Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month

Microsoft's July 2026 Patch Tuesday update addresses a record 621 Common Vulnerabilities and Exposures (CVEs), marking the largest single-month security release in the company's history¹. This update includes fixes for two exploited zero-day vulnerabilities and critical flaws in SharePoint, Remote Desktop Protocol (RDP), Hyper-V, and Active Directory Federation Services (AD FS). The sheer volume of patches underscores the escalating threat landscape, with the year-to-date total of CVEs already surpassing every other full-year total in the last two decades. The update also encompasses roughly 480 additional bugs in Chromium and Microsoft Edge, further emphasizing the need for prompt action. As zero-day activity continues to target Microsoft products, the window for patching is rapidly shrinking, making it essential for organizations to assess their exposure immediately. This massive update highlights the critical importance of timely patch management to prevent exploitation of known vulnerabilities.