Microsoft Breaks Patch Tuesday Record with Over 620 Security Fixes in July

Microsoft has released one of the largest Patch Tuesday updates in its history, fixing more than 620 security vulnerabilities across Windows, Microsoft Office, Exchange Server, Edge, and other products throughout July. The official July Patch Tuesday alone addressed 570 newly disclosed vulnerabilities, shattering the company’s previous monthly record.

The massive update underscores Microsoft’s intensified focus on cybersecurity as attackers continue to target newly discovered vulnerabilities at an accelerating pace.

A Record-Breaking Security Release

July’s Patch Tuesday marks Microsoft’s largest security release to date.

The company had previously set a monthly record by fixing 206 vulnerabilities in June, but July’s total more than tripled that figure. Microsoft has now patched approximately 1,380 vulnerabilities since the beginning of 2026, already surpassing the previous annual record of 1,250 vulnerabilities set in 2020.

Microsoft’s next scheduled Patch Tuesday is set for August 11, 2026.

Windows Receives More Than 400 Security Fixes

The majority of July’s patches target Windows.

Microsoft resolved 413 vulnerabilities affecting supported versions of:

• Windows 10
• Windows 11
• Windows Server

The update arrives shortly after Microsoft extended the Windows 10 Extended Security Updates (ESU) program through October 12, 2027, allowing eligible systems to continue receiving security patches beyond the operating system’s official end of support.

Active Directory Flaw Already Exploited

Among this month’s fixes, CVE-2026-56155 stands out as the only Windows vulnerability currently known to be exploited in active attacks.

The elevation-of-privilege flaw affects Active Directory Federation Services (ADFS) and allows attackers to obtain administrator privileges due to insufficient access controls.

Affected systems include:

• Windows Server 2012 through Windows Server 2025
• Windows 10 versions 1607 and 1809

Organizations running these systems are strongly encouraged to install the update immediately.

Critical Remote Code Execution Vulnerabilities

Microsoft also addressed numerous critical remote code execution (RCE) vulnerabilities across Windows.

Notable fixes include:

• CVE-2026-57092 — A Hyper-V VMSwitch use-after-free vulnerability that enables attackers with limited privileges inside a virtual machine to elevate privileges on the host.
• CVE-2026-56190 — A Remote Desktop Protocol (RDP) flaw allowing specially crafted network packets to execute arbitrary code.
• CVE-2026-50518 — A critical vulnerability affecting DHCP Server.
• CVE-2026-56188 — A Windows Server network driver vulnerability that could allow remote code execution through specially crafted network traffic.

Together, these vulnerabilities highlight the importance of promptly deploying July’s Windows updates.

Office and SharePoint Receive Major Security Updates

Microsoft fixed 97 vulnerabilities in Microsoft Office, nearly doubling June’s total.

Among them were:

• 17 critical remote code execution vulnerabilities
• Numerous flaws that can be exploited simply through the Preview Pane, without opening a document
• Additional “open-and-own” vulnerabilities triggered when malicious Office files are opened

SharePoint Server also received several important fixes.

Notably, CVE-2026-56164, an elevation-of-privilege vulnerability, is already being exploited in the wild. Microsoft also patched CVE-2026-55040, which allows attackers to bypass security protections and access files without authentication, along with critical RCE vulnerabilities CVE-2026-50522 and CVE-2026-58644.

Exchange and Edge Updates

Exchange Server received four security fixes, while Exchange Online received one additional patch.

Among them, CVE-2026-55008 addresses a spoofing vulnerability based on cross-site scripting (XSS) that could allow malicious JavaScript to execute when a user opens a specially crafted email through Outlook Web Access (OWA).

Microsoft also released Edge 150.0.4078.65, based on Chromium 150.0.7871.115, fixing 27 Chromium vulnerabilities. These patches are separate from Microsoft’s official Patch Tuesday count, and when combined with nearly 400 Chromium vulnerabilities addressed earlier in July, the total number of security fixes across Microsoft’s ecosystem exceeds 1,000.

Security Updates Extend to Gaming

Microsoft also issued security updates for several gaming platforms.

For Minecraft Bedrock Dedicated Server, the company has already deployed a fix for CVE-2026-55010, requiring no additional action from server administrators.

Meanwhile, Age of Empires II: Definitive Edition users are encouraged to update promptly. The patched CVE-2026-50663 vulnerability could allow attackers to distribute malicious scenario files capable of placing and potentially executing harmful code on another player’s system.

One of Microsoft’s Biggest Patch Tuesdays Ever

July 2026 represents one of the most significant security update cycles Microsoft has ever delivered. With hundreds of vulnerabilities addressed—including several already under active exploitation—the release reinforces the importance of keeping Windows, Microsoft Office, Exchange, Edge, and related software fully updated to minimize exposure to emerging cyber threats.