Microsoft Patches Record 570 Vulnerabilities and Credits AI for Finding Them
Microsoft released patches for 570 security vulnerabilities on July 15, 2026, the largest single-month security fix release in the company’s history. The update beat the previous record set in October 2023. Microsoft credited AI-powered vulnerability scanning tools for discovering the majority of the flaws, many of which had been sitting in legacy code for years without detection.
Three of the vulnerabilities were zero-days. Two were already being exploited by attackers before Microsoft had a chance to patch them.
The Numbers Are Hard to Ignore
July 2025 had 137 patches. June 2026 had 200. July 2026 had 570.
That is a 316 percent increase year over year. Microsoft has patched 1,308 vulnerabilities in the first seven months of 2026 alone, nearly double the same period last year, according to Windows Latest.
The breakdown of this month’s 570 fixes: 254 elevation-of-privilege vulnerabilities, 145 remote code execution flaws, 102 information disclosure issues, 35 denial-of-service bugs, 17 security feature bypass vulnerabilities, and 16 spoofing flaws. Of the total, 59 carry a Critical severity rating.
The Two Zero-Days Being Actively Exploited
Two vulnerabilities required immediate action from every IT team because attackers were already using them before the patch existed.
CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services. An authenticated attacker can use it to escalate from a limited account to system administrator level. Microsoft credited its own Detection and Response Team with discovering this one, which suggests it surfaced during live incident investigations.
CVE-2026-56164 affects Microsoft SharePoint Server. Missing authentication for a critical function allows an unauthenticated attacker on the network to escalate privileges remotely. SharePoint is in production at hundreds of thousands of organizations worldwide.
A third zero-day, CVE-2026-50661, is a BitLocker security feature bypass that allows an attacker with physical access to read encrypted data. Microsoft said this has been publicly disclosed but has not seen active exploitation yet.
What MDASH Is and Why It Matters
The AI system behind most of these discoveries is called MDASH, Microsoft’s Multi-Model Agentic Scanning Harness.
MDASH uses multiple AI models and more than 100 specialized AI agents to analyze code, identify potential vulnerabilities, debate findings among themselves, and validate whether the issues are real before flagging them. It runs around the clock across the full Windows codebase.
Microsoft deployed MDASH more broadly through the first half of 2026. In May, the company noted MDASH had autonomously found 16 vulnerabilities. By July, it was running across the entire codebase.
Windows chief Pavan Davuluri wrote in a blog post on July 9: “The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis.”
This Is Not a Sign Windows Got Less Secure
That is the counterintuitive part that most coverage misses.
Microsoft is not finding more vulnerabilities because the codebase suddenly became more broken. Many of these flaws have been sitting in legacy code for decades, undetected because humans simply cannot scan that much code at that speed. AI can.
This is what proactive security actually looks like at scale. Find the bugs before attackers do, patch them, and ship the fix before exploitation happens. The uncomfortable side effect is that Patch Tuesday gets very large very fast.
Davuluri said directly that Windows users should expect “a higher volume of security updates” going forward as AI continues expanding what is findable.
What IT Teams Need to Do Right Now
The two actively exploited zero-days are the priority. Any organization running Active Directory Federation Services or SharePoint Server on-premises needs to treat these as urgent patches, not scheduled maintenance.
Beyond the zero-days, security researchers flagged CVE-2026-48561, a remote code execution flaw in Microsoft Copilot with a 9.6 CVSS threat score that allows an unauthorized attacker to execute code over the network.
Krebs on Security noted that many of this month’s vulnerabilities involve chaining from one weakness to another. That is particularly important context because chained vulnerabilities are harder to detect manually and exactly the kind of issue AI scanning identifies faster than human researchers.
The operational message is straightforward: enterprises need to move patch management faster and plan for monthly releases of this scale to be the new normal, not an exception.
