Microsoft fixed a record 570 flaws and still left a Windows zero-day unpatched

Microsoft’s July Patch Tuesday fixed 570 security flaws, the largest single batch it has ever shipped. Two were already under attack when the updates landed on July 14. The Windows zero-day drawing the most attention this week isn’t in the release at all, and it still runs on fully patched machines.

The scale is the headline. The risk is a much shorter list: two flaws under active exploitation, one unpatched registry bug with a working public exploit, and a Defender fix that opened a fresh hole. For anyone running Windows in production, this month is about triage, not volume, and the sheer count of fixes makes getting that order right harder than usual.

A record set by machines

The 570 figure isn’t a rounding artifact. Microsoft’s advisory tally breaks down to 254 elevation-of-privilege bugs, 145 remote-code-execution flaws (RCE), 102 information-disclosure issues, 35 denial-of-service bugs, 17 security-feature bypasses, and 16 spoofing flaws. Fifty-nine are rated Critical. That’s roughly four times the 137 CVEs Microsoft fixed in July 2025, and it clears last month’s record too.

Microsoft ties the surge to an internal AI system that hunts for bugs across the Windows codebase, and the pace shows. More findings mean more fixes, and more of the attack surface exposed with every cumulative update. This is a separate story from the Secure Boot certificate expiry we covered earlier: that was a clock running out on trust anchors. This is raw vulnerability volume, and it changes how you have to triage a monthly rollup.

Two flaws already under attack

If you triage nothing else, start with the two zero-days that attackers are already using. CVE-2026-56155 is an elevation-of-privilege hole in Active Directory Federation Services, and Microsoft’s advisory states that “insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.” The second, CVE-2026-56164, is a missing-authentication flaw in on-premises SharePoint Server that lets an unauthenticated attacker escalate privileges over the network.

SharePoint is the one to watch. Incident responders at Google’s Mandiant found it exploited in live attacks, chained with older SharePoint bugs to steal IIS machine keys, plant persistence, and drop malware. CISA added it to its Known Exploited Vulnerabilities catalog with a July 17 fix deadline for federal agencies. A third zero-day, a BitLocker bypass tracked as CVE-2026-50661, was publicly disclosed but needs physical access, so it ranks lower.

The zero-days the patch left open

Here’s the twist. The Windows flaw generating the most noise this week, nicknamed LegacyHive, wasn’t patched at all. A researcher going by Nightmare Eclipse published a working exploit within hours of Patch Tuesday. It abuses the Windows User Profile Service to let a standard, non-admin user mount another account’s registry hive in full-access mode, an administrator’s included, then read stored secrets or rewrite values that run the next time that user logs in. It works on Windows 10 2004 and later and Windows Server 2019 and later, fully patched.

Microsoft hasn’t assigned a CVE. Its statement: “Microsoft is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims.” In the meantime, ACROS Security’s 0patch service shipped a free micropatch on July 20 that applies without a reboot. “With 0patch enabled, the exploit still seems to work, but it loads a temporary user profile hive instead of that from adminuser,” the company wrote.

Then there’s Windows Defender. The July update fixed RoguePlanet (CVE-2026-50656), a Defender flaw that let a remote attacker take admin control even with real-time protection turned off. The fix introduced a new problem: the patched engine can be tricked into caching an oversized file until it fills the disk. “I found a small exception to this rule,” Nightmare Eclipse wrote of the size cap Defender normally enforces, and “the spynet functions in mpengine.dll really wants to keep a local copy of Zone.Identifier ADS file and it does not matter how big this file is, Windows Defender will cache it locally anyways.” A malicious SMB server can hold the connection open and let Defender write until the volume is full.

What this means for you

Patch order matters more when there are 570 fixes than when there are 100. Do the two exploited bugs first: the AD FS and SharePoint zero-days are being used right now, and if you run on-prem SharePoint, the machine-key theft means a patch alone may not clear you, so rotate keys and hunt for persistence. LegacyHive has no official fix, so if you manage multi-user Windows boxes where a standard account could pivot to admin, 0patch’s micropatch is the stopgap until Microsoft ships one. Keep an eye on the Defender disk-fill behavior on any machine that mounts untrusted SMB shares. And don’t read the record number as Microsoft getting sloppier. More bugs found and fixed beats the same bugs sitting undiscovered, though it does mean “just install the updates” no longer covers you when the flaw that matters ships without a patch.