July 2026 Patch Tuesday: Microsoft Patches 622 Vulnerabilities Including Two Exploited Zero-Days
Microsoft's July 2026 Patch Tuesday release addresses 622 vulnerabilities, including two actively exploited zero-days and one publicly disclosed zero-day, with 62 rated Critical. The dominant exploitation techniques this month are elevation of privilege (41%), remote code execution (27%), and information disclosure (18%), though the article provides no specific CVE identifiers, affected products, or technical exploitation details.
Detection / HunterAnthropic
What Happened
Microsoft released its monthly batch of security fixes for July 2026, patching 622 flaws in its software - far more than the previous two months combined. Two of these flaws were already being actively used by attackers before the fix was released, and a third flaw was made public but not yet confirmed as exploited. A separate unfixed flaw was also announced by someone else the same day. This affects organizations and individuals using Microsoft software broadly, though the article does not specify which particular products or versions. Because some flaws are already being exploited, organizations should apply Microsoft's monthly updates as soon as possible following their normal testing and deployment process.
Key Takeaways
- Microsoft's July 2026 Patch Tuesday addressed 622 vulnerabilities, a roughly 3x increase from June and 5x increase from May 2026.
- Two zero-day vulnerabilities patched this month were confirmed as actively exploited in the wild.
- One additional zero-day vulnerability was publicly disclosed by Microsoft but not confirmed as exploited.
- A separate, unpatched zero-day vulnerability was disclosed today outside of Microsoft's official release.
- 62 vulnerabilities were rated Critical; elevation of privilege (41%) and remote code execution (27%) are the dominant vulnerability classes this month.
Affected Systems
- Microsoft products (unspecified in article)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| Article references two actively exploited zero-day vulnerabilities and one publicly disclosed zero-day patched by Microsoft in July 2026, but does not provide specific CVE identifiers, affected products, or technical details. | |||
| A separate unpatched zero-day vulnerability was disclosed the same day, outside Microsoft's patch release; no CVE ID or technical detail provided. |
Attack Chain
- Disclosure: Microsoft releases monthly security update disclosing 622 vulnerabilities, including two zero-days already under active exploitation
- Exploitation (pre-patch): Attackers leverage the two exploited zero-days against unpatched systems before or around disclosure
- Public Disclosure: A third zero-day is publicly disclosed by Microsoft without confirmed exploitation, and a separate unpatched zero-day is disclosed by a third party the same day
- Remediation Window: Organizations must prioritize patch deployment across affected Microsoft products to close the exposure window
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide any detection rules, signatures, or queries; it is a high-level Patch Tuesday summary without technical indicators or detection content.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | No specific vulnerability, exploitation technique, or malware behavior is described in sufficient technical detail to assess EDR visibility. |
| Network Visibility | None | No network indicators, C2 infrastructure, or protocol details are provided in the article. |
| Detection Difficulty | Very Hard | Without specific CVE identifiers, affected products, or exploitation technical details, no meaningful detection engineering can be performed based solely on this article. |
Required Log Sources
- Windows Update/WSUS logs
- Patch management/vulnerability scanner reports
- EDR telemetry once specific CVEs are identified
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider monitoring for anomalous privilege escalation attempts on Microsoft systems following this disclosure window, as elevation of privilege represents the largest vulnerability category this month. | EDR process and token manipulation events, Windows Security Event Logs (e.g., 4672, 4673) | Privilege Escalation | Medium - legitimate administrative activity can trigger similar telemetry |
| Consider reviewing external-facing Microsoft services for unusual remote code execution indicators given RCE is the second largest category this month. | Network intrusion detection alerts, application crash logs, unexpected child process spawning from server processes | Initial Access / Execution | Medium - service instability or legitimate patching activity can produce similar signals |
Control Gaps
- Signature-based detection is not applicable without specific CVE or exploit details
- Organizations relying solely on monthly patch cycles may have an exposure window during active zero-day exploitation
Key Behavioral Indicators
- Unexpected elevation of privilege events on systems awaiting patch deployment
- Anomalous process behavior on Microsoft services following public disclosure of the zero-days referenced in this release
False Positive Assessment
Low - the article contains no technical indicators or detection logic to generate false positives; risk relates instead to incomplete prioritization if specific CVE details are not obtained from primary sources.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting; prioritize identifying which of the 622 patched vulnerabilities, especially the two exploited zero-days, apply to your Microsoft asset inventory.
- Consider expediting patch deployment testing and rollout for Critical-rated vulnerabilities identified in this release, particularly the exploited zero-days.
- Consider cross-referencing Microsoft's official July 2026 security update guide for specific CVE details, affected products, and mitigation guidance not covered in this summary.
Infrastructure Hardening
- Evaluate whether vulnerability scanning and patch management tooling can automatically flag assets affected by this month's Critical vulnerabilities.
- Consider reviewing exposure of internet-facing Microsoft services given the high proportion of remote code execution vulnerabilities this month.
- Evaluate whether privileged access management controls could reduce impact from elevation of privilege vulnerabilities pending patch deployment.
User Protection
- If your EDR supports behavioral detection for privilege escalation and exploitation attempts, consider verifying relevant detections are enabled and tuned.
- Consider ensuring endpoint patch compliance reporting captures this month's update cycle for all managed devices.
Security Awareness
- Consider briefing IT and security teams on the scale of this month's release and the presence of actively exploited zero-days to support prioritization decisions.
- Consider incorporating regular Patch Tuesday review into existing vulnerability management awareness and reporting cadences.
