Information Disclosure — 21 flaws expose sensitive data, including memory contents and authentication tokens. Often chained with EoP exploits.
-
Denial of Service (DoS) — 20 flaws can crash or degrade Windows services, including some targeting Hyper-V hypervisors.
-
Security Feature Bypass — patches address bypasses of Windows Defender Credential Guard and Smart App Control, among others.
-
Spoofing — several spoofing vulnerabilities affect Microsoft Outlook and Windows authentication prompts.
Additionally, this month’s release set a new sub-record with 416 Windows-platform-specific CVEs — a figure reported by Rapid7’s threat intelligence team, underscoring just how broad the attack surface for Windows endpoints has become.
Which Products Are Affected by July 2026 Vulnerabilities
The July 2026 vulnerabilities span virtually the entire Microsoft ecosystem. The following products received Critical or actively exploited patches:
-
Windows 11 (all versions, including 24H2)
-
Windows 10 (versions 21H2, 22H2)
-
Windows Server 2025, 2022, 2019, 2016
-
Microsoft SharePoint Server (Subscription Edition, 2019, 2016)
-
Active Directory Federation Services
-
Remote Desktop Client and Gateway
-
Microsoft Outlook and Exchange Server
-
Hyper-V and Azure Stack HCI
-
Microsoft Edge (Chromium-based)
Organisations still running Windows Server 2016 or older should note that these releases mark yet another month where legacy infrastructure absorbs a disproportionate share of critical patches — and that the effort to apply each one grows as the underlying platform ages.
Patch Tuesday July 2026: A Prioritisation Framework for Sysadmins
When 600 patches land simultaneously, triage discipline is everything. Use this tiered approach to work through the Patch Tuesday July 2026 backlog without overwhelming your change management process.
Tier 1 — Deploy Within 24 Hours
Patch any system exposed to the two actively exploited zero-days (CVE-2026-56164 and CVE-2026-56155) within 24 hours, or isolate those systems from the network until patches can be applied. This applies to all SharePoint Server on-premises instances and all AD FS server nodes, regardless of whether they are internet-facing.
Tier 2 — Deploy Within 72 Hours
Roll out all 59 Critical patches to internet-facing servers, Remote Desktop Gateway hosts, and Exchange Server infrastructure. The Remote Desktop Client RCE is particularly relevant for environments that allow employees or contractors to connect via RDP from unmanaged devices.
Tier 3 — Standard Patch Window (7–14 Days)
Deploy all Important-rated patches to workstations and internal servers within your normal change window. The 254 elevation-of-privilege fixes in this category are still urgent in environments that have experienced any suspected breach activity, as EoP is a core post-exploitation technique.
Tier 4 — Verification and Rollback Readiness
With 570 patches in a single cycle, regression risk is elevated. Always test on a representative sample of hardware before broad deployment. If you encounter issues, the Windows Update rollback guide covers how to safely remove a faulty patch without leaving your system exposed.
Windows Security Updates and the Role of AI in Vulnerability Discovery
One detail that makes July 2026’s record-breaking volume especially notable is context: Microsoft confirmed it has been using AI-powered tooling internally to scan its own codebase for security weaknesses. The AI assistant identifies potential vulnerabilities that human security engineers might miss in code review, flagging them for triage and fix development. This is a double-edged development — the same class of AI tools is being adopted by threat actors to find vulnerabilities faster than ever before.
The 2026 Microsoft Vulnerabilities Report noted that while total Microsoft CVE volume dropped by 6% year-over-year early in the year, critical vulnerabilities doubled in severity concentration. July’s record release reflects both the AI-assisted discovery pipeline and the growing complexity of Windows as a platform spanning desktop, cloud, virtualisation, and identity services simultaneously.
Keeping Your Windows Licence Current and Patch-Ready
Every fix in the July 2026 batch is delivered through Windows Update and Windows Server Update Services — but only to genuine, activated Windows installations. Machines running counterfeit or unactivated copies of Windows are typically blocked from receiving security updates, leaving them exposed to every vulnerability in this record-breaking batch.
If your organisation is running Windows 11 Pro on endpoints that need to remain current and patch-eligible, it is worth reviewing your licensing position. Shop Key Online supplies 100% genuine Windows 11 Pro Retail keys — fully Microsoft-verified, activating directly with Microsoft’s servers, and eligible for all future security updates including Patch Tuesday releases. Every key is backed by a money-back guarantee and free lifetime activation support.
FAQ
How many vulnerabilities did Microsoft patch in July 2026?
Microsoft released fixes for approximately 622 CVEs across its entire product portfolio in July 2026, with around 570 of those affecting Windows and Windows Server directly. This is the largest Patch Tuesday release in Microsoft’s history. Of the total, 59 are rated Critical and three are classified as zero-day vulnerabilities.
Which July 2026 Windows patches vulnerabilities are being actively exploited?
Two zero-days were confirmed as actively exploited at the time of the July 2026 release: CVE-2026-56164, a remote code execution flaw in Microsoft SharePoint Server, and CVE-2026-56155, an elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS). Both should be patched within 24 hours of your patch window opening.
Does the July 2026 Patch Tuesday affect Windows 10?
Yes. Windows 10 versions 21H2 and 22H2 both received security updates in the July 2026 cycle. Windows 10 reaches end of support on October 14, 2026, after which monthly security patches will cease for most editions. Organisations should factor this into their planning and consider upgrading to Windows 11 before support ends.
What is the best way to deploy 600+ patches without causing outages?
Use a tiered deployment strategy: patch actively exploited zero-days within 24 hours, Critical patches on internet-facing systems within 72 hours, and Important patches within your standard 7–14 day change window. Always test on a hardware sample first, document rollback steps, and use Windows Server Update Services or a third-party patch management platform to stage rollouts by device group.
Will my Windows licence still receive July 2026 patches?
Yes — provided your Windows installation is genuine and activated. All valid retail and OEM licences, including those purchased from authorised resellers like Shop Key Online, receive Patch Tuesday updates automatically via Windows Update. Unactivated or counterfeit copies are typically excluded from security updates, leaving those machines unprotected.
