Microsoft's AI bug-hunting surfaces a record 570 flaws in a single Patch Tuesday

What happened

Microsoft's July 2026 Patch Tuesday, released on July 14, set a new record: 570 security vulnerabilities patched across Windows and other Microsoft products. That figure is nearly triple the count from the previous month's already record-breaking release.

The breakdown is striking in its breadth: 254 elevation-of-privilege (EoP) flaws, 145 remote code execution (RCE) bugs, 102 information disclosure issues, 35 denial-of-service vulnerabilities, 17 security feature bypasses, and 16 spoofing flaws. Fifty-nine of the 570 carry a Critical severity rating, meaning attackers could potentially seize remote control of a Windows device with little or no user interaction.

Microsoft attributed the surge to its deployment of an AI-powered vulnerability-discovery system that proactively scans its Windows codebase for flaws. In a July 9 blog post, Executive Vice President Pavan Davuluri warned that Windows users would notice "a higher volume of security updates included in each security release" as a result of AI-aided discovery.

Three zero-day vulnerabilities were addressed in this release, two of which were already being exploited in the wild:

• CVE-2026-56155 — An elevation-of-privilege flaw in Active Directory Federation Services (ADFS) caused by insufficient access-control granularity. Microsoft's own Detection and Response Team surfaced it during incident investigations. The company has also begun hardening the Access Control List on the AD FS Distributed Key Manager container.
• CVE-2026-56164 — An elevation-of-privilege vulnerability in Microsoft SharePoint Server involving missing authentication for a critical function, allowing an unauthorized network attacker to escalate privileges.
• CVE-2026-50661 — A security feature bypass in Windows BitLocker that could allow attackers with physical access to a device to gain access to encrypted data. This flaw has been publicly disclosed but Microsoft says it is not aware of active exploitation.

Separately, a researcher known as Nightmare Eclipse published a proof-of-concept exploit for an unpatched Windows EoP vulnerability dubbed "LegacyHive" following the release.

Why it matters

This Patch Tuesday signals a structural shift in how vulnerabilities are found and fixed. AI has dramatically lowered the cost of discovering software flaws, meaning the volume of patches is unlikely to return to prior levels anytime soon.

Trey Ford, chief strategy and trust officer at Bugcrowd, framed the economic reality bluntly: "AI has collapsed the cost of finding vulnerabilities, and this increase in volume is a new floor, not the ceiling… at least for a while." He urged leadership teams to stop treating patch volume as a monthly surprise and instead fund it as a fixed operating cost.

Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, emphasized the urgency of the ADFS zero-day: "AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly."

For IT and security teams, the message is clear: the patching workload is now permanently larger, and the window between discovery and exploitation may be shrinking.

What to watch

• Whether August's Patch Tuesday continues the upward trend in vulnerability counts, validating the "new floor" thesis.
• How quickly organizations deploy patches for the two actively exploited zero-days (CVE-2026-56155 and CVE-2026-56164), particularly those running ADFS or SharePoint Server.
• Whether Nightmare Eclipse's LegacyHive PoC prompts an out-of-band patch from Microsoft.
• Broader industry adoption of AI-driven vulnerability discovery tools by other major software vendors, which could multiply patch volumes across the ecosystem.