622 CVEs in Microsoft's Biggest Patch Tuesday Ever: Why Every Security Leader Should Pay Attention

622 CVEs in Microsoft's Biggest Patch Tuesday Ever: Why Every Security Leader Should Pay Attention 

Microsoft's own MSRC release notes put July's Patch Tuesday at 622 Microsoft CVEs. That's triple last month's count and the largest single release since the program started.

Here's how it breaks down by product family:

• Windows: 416 vulnerabilities across 35 updates

• Office and Office 2016: 82 vulnerabilities each

• Microsoft Edge: 46 vulnerabilities in one cumulative update

• Developer Tools: 27 vulnerabilities across 36 updates

• SharePoint Server: 17 vulnerabilities across 3 updates

• Azure, SQL Server, Defender, and Exchange Server round out the rest with smaller counts

Windows alone is about two-thirds of this release. If your team has to make hard calls about where to spend limited patching hours, that's the obvious place to start.

"The bug apocalypse has fully descended upon us." — Dustin Childs, Zero Day Initiative

What changed

Last month's surge got pinned mostly on outside researchers running AI against Microsoft's code. This month, Microsoft admitted its own tooling is doing the same thing internally. Per Microsoft's own blog, the company is now applying AI across security analysis to identify patterns faster and scale discovery across the Windows codebase, using a multi-model scanning system called MDASH.

MDASH was built by Microsoft's Autonomous Code Security team and runs more than 100 specialized AI agents across an ensemble of models. It works in two stages: a scanning pipeline flags candidate bugs, then a validation pipeline debates and proves them before anything reaches an actual engineer. Microsoft tested it blind against StorageDrive, a private codebase that had never been publicly released, specifically to rule out the model having seen the code before. It correctly identified all 21 known vulnerabilities with zero false positives.

Microsoft isn't waiting for outside labs to find its bugs anymore. It's running the same class of tooling on itself, and this release is the clearest sign yet.

Why it'll keep climbing

Tenable's Satnam Narang told CyberScoop that Microsoft could top 3,000 CVEs for the full year, which would beat the prior full-year record of 1,245 set in 2020. He also raised a sharper concern about how severity gets assigned in the first place. Per Krebs on Security, Narang cited research from Anthropic's Red Team showing its Mythos Preview model generated working proof of concept exploits for 13 of 14 vulnerabilities that Microsoft's own Exploitability Index had rated unlikely to be exploited. Severity ratings built around what a human attacker finds practical don't hold up as well against a model that doesn't get tired.

The broader industry is seeing the same thing. FIRST revised its 2026 forecast to roughly 66,000 CVEs across all vendors, up from an original estimate of 59,427, and named AI assisted discovery as a primary driver of that jump.

The bugs that actually matter

Three zero-days shipped this month, two of them already under active attack:

• CVE-2026-56155: AD FS elevation of privilege, actively exploited. AD FS is exactly the kind of identity infrastructure attackers pivot through once they're already inside a network.

• CVE-2026-56164: SharePoint Server elevation of privilege, also actively exploited, rated only CVSS 5.3 despite requiring no authentication at all. A good reminder that a low score doesn't always mean low urgency.

• CVE-2026-50661: BitLocker security feature bypass, needs physical access. Tenable notes it was dropped as an uncoordinated disclosure by a researcher known as Nightmare Eclipse.

Two more are worth flagging even though neither is a zero-day. CVE-2026-55040 is a SharePoint authentication bypass found by Rapid7 researcher Stephen Fewer, and it's the first half of a chain that leads to unauthenticated remote code execution. The second half stays embargoed until August's Patch Tuesday, so mark the calendar. And CVE-2026-57092, a Hyper-V VMSwitch elevation of privilege bug scored 9.9, is a use after free that lets an attacker inside a virtual machine escalate all the way to full host compromise.

What to do this cycle

SharePoint Server 2016 and 2019, along with SQL Server 2016, reach end of extended support this month. If you're still running those versions, this is the last month you'll get standard patches, so plan accordingly.

On triage, lean on CISA KEV status first, then exploit probability, then business context. CVSS alone is a weak signal this month given how the SharePoint bug above played out. And while Windows will eat most of your patching time simply because of volume, don't let that crowd out the SharePoint fixes just because their scores look unremarkable next to everything else.

The pattern here isn't subtle. Microsoft brought AI assisted discovery in-house this month, and the release size shows it. Expect August to look similar.