Quick Facts
- Microsoft fixed 622 CVEs in July 2026, more than triple June’s record of 206 and larger than the previous three months combined.
- Microsoft’s agentic AI scanning system, MDASH, orchestrates more than 100 specialized AI agents to find and confirm exploitable bugs across Windows.
- Two zero-days are actively exploited in the wild, one in Active Directory Federation Services and one in SharePoint Server, with federal remediation deadlines already set by CISA.
Microsoft’s July 2026 Patch Tuesday fixed 622 unique CVEs, the largest security update in the program’s history. The release is more than triple June’s record of 206 fixes and larger than the prior three months combined. Microsoft has now patched 1,308 vulnerabilities in the first seven months of 2026, nearly double the same period last year.
The surge is not an accident. On July 9, Microsoft Executive Vice President Pavan Davuluri published a blog post warning that users would see higher volumes of security updates as AI tools accelerate the discovery of flaws. The company’s new agentic scanning system is the primary driver.
The AI System Behind the Numbers
Microsoft’s Autonomous Code Security team built the Microsoft Security multi-model agentic scanning harness, internally known as MDASH. The system orchestrates more than 100 specialized AI agents across multiple model families to discover, debate, and confirm exploitable bugs from end to end.
MDASH runs on dedicated cloud infrastructure built specifically for Windows-scale scanning. A scanner pipeline analyzes critical binaries and sends candidates through a multi-model debate process. Confirmed findings then move to a Windows-specific prove pipeline that filters out false positives before any result reaches an engineer.
The system’s benchmark performance is notable. When re-run against pre-patch Windows components, MDASH achieved 96% recall on 28 Microsoft Security Response Center cases in clfs.sys over five years and 100% recall on 7 cases in tcpip.sys over the same period. Its CyberGym industry benchmark score recently reached 96.55%, a jump of roughly 10% in under three weeks.
Several members of the team that built MDASH came to Microsoft from Team Atlanta, which won the $29.5 million DARPA AI Cyber Challenge by building an autonomous system that found and patched real bugs in complex open-source projects.
What the Patches Cover
Windows accounts for 416 of the 622 CVEs. Office follows with 82, and Microsoft Edge with 46. The full release includes 59 critical vulnerabilities, 48 of which are remote code execution flaws. Products patched include Exchange Server, SharePoint Server, SQL Server, Hyper-V, Azure, GitHub Copilot, and Visual Studio. Age of Empires II and Minecraft Server also received fixes.
Three zero-days are included in the release. Two are actively exploited. CVE-2026-56155 is an elevation of privilege flaw in Active Directory Federation Services that can grant an attacker administrator access. CVE-2026-56164 is a missing authentication vulnerability in SharePoint Server that allows an unauthorized attacker to elevate privileges over a network. Microsoft credited the SharePoint discovery to researchers at Mandiant Incident Response and Google Cloud FLARE OTF.
The third zero-day, CVE-2026-50661, is a BitLocker security feature bypass that requires physical access and is not yet known to be exploited in the wild.
Government and Enterprise Response
The U.S. Cybersecurity and Infrastructure Security Agency added both actively exploited bugs to its known exploited vulnerabilities catalog. Federal agencies have until July 17 to patch the SharePoint Server flaw and until July 28 to address the Active Directory vulnerability.
Microsoft also changed how it presents patch data. Its Security Update Guide no longer lists individual CVEs in the main release. Instead, it shows a summary table with bug counts by product family and a separate notable CVEs section. Individual advisories for each CVE remain available, but the format shift adds friction for security teams that rely on the guide for triage.
For enterprise security and IT teams, the scale of this release presents a real operational problem. Prioritizing patches across 622 CVEs, two active zero-days, and a wide range of affected products requires processes built for smaller, more predictable update cycles. If MDASH continues to accelerate discovery at its current rate, monthly patch volumes of this size may become routine.
Read more: Microsoft patches record number of security vulnerabilities, citing its use of AI