569 Patches in One Month: Microsoft Just Broke Every Record on the Books

Key points

• Microsoft released patches for 569 security flaws in July 2026, the largest single Patch Tuesday release ever recorded, with 59 rated as the most severe possible.
• Three of those flaws are zero-days, meaning weaknesses that were either already being actively attacked or had details made public before a fix existed.
• Two actively exploited flaws sit inside Active Directory Federation Services and SharePoint Server, both tools large organisations use to control who can log in and access company files.
• SAP also released patches this month, including one rated 9.9 out of 10 on the severity scale, covering its NetWeaver Application Server software used widely in corporate finance and HR systems.
• Security researchers at Tenable predict Microsoft will patch more than 3,000 vulnerabilities by the end of 2025, surpassing the previous full-year record of 1,245 set in 2020.

Microsoft pushed out 569 security fixes in a single Tuesday update. Tenable senior researcher Satnam Narang, writing for CSO Online, confirmed that number doesn't just set a monthly record: July's tally alone pushes 2025's running total past every full-year figure from the last twenty years. We've been tracking SharePoint vulnerabilities since 28 May, and our seventeen SharePoint stories in the last ninety days reflect exactly how that cadence has been accelerating.

The cause is AI. Security researchers now use models trained to behave like attackers, scanning code at machine speed and surfacing in hours what a human team might find in months. Microsoft told customers earlier this month to expect higher patch volumes as a direct result. Narang put it plainly: the volume is "striking, but it reflects how good these tools have become at finding bugs, not how many of those bugs actually pose a risk to organizations."

The failure mode is obvious. Patching teams are already stretched. Tripling the monthly workload doesn't triple the headcount available to fix things.

Should ordinary employees be worried right now?

Two of this month's flaws are being exploited in live attacks. CVE-2026-56155 sits in Active Directory Federation Services (AD FS), the system many companies use to verify employee logins across applications. CVE-2026-56164 affects Microsoft SharePoint Server, where teams store internal documents. Both let an attacker with limited network access quietly elevate themselves to full administrator.

A third flaw, CVE-2026-50661, is a security bypass in Windows BitLocker, the encryption layer that protects data on stolen laptops. Its details are already public, giving attackers a head start before most organisations have applied the fix. Narang noted the disclosure may connect to a researcher known as Nightmare Eclipse or Chaotic Eclipse, though no official confirmation exists.

Dustin Childs, head of threat awareness at TrendAI's Zero Day Initiative, called this the "Mother of All Releases" and flagged CVE-2026-57092, a 9.9-severity flaw in Windows VMSwitch. It lets a low-privileged attacker break out of a virtual machine, a contained computing environment meant to act as a sandbox, and take over the physical host beneath it. In cloud and data centre environments, that's catastrophic.

For anyone outside IT: if your employer hasn't applied July's updates, the realistic risk is credential theft or ransomware, malicious software that scrambles files until a ransom is paid. Anthropic's own Red Team findings are relevant here: its Mythos Preview model produced working proof-of-concept exploits for 13 of 14 vulnerabilities that Microsoft had rated as unlikely to be exploited. That gap between Microsoft's exploitability rating and actual exploitability is the real story of this month.

If you're in IT, start with the AD FS and SharePoint fixes. Everything else queues behind those two.

Operational takeaway: The exploitability index was designed for humans reading advisories. AI doesn't read advisories; it writes the exploit.