Microsoft's Biggest Patch Tuesday Ever: 622 Flaws, Two Exploited Zero-Days

July 2026 is the largest security release in Microsoft’s history: 622 CVEs, more than triple the previous monthly high of around 200. Sixty-three are rated Critical, 26 score above CVSS 9.0, and two zero-days are already being exploited in the wild — a SharePoint Server privilege-escalation flaw and one in Active Directory Federation Services. The breakdown: 416 Windows bugs, 82 in Office, 46 in Edge, and 17 in SharePoint Server. If you run Windows infrastructure, the exploited SharePoint and AD FS flaws are the ones to patch first — attackers are not waiting.