Microsoft Ships 570 Security Patches in Single Release Using AI

Microsoft delivered 570 security patches in its July 2026 monthly update—a record volume the company attributes directly to artificial intelligence tools that help engineers discover previously hidden vulnerabilities in decades-old code.

The massive batch of fixes, released Tuesday as part of the company's regular "Patch Tuesday" cycle, addresses flaws across Windows, Office, and other Microsoft product lines. Among them are two zero-day vulnerabilities that attackers exploited before Microsoft became aware of them.

One zero-day affects Windows Server and allows attackers to escalate privileges from limited user accounts to full system administrator access. The second targets SharePoint file-sharing servers, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue warnings that hackers were actively using the flaw to compromise organizations.

Why it matters

This release signals a fundamental shift in how security vulnerabilities will be discovered and disclosed. As AI models become more sophisticated at analyzing code, enterprises should expect dramatically higher patch volumes—not because software is less secure, but because dormant flaws that have existed for years are finally being surfaced. IT teams will need to scale their patch management processes accordingly, while software vendors face pressure to accelerate remediation cycles for issues that AI can now detect faster than human researchers.

AI accelerates vulnerability discovery

Microsoft telegraphed the surge in patches a week before the release. In a blog post, Windows chief Pavan Davuluri wrote that the company's use of AI to help employees uncover security bugs would result in "a higher volume of security updates included in each security release."

The approach leverages machine learning models increasingly focused on cybersecurity analysis. These systems can identify vulnerability patterns in software code that may have remained undetected for years or even decades—a significant capability given that portions of Windows code date back multiple decades.

Security researchers across the industry are adopting similar AI-assisted techniques, suggesting that elevated patch volumes may become the norm rather than an anomaly specific to Microsoft.

Implications for enterprise security

The shift creates both opportunities and challenges for organizations. On one hand, AI-driven discovery means vulnerabilities are being identified and fixed before attackers can weaponize them at scale. On the other, IT and security teams must prepare for sustained increases in patch deployment workloads.

The presence of two actively exploited zero-days in this release underscores that threat actors continue to find and leverage vulnerabilities before vendors can address them. Organizations running Windows Server and SharePoint environments should prioritize applying these specific patches immediately.

Details of the record patch release were first reported by Krebs on Security.