July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days

Microsoft's July 2026 Patch Tuesday update addresses a staggering 622 vulnerabilities, including three zero-day exploits that were publicly disclosed before patches were available¹. The update comprises 59 critical vulnerabilities, with two of the zero-days known to be actively exploited by attackers. This massive patch release triples the number of vulnerabilities addressed in the previous month, underscoring the escalating pace of vulnerability discovery driven by AI-powered tools. The sheer volume of fixes and the presence of zero-day exploits highlight the urgent need for swift patch application to mitigate potential attacks. As attackers are already exploiting some of these vulnerabilities, the window for applying patches and assessing exposure is rapidly shrinking. This matters to security practitioners because the accelerated discovery and exploitation of vulnerabilities demand immediate attention to patch management and exposure assessment to prevent potential breaches.