Microsoft has released an unprecedented number of security patches during its July 2026 Patch Tuesday, addressing more than 570 vulnerabilities. This record-breaking update includes fixes for two flaws that are already being exploited by attackers: CVE-2026-56155 and CVE-2026-56164. Additionally, one previously disclosed vulnerability, CVE-2026-50661, received a patch. The sheer volume of fixes is largely attributed to the growing use of artificial intelligence in vulnerability discovery, both by Microsoft and by external security researchers and malicious actors.

The Scale of the July 2026 Patch Tuesday

This month's update dwarfs previous Patch Tuesday releases. Microsoft confirmed that the inclusion of over 570 CVEs marks a new high, driven by AI-powered scanning tools that can rapidly identify potential flaws across millions of lines of code. The company had pre-announced that its internal bug hunting efforts had been supercharged by machine learning models, leading to a surge in discovered vulnerabilities. This trend mirrors the broader industry shift where AI is being used to automate code review, fuzzing, and static analysis, enabling researchers to find weaknesses at a pace unimaginable just a few years ago.

Critical Vulnerabilities Under Active Attack

CVE-2026-56155: Active Directory Federation Services Elevation of Privilege

One of the most critical flaws patched this month is CVE-2026-56155, an elevation of privilege (EoP) vulnerability in Active Directory Federation Services (ADFS). Microsoft's incident response teams observed this vulnerability being exploited in the wild. The flaw stems from insufficient access-control granularity in the ADFS Distributed Key Manager container. While exploitation requires local access and low privileges, ADFS is a prime target for attackers who have already gained foothold in a network because it serves as a pivot point for lateral movement and privilege escalation. Experts emphasize that organizations should test and deploy this patch urgently, especially given the common pairing of EoP flaws with remote code execution in ransomware attacks. Dustin Childs of TrendAI's Zero Day Initiative stressed the importance of treating this vulnerability with high priority, noting that identity infrastructure is a favorite target.

CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege

Another actively exploited flaw is CVE-2026-56164, an EoP vulnerability in Microsoft SharePoint Server. This vulnerability was reported by Google's incident response team and an anonymous researcher. It is remotely exploitable in low-complexity attacks, meaning attackers can leverage it without advanced skills. While Microsoft notes that enabling the Antimalware Scan Interface (AMSI) on SharePoint servers can mitigate some risk, the recommended action is to apply the security update immediately. The patch also addresses additional SharePoint remote code execution vulnerabilities (CVE-2026-50522 and CVE-2026-58644) and a critical security feature bypass flaw (CVE-2026-55040). The latter was discovered by Rapid7 senior principal security researcher Stephen Fewer and can be chained with another still-embargoed vulnerability to achieve unauthenticated remote code execution. Microsoft expects to release a patch for the second part of the chain in August 2026.

In light of these developments, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations running SharePoint servers to apply additional hardening measures. Attackers are also exploiting two recently patched SharePoint vulnerabilities: CVE-2026-32201 and CVE-2026-45659.

Disclosed but Not Yet Exploited: CVE-2026-50661

CVE-2026-50661 is a Windows BitLocker security feature bypass vulnerability that was publicly disclosed prior to this Patch Tuesday. Microsoft has now released a fix, though there is no evidence of active exploitation yet. Crowdstrike noted that this vulnerability may correspond to the “GreatXML” exploit released by the researcher known as Nightmare Eclipse, which targeted BitLocker. The researcher also published a stripped-down proof-of-concept exploit for an unpatched Windows EoP vulnerability dubbed LegacyHive. This highlights the ongoing challenge of responsible disclosure and the pressure on vendors to patch quickly.

The Role of AI in Vulnerability Discovery and Exploitation

Microsoft has confirmed that the record number of vulnerabilities is partly due to its increased reliance on AI for internal bug hunting. The company stated that AI tools are enabling faster and more comprehensive identification of security gaps in its software. However, the same technology is also being used by external researchers and attackers. As Microsoft noted, the window for deploying patches has shrunk dramatically because attackers can use AI to quickly analyze patches and develop exploits for the underlying vulnerabilities.

