Microsoft released the largest Patch Tuesday update in its history on July 14, addressing a record-breaking 570 security flaws across Windows and other Microsoft products.
The release included 59 vulnerabilities rated critical and three zero-day vulnerabilities. Two of the zero-days were already being exploited when Microsoft issued the fixes.
The number is significant, but business leaders do not need to study hundreds of individual vulnerability reports. The more important question is whether their computers, servers, and other affected systems successfully received the updates.
Why Some Reports Say Microsoft Fixed 622 Vulnerabilities
Readers may see different totals in coverage of the July release.
Microsoft’s broader July 2026 Security Update Guide includes 622 vulnerabilities. Some same-day Patch Tuesday analyses count 570 because they exclude security fixes Microsoft released earlier in the month for products such as Azure, Microsoft 365 Copilot, Exchange Online, and other services.
Both methods identify July 2026 as Microsoft’s largest Patch Tuesday release to date. This article uses 570 when referring specifically to the vulnerabilities counted in the July 14 Patch Tuesday release.
Two Vulnerabilities Were Already Being Exploited
The July update addressed two vulnerabilities that attackers were already using.
The first, CVE-2026-56155, affects Active Directory Federation Services, often called AD FS. The vulnerability could allow an attacker who already has authorized access to obtain higher administrative privileges.
The second, CVE-2026-56164, affects Microsoft SharePoint Server. It could allow an unauthorized attacker to gain elevated privileges remotely over a network.
The Cybersecurity and Infrastructure Security Agency added both vulnerabilities to its Known Exploited Vulnerabilities Catalog, confirming that the risks were not only theoretical.
A third zero-day, CVE-2026-50661, affects Windows BitLocker. Microsoft reported that someone with physical access to a vulnerable computer could potentially bypass BitLocker protection and access encrypted data. The vulnerability had been publicly disclosed, but Microsoft had not reported active exploitation when the patch was released.
Why Was This Patch Tuesday So Large?
A record number of fixes does not automatically mean Microsoft products suddenly became less secure.
Microsoft says AI-powered vulnerability discovery is helping its security teams examine more code, identify weaknesses earlier, and validate potential issues faster. The company warned before the July release that customers should expect the volume of security updates to increase as these methods improve.
Finding more vulnerabilities gives Microsoft an opportunity to correct them before attackers discover or exploit them. However, attackers may also use AI to analyze newly disclosed weaknesses and build attacks faster.
For businesses, that could mean shorter response windows and larger monthly update cycles.
Releasing a Patch Does Not Mean Every Device Is Protected
Microsoft provides the fixes, but each organization still needs a reliable process for installing and verifying them.
A laptop may be offline when updates are deployed. An installation may fail. An employee may postpone a required restart. An older computer may no longer be eligible for security updates. A critical server may need compatibility testing before a change can be installed.
From our experience managing business environments, a patch can be approved for deployment without reaching every system. Devices may remain exposed because they were offline, the installation failed, a restart is still pending, or the operating system is no longer supported.
That is why turning on automatic updates is not the same as having verified patch management.
Patch Tuesday response check
Can your business answer yes to these questions?
Installing an update is only one step. A reliable process should also show which systems were updated, which were missed, and who is responsible for resolving the exceptions.
- We maintain an accurate inventory of computers and servers.
- We can verify whether critical updates installed successfully.
- We can identify devices that were offline or missed deployment.
- We track computers waiting for a required restart.
- Unsupported devices are documented and scheduled for replacement.
- Someone is accountable for failed updates and unresolved exceptions.
Several “no” answers may mean that updates are occurring, but patching is not being fully verified or managed.
What Verified Patch Management Should Include
A dependable patch-management process should answer more than whether updates are enabled.
It should include:
- An accurate inventory of computers and servers
- A way to prioritize actively exploited and critical vulnerabilities
- Controlled testing for important business systems
- Scheduled deployment and restart windows
- Reporting that identifies successful and failed installations
- Follow-up for devices that were offline
- Documentation for systems that cannot be updated
- Clear responsibility for resolving exceptions
The goal is to make sure testing does not become an indefinite delay and that every unresolved update has an owner.
Five Questions Business Leaders Should Ask
Business leaders do not need to personally manage Windows updates. They should, however, be able to get clear answers to these questions:
- Do we know which devices and servers were affected?
- Can we verify that the updates installed successfully?
- Which systems failed, were offline, or still need to restart?
- Are any computers running unsupported operating systems?
- Who is responsible for resolving missed updates?
“Windows Update is turned on” is not a complete answer.
Patching Is Only One Part of Cybersecurity
Software updates close known vulnerabilities, but they cannot compensate for weak passwords, missing multifactor authentication, excessive administrative access, poor backups, or suspicious activity that nobody is monitoring.
Patching should be part of a broader cybersecurity program that connects device management, access control, monitoring, backup, employee support, and incident response.
Businesses without dedicated internal IT resources may benefit from managed IT services that bring patching, monitoring, support, security, and technology planning under one accountable process.
This is also a practical way to evaluate whether an IT provider is truly proactive. A proactive provider should be able to identify missing devices, failed updates, recurring problems, and aging systems before they create a larger interruption.
How Micro Solutions Helps
Micro Solutions helps small and mid-sized businesses manage updates as part of a broader approach to IT support and cybersecurity.
Through TotalCare, patching works alongside system monitoring, helpdesk support, security management, backups, documentation, and long-term planning. The objective is not simply to send out updates. It is to confirm that important systems are being maintained and that someone follows up when an update does not go as planned.
Microsoft’s record Patch Tuesday is a reminder that the number of vulnerabilities businesses must address is increasing. Clear ownership and reliable verification will matter more than ever.
Know what is actually protected
Not sure whether every system is receiving critical updates?
A practical IT review can help identify missed devices, unsupported systems, failed updates, and unclear responsibilities. Micro Solutions can help you understand what is being managed well and where your patching process may need attention.
Frequently asked questions
Microsoft Patch Tuesday FAQs
What is Microsoft Patch Tuesday?
Patch Tuesday is Microsoft’s regular monthly release of security updates and software fixes. It normally occurs on the second Tuesday of each month.
How many vulnerabilities did Microsoft fix in July 2026?
Same-day Patch Tuesday reporting counted 570 vulnerabilities. Microsoft’s broader July security release included 622. The difference comes from whether vulnerabilities released earlier in the month are included in the total.
What is a zero-day vulnerability?
A zero-day is a vulnerability that was publicly disclosed or actively exploited before an official fix became available. Microsoft’s July release addressed three zero-days, including two that were already being used in attacks.
Does Windows automatically install every security update?
Windows can install many updates automatically, but installations can still fail or remain incomplete. Devices may also be offline, waiting for a restart, or running an operating system that no longer receives security updates.
Should businesses install every patch immediately?
Actively exploited and high-risk vulnerabilities should be prioritized. Critical business systems may require compatibility testing and a rollback option before deployment. Testing should reduce disruption without creating an indefinite delay.
How can a business verify that its systems were updated?
A business should have centralized reporting that identifies successful installations, failed updates, offline devices, pending restarts, and unsupported systems. Someone should also be accountable for resolving each exception.