Microsoft released fixes for a record 570 vulnerabilities on Patch Tuesday in July 2026, including three zero-day exploits. The surge reflects the company’s new AI-powered vulnerability discovery system scanning Windows code proactively before attackers find flaws.

Of the 570 flaws, 59 are rated Critical. Two of the three zero-days were already under active exploitation before patches arrived. This urgency means IT teams need to prioritize these updates immediately.

Critical Details

Among the Critical flaws: 48 enable remote code execution, 9 allow elevation of privilege, 1 is a security bypass, and 1 is a spoofing vulnerability. The remote code execution bugs pose the highest risk because attackers can compromise systems remotely without user interaction.

One publicly disclosed zero-day, CVE-2026-50661, affects Windows BitLocker. An attacker with physical access to a device could bypass BitLocker encryption and access data on the system drive. Organizations relying on BitLocker for physical security should patch immediately.

Exploitation Already Underway

The other two zero-days are not disclosed publicly but have been actively exploited. This means threat actors already have working attacks. The window between exploit deployment and patch availability has closed, but systems without the update remain vulnerable right now.

Microsoft attributed the record volume partly to its AI-driven scanning. The company is using machine learning to find bugs at scale, then shipping fixes before malicious actors can discover the same flaws through fuzzing or reverse engineering.

What IT Teams Should Do

Apply patches to all Windows systems without delay. Test in non-production environments first if possible, but the actively exploited flaws justify aggressive deployment even with minimal testing windows. Communicate with users about potential reboots required.

This is the highest-volume Patch Tuesday on record. Treat it as urgent and get systems updated before end of business today if feasible.