A Historic Security Update Drops
On July 14, Microsoft released patches for 570 CVEs — the largest single Patch Tuesday in the company’s history. The sheer scale caught many security teams off guard, though the writing had been on the wall for months.
Earlier this year, Microsoft warned that its use of agentic AI to hunt for flaws would inevitably push update volumes higher. That prediction has now landed, hard.
Why 570? AI Changed the Economics of Bug Hunting
Trey Ford, chief strategy and trust officer at Bugcrowd, put it bluntly: “The real story is economic. AI has collapsed the cost of finding vulnerabilities, and this increase in volume is a new floor, not the ceiling … at least for a while.”
His message to leadership teams is direct. Stop treating patch volume like a monthly surprise. Fund it as a fixed operating cost. “The organizations that win won’t be the ones that patch fastest this month. They’ll be the ones who built a process that scales when the next couple months continue to increase.”
This isn’t just a Microsoft story. Google fixed over 460 Edge/Chromium flaws this month alone, and Adobe has shifted its patching cadence to twice monthly. The industry is recalibrating.
Three Zero-Days, Two Actively Exploited
Among the 570 CVEs in this month’s Microsoft patches 570 CVEs batch are three zero-day vulnerabilities. Two have already been exploited in the wild.
CVE-2026-56155: Active Directory Federation Services EoP
This elevation of privilege (EoP) flaw in Active Directory Federation Services lets an authorized attacker elevate privileges locally. Adam Barnett, principal software engineer at Rapid7, noted that eight other AD FS vulnerabilities were also patched, all rated Important on Microsoft’s scale.
“The advisory doesn’t explicitly describe the location of the attacker, but it’s likely that an attacker would need an existing toehold on the target system to chain together with the elevation of privilege opportunity on offer here,” Barnett explained.
CVE-2026-56164: SharePoint Server — No Privileges Needed
The second exploited zero-day is another EoP bug, but this time in Microsoft SharePoint Server. The critical difference? No existing privileges are required. Microsoft has branded exploitation “low complexity.”
The US Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to harden their SharePoint systems in response to active exploitation of this flaw and two others published earlier this year.
CVE-2026-50661: BitLocker Bypass Requires Physical Access
The publicly disclosed zero-day is a Windows BitLocker security feature bypass. It could allow attackers to access encrypted data — but only if they have physical access to the target machine. That constraint limits its immediate danger, but it’s a reminder that encryption alone isn’t a silver bullet.
Breaking Down the Numbers
July’s update flood includes:
- 254 elevation of privilege (EoP) vulnerabilities
- 145 remote code execution (RCE) bugs
- 102 information disclosure flaws
- 59 rated critical, of which 48 are RCE flaws
The RCE numbers are especially concerning. Remote code execution is the kind of flaw that lets attackers take full control of a system without any user interaction.
What Security Teams Should Do Now
Qualys security research manager Mayuresh Dani observed, “This trend was predicted and we’re seeing the evidence of it happening now. As more advanced and frontier AI models become available, we can expect an upward trend to continue and then slow down.”
He added, “What we’re observing is that AI automated fuzzing, LLM-assisted variant hunting, and static analysis at scale are discovering bugs faster than enterprises can remediate.”
Qualys has urged organizations to take four concrete steps:
- Move beyond CVSS-only prioritization. Use the Exploit Prediction Scoring System (EPSS) and CISA’s Known Exploited Vulnerabilities (KEV) catalog instead.
- Adopt tiered-patching SLAs. For example, a KEV-listed CVE or an EPSS score above 0.5 should be patched within 24–36 hours. Classification should be risk-based and will differ per organization.
- Reduce the attack surface. Ensure systems like Active Directory Federation Services aren’t internet-connected. On-premises SharePoint should not have public access. Remote management tools shouldn’t be reachable from anywhere.
- Improve patching practices. Validate updates, monitor installs and system stability on a select group, and support automated rollback. Approved patches should then be pushed to all required systems.
The New Normal Isn’t Temporary
Ford’s closing point is worth repeating: “The intake will not be going back down for a while.” For CISOs and IT operations teams, the era of predictable, manageable Patch Tuesdays is over. The question now is whether your organization has the process maturity to survive the next few months — because the volume is only going one direction.
For more on how AI is reshaping vulnerability discovery, read about Anthropic’s Project Glasswing and its approach to using AI for finding critical software flaws.
