{"id":107393,"date":"2026-07-15T21:45:34","date_gmt":"2026-07-15T21:45:34","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/107393\/"},"modified":"2026-07-15T21:45:34","modified_gmt":"2026-07-15T21:45:34","slug":"microsoft-discloses-the-mother-of-all-vulnerability-loads-tripling-junes-previous-record","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/107393\/","title":{"rendered":"Microsoft discloses \u2018the mother of all\u2019 vulnerability loads, tripling June\u2019s previous record"},"content":{"rendered":"

Microsoft\u2019s monthly Patch Tuesday<\/a>\u00a0security program reached an unrivaled pinnacle this month, as the vendor addressed 622 vulnerabilities across its suite of business products and systems.\u00a0<\/p>\n

\u201cThe bug apocalypse has finally descended upon us,\u201d Dustin Childs, head of threat awareness at Trend Micro\u2019s Zero Day Initiative, wrote in a blog post<\/a> Tuesday.<\/p>\n

\u201cThe mother of all releases. To call this record-breaking is an understatement,\u201d he added. \u201cThe CVE count year-to-date exceeds all other years\u2019 totals.\u201d<\/p>\n

The startling increase in vulnerabilities reflects a compounding effect taking root across software as artificial intelligence plays a growing role in discovering and developing patches for defects lurking in error-riddled applications.\u00a0<\/p>\n

Microsoft\u2019s June Patch Tuesday update<\/a> broke the previous all-time record with 206 vulnerabilities.<\/p>\n

The company last week warned forewarned customers and defenders that a flood of defects would be uncovered as it applies its multi-model agentic scanning harness<\/a> (MDASH) to discover and address vulnerabilities at greater speed and scale.<\/p>\n

The monthly exponential rise in Microsoft vulnerabilities already puts the vendor on pace to break a full-year record, ending 2026 with the largest annual collection of defects, beating the previous record of 1,245 CVEs in 2020, Satnam Narang, senior staff research engineer at Tenable, said in an email.\u00a0<\/p>\n

\u201cIt\u2019s probable that we will not only exceed 2,000 CVEs in a calendar year, but potentially over 3,000 CVEs this year or more,\u201d he added.<\/p>\n

\u201cThe volume is striking, but it reflects how good these tools have become at finding bugs, not how many of those bugs actually pose a risk to organizations,\u201d Narang said.<\/p>\n

Microsoft disclosed two actively exploited zero-day vulnerabilities \u2014 CVE-2026-56155<\/a> and CVE-2026-56164<\/a>, privilege escalation defects in Active Directory Federation Services and Microsoft SharePoint Server, respectively.\u00a0<\/p>\n

The monthly batch of patches included 416 defects in Windows, 82 in Office and 46 in Microsoft Edge. More than 1 in 10 vulnerabilities the vendor disclosed \u2014 63 total \u2014 were rated as critical.<\/p>\n

\u201cThe products covered this month are also astonishing,\u201d Childs said. \u201cJust about everything you\u2019ve ever heard of is getting patched.\u201d<\/p>\n

The full list of vulnerabilities addressed this month is available in Microsoft\u2019s Security Response Center<\/a>.<\/p>\n

SAP also addressed a fresh assortment of vulnerabilities<\/a> Tuesday, including critical defects CVE-2026-44747<\/a> in SAP NetWeaver Application Server and CVE-2026-27690<\/a> in SAP Approuter.<\/p>\n

\t\t\t\t\t\"Matt<\/p>\n

\n\t\t\tWritten by Matt Kapko
\n\t\t\tMatt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University.\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"Microsoft\u2019s monthly Patch Tuesday\u00a0security program reached an unrivaled pinnacle this month, as the vendor addressed 622 vulnerabilities across…\n","protected":false},"author":2,"featured_media":107394,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[24,420,7829,11273,320,7828,23294,4563,28106,55233,318,10718,22073,13709,55571],"class_list":["post-107393","post","type-post","status-publish","format-standard","has-post-thumbnail","category-microsoft","tag-ai","tag-azure","tag-azure-ai","tag-cve","tag-microsoft","tag-microsoft-ai","tag-patch-tuesday","tag-sap","tag-tenable","tag-trend-micro","tag-vulnerabilities","tag-vulnerability","tag-vulnerability-disclosure","tag-vulnerability-management","tag-vulnerability-reporting"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/107393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=107393"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/107393\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/107394"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=107393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=107393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=107393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}