Loading story…
Microsoft warned customers to expect a sustained rise in Windows security updates as it expands AI-assisted vulnerability discovery, then followed with unusually large Patch Tuesday releases that underscored the shift. The company said its multi-model agentic scanning harness, MDASH, is finding more flaws across the Windows codebase and is being paired with updates to Microsoft’s Secure Development Lifecycle to address AI-enabled attack paths while keeping human validation in the loop. External reporting and national CERT coverage highlighted the broader operational impact for defenders as vulnerability volume increases.
The most dramatic release fixed 570 CVEs in a record Patch Tuesday, including three zero-days and two that were exploited in the wild: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in Microsoft SharePoint Server. Microsoft also patched the publicly disclosed CVE-2026-50661 BitLocker security feature bypass, while the prior month’s update addressed 200 CVEs, including the CVE-2026-49160 "HTTP/2 Bomb" denial-of-service flaw, CVE-2026-50507 in BitLocker, and CVE-2026-45586, a Windows elevation-of-privilege bug that could grant SYSTEM access. Security observers said the spike reflects AI-driven fuzzing, variant hunting, and large-scale static analysis, increasing pressure on organizations to prioritize asset inventory and risk-based patching.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft said Exchange Server Subscription Edition Cumulative Update 1 has been delayed, citing the Exchange team's need to handle a larger volume of vulnerability reports, including issues surfaced by AI-assisted bug-finding. The company said it is prioritizing monthly security fixes and will release CU1 only when the build is stable enough and no urgent security payload takes precedence.
In August 2026, Microsoft released security updates for approximately 398 new CVEs across Windows, Office, Azure, Exchange, SharePoint, Teams, .NET, and other products. The release included one actively exploited flaw, CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock, along with numerous critical remote code execution vulnerabilities affecting services such as DNS, WDS, QUIC, HPC Pack, Exchange, and SharePoint.
Microsoft rolled out the mandatory August 2026 Patch Tuesday update for Windows 11 as KB5121003, advancing Windows 11 25H2 to Build 26200.9165 and 24H2 to Build 26100.9165. The update reportedly patched more than 700 security issues and was also published as offline .msu installers in the Microsoft Update Catalog.
On July 14, Microsoft released security updates for 570 CVEs in an unusually large Patch Tuesday. The release included three zero-days, two of which were exploited in the wild: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in Microsoft SharePoint Server.
In a July 9 blog post, Microsoft warned customers to expect a higher volume of Windows security updates because it is using AI-driven techniques to discover more vulnerabilities. The company described its MDASH multi-model scanning harness and said it is updating its Secure Development Lifecycle to address AI-enabled attack techniques.
Microsoft's June Patch Tuesday release fixed 200 vulnerabilities, including 33 critical CVEs and three publicly disclosed zero-days. The update set included fixes for flaws such as CVE-2026-49160, CVE-2026-50507, and CVE-2026-45586.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcezdnet.fr
Open sourcesecurityweek.com
Open sourcebleepingcomputer.com
Open sourceinfosecurity-magazine.com
Open sourceinfosecurity-magazine.com
Open sourceinfosecurity-magazine.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released its June Patch Tuesday updates to address more than 200 vulnerabilities across Windows, .NET, Office, Teams, Exchange Server, Azure, Visual Studio Code, and other products, including three publicly disclosed zero-days: `CVE-2026-45586` in the Windows Collaborative Translation Framework (`CTFMON`), `CVE-2026-49160` in `HTTP.sys`, and `CVE-2026-50507` in Windows BitLocker. The update covered a broad range of impact types, including elevation of privilege, spoofing, denial of service, security feature bypass, information disclosure, and remote code execution, with notable high-severity issues such as `CVE-2026-44815`, a DHCP Client Service RCE flaw rated `CVSS 9.8`, and `CVE-2026-47281`, a Visual Studio Code elevation-of-privilege bug rated `CVSS 9.6`. Researchers described the release as part of a wider 2026 "patch tsunami," estimating roughly 198 to 208 Microsoft CVEs in the June cycle and about 571 CVEs overall when Chromium and other third-party issues were included, with 38 rated critical. One of the zero-days, `CVE-2026-49160`, was detailed as an `HTTP/2` and `HTTP/3` header compression flaw that can trigger resource exhaustion through a "compression bomb," and Microsoft added a `MaxHeadersCount` registry mitigation; the bug was reportedly credited to OpenAI Codex, underscoring claims that AI-assisted discovery is accelerating vulnerability reporting and increasing patch-management pressure on enterprises.
Jul 8, 2026
Microsoft released its largest Patch Tuesday update to date, fixing **206 vulnerabilities** across Windows, Office, Azure, Exchange, SharePoint, SQL Server, Visual Studio, Copilot-related offerings, and other products. Multiple reports said the release included **three publicly disclosed zero-days**, while Microsoft separately noted an earlier out-of-band fix for the actively exploited Microsoft Defender flaw `CVE-2026-41091`. Publicly disclosed issues in the June bundle included `CVE-2026-50507`, a **BitLocker** security feature bypass that could expose encrypted data with physical access and available proof-of-concept code, and `CVE-2026-45586`, a **Windows CTFMON** elevation-of-privilege flaw that could let a low-privileged local attacker gain **SYSTEM** access. JPCERT/CC also warned that Microsoft disclosed active exploitation of `CVE-2026-42897`, a spoofing flaw in **Microsoft Exchange Server**.
Jul 3, 2026
Microsoft released fixes for **165 vulnerabilities** across Windows, Office, SharePoint, Defender, SQL Server, Azure, .NET, and other products in one of its largest Patch Tuesday updates on record. The most urgent issue was **CVE-2026-32201**, an **actively exploited** improper input validation flaw in **SharePoint Server** that enables unauthenticated network-based spoofing and was immediately added to **CISA's Known Exploited Vulnerabilities** catalog. Microsoft also patched **CVE-2026-33825**, a publicly known **Microsoft Defender** privilege-escalation bug with proof-of-concept code, and **CVE-2026-33824**, a critical **remote code execution** flaw in **Windows IKE Service Extensions** affecting IPsec/VPN infrastructure. Researchers flagged **CVE-2026-33827** in **Windows TCP/IP** as potentially **wormable** under certain IPv6 and IPSec configurations. Other high-impact fixes include **CVE-2026-33120**, a **SQL Server remote code execution** flaw that paired with a separate privilege escalation bug (**CVE-2026-32176**) could enable full server compromise, and **CVE-2026-32220**, a **UEFI Secure Boot bypass** that could allow untrusted code to load during the boot process. The release also addressed elevation of privilege flaws across Desktop Window Manager, WinSock, TDI Translation Driver, Windows Push Notifications, Function Discovery Service, WSUS, Remote Desktop Licensing, Azure Monitor Agent, and Windows kernel components; security feature bypasses in Windows Hello, PowerShell, BitLocker, and Windows Shell; information disclosure bugs in Windows GDI, Print Spooler, Web Account Manager, UPnP Device Host, and the Windows kernel; and denial-of-service issues in .NET/Visual Studio and Windows RDBSS. Cumulative updates for Windows Server 2022 and 23H2 bundled security hardening for Kerberos, RDP, Secure Boot, and WDS, with Microsoft warning that Secure Boot certificates begin expiring in June 2026.
Aug 10, 2026