To counter this, Microsoft updated its update deployment recommendations, advising organizations to deploy quality updates within three days of release, set deadlines to zero or one day, and keep the update grace period to a maximum of two days. This aggressive schedule reflects the new reality where any delay can be exploited at machine speed.

Shifting the Exploitability Index

Satnam Narang, senior staff research engineer at Tenable, pointed out that the Exploitability Index—Microsoft's rating of how likely a vulnerability is to be exploited—must evolve in the age of AI. For example, CVE-2026-45659 was originally rated “Exploitation Less Likely” yet was later added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Anthropic’s Red Team demonstrated the fragility of the current system: their Mythos Preview model was able to produce proof-of-concept exploits for 13 of 14 vulnerabilities rated “Exploitation Less Likely” or “Exploitation Unlikely.” This indicates that indexes based on human assessment are no longer reliable predictors when AI can quickly generate working exploits.

Recommendations from Five Eyes Cybersecurity Agencies

In response to these evolving threats, cybersecurity agencies from the Five Eyes intelligence alliance has issued guidance for organizations. They recommend integrating AI tools into security operations to enhance vulnerability detection, improve software quality, monitor unusual behavior, and accelerate incident response. Specific actions include reducing the attack surface by limiting access to critical systems, accelerating patching processes and prioritizing updates based on risk, addressing legacy systems (decommissioning them wherever possible), strengthening identity and access controls, and preparing incident response playbooks before breaches occur.

Post-Release Update

After the Patch Tuesday release, Microsoft updated the advisory for CVE-2026-58644, one of the SharePoint RCE vulnerabilities fixed in June but only published this Tuesday, to confirm that it is now being actively exploited. This underscores the dynamic nature of threat intelligence and the need for continuous monitoring and rapid response.

Background on AI-Driven Bug Hunting

The integration of artificial intelligence into cybersecurity has been a growing trend. AI models trained on vast codebases can identify patterns indicative of vulnerabilities, such as buffer overflows, SQL injection points, or improper validation logic. Microsoft itself has been leveraging its internal AI research to augment its security teams. However, the same capabilities are accessible to malicious actors who use AI to reverse-engineer patches or scan for zero-day flaws. This arms race is driving both the volume of vulnerabilities discovered and the speed at which they are exploited. The industry is now grappling with the challenges of vulnerability management at machine scale, where manual triage is no longer sufficient. Automated tools that can prioritize patches based on exploitability and asset criticality are becoming essential.

Historical Context

For years, Patch Tuesday has been a predictable monthly event where Microsoft releases security updates. The number of CVEs per month has steadily increased, but July 2026 represents a step change, largely attributable to AI. In comparison, the largest previous Patch Tuesday occurred in November 2025 with around 300 vulnerabilities. The jump to over 570 signals a paradigm shift in how vulnerabilities are discovered. It also raises questions about the sustainability of the current patching model. Organizations that rely on manual testing or lengthy change windows will struggle to keep up, potentially leaving critical systems exposed for longer than acceptable.

Implications for Enterprise Security Teams

Enterprise security teams must adapt to this new reality. The traditional monthly patching cycle may need to be replaced by a continuous deployment approach for security updates. Tools that automate the testing and deployment of patches in staging environments before full rollout can help reduce risk. Additionally, asset inventory and risk assessment are more critical than ever; teams must know which systems are vulnerable and prioritize high-value targets. Identity and access management, network segmentation, and multi-factor authentication remain key defensive layers that can mitigate the impact of unpatched vulnerabilities.

Conclusion

This article has covered the record-breaking July 2026 Microsoft Patch Tuesday, focusing on the two actively exploited vulnerabilities, the role of AI in vulnerability discovery, and the urgent need for organizations to accelerate their patching strategies. The security landscape is evolving rapidly, and defenders must leverage AI as much as attackers do to stay ahead.

Source: Help Net Security News