Microsoft's Largest-Ever Patch Tuesday: 622 CVEs, Two Zero-Days Under Active Attack

Microsoft has shipped its largest Patch Tuesday on record, closing 622 CVEs in a single release — more than triple the previous high set just last month in June. Two of those vulnerabilities are zero-days that attackers are actively exploiting right now, making this a drop-everything update event for every Windows shop.

What Happened

The July 2026 Patch Tuesday release, covered in detail by The Hacker News, landed this week with an unprecedented CVE count sourced directly from Microsoft's Security Update Guide. The previous single-month record stood at roughly 200 CVEs — this release more than triples it. Buried in that avalanche are two vulnerabilities already confirmed as being weaponized in active campaigns, meaning threat actors aren't waiting for defenders to catch up.

The volume spike is not coincidental. Security researchers have flagged that AI-assisted tooling is accelerating both vulnerability discovery and the speed at which proof-of-concept exploits reach attacker infrastructure, compressing the window between patch release and exploitation.

Why It Matters

Two actively exploited zero-days in a single release is a five-alarm event. "Under active attack" is not theoretical — it means adversaries have working exploits in the wild and are using them against unpatched systems today. Every hour your Windows fleet stays unpatched is an hour attackers can move laterally, escalate privileges, or exfiltrate data through those specific holes.

The record-breaking volume also introduces triage fatigue risk. At 622 CVEs, security teams face a real danger of losing the critical items in the noise, creating blind spots that attackers will probe. And with this many fixes in a single release, the statistical probability that additional CVEs have silent exploitation underway — not yet confirmed by Microsoft — is meaningfully higher than a normal cycle.

If your patch SLA assumes a 30-day window for critical updates, this release is the evidence you need to revisit that policy.

What To Do

Apply patches immediately. Don't wait for the next scheduled maintenance window if you can avoid it. Work through this sequence:

1. Isolate the zero-days first. Pull the full advisory from Microsoft's Security Update Guide and filter by "Exploitation Detected." Those CVEs are your P0 items — treat them as a 24–72 hour SLA regardless of your normal cycle.

1. Sequence by exposure. Deploy to internet-facing systems first: VPN endpoints, RDP-accessible servers, domain controllers, anything reachable from the public internet. Follow with internal credential-holding systems.

1. Check for existing compromise. Patching closes the door but doesn't undo a breach that already happened. Review authentication logs and EDR telemetry on high-value systems for anomalies dating back at least two weeks.

1. Plan for regression. A release this large has a higher-than-normal probability of breaking something. Stage your rollout, monitor application health aggressively post-patch, and have rollback procedures ready before you start.

1. Revisit your patch cadence. If active zero-days are shipping monthly at this volume, a 30-day standard SLA is no longer defensible for critical and exploited-in-wild classifications. Push for a tiered policy: exploited-in-wild gets 72 hours, critical-not-exploited gets 7 days.