Microsoft’s July 2026 Patch Tuesday arrived on July 14 with an unusually large security payload. The cumulative updates cover 570 distinct vulnerabilities—including 61 critical flaws and three zero-days already under active exploit—making this one of the heaviest patching months in recent memory.

For end users, that means hitting “check for updates” immediately. For IT administrators, it means accelerated deployment through standard rings and close monitoring of known issues. The update package affects every supported Windows release.

What exactly arrived on July 14

The servicing stack is straightforward but broad. The key packages:

  • Windows 11 24H2 and 25H2 receive KB5101650, taking OS Builds to 26100.8875 and 26200.8875 respectively.
  • Windows 11 23H2 gets KB5099414, moving to Build 22631.7376.
  • Windows 10 22H2 picks up KB5099539 on builds 19044.7548 and 19045.7548; other supported Windows 10 editions also receive the same cumulative package.

BleepingComputer’s count pegs the total at 570 vulnerabilities, though a sidebar on their Windows 11 coverage cites 571—a minor discrepancy that doesn’t change the urgency. Sixty-one of the bugs are rated critical, and three are confirmed zero-days with evidence of exploitation before the patch landed.

Beyond CVE counts, the updates include maintenance fixes that matter disproportionately in managed environments. A Recycle Bin bug that could expose internal filenames during deletion gets squashed; the secure boot certificate handling sees further refinement; and SHA-2 support expands for trusted Remote Desktop Publishing publishers. These aren’t flashy changes, but they can break authentication chains and remote access workflows if not validated.

Microsoft also refreshed its Media Creation Tool images with July’s cumulative updates. New Windows 11 deployments created from those images won’t start life multiple patch cycles behind, which helps reduce the post-install update burden.

Why this month is different—and what’s at stake

Zero-day revelations always raise the urgency dial. When attackers are already using a vulnerability before a fix ships, every hour of delay widens the window for compromise. This month’s three zero-days cover the gamut: privilege escalation, remote code execution, and information disclosure, according to details trickling out through the Microsoft Security Response Center.

The sheer volume of 570 CVEs also strains normal patch management cadences. Even organizations with mature deployment pipelines may need to compress testing windows. Microsoft didn’t bundle the July updates with out-of-band fixes, so the entire payload lands at once.

Lifecycle pressure adds another layer. Windows 11 24H2, Windows Server 2022, and Windows 10 Enterprise LTSB 2016 all reach end of support on October 13, 2026. OneDrive sync support for Windows 10 22H1 and earlier ends even sooner—August 15, 2026. Systems still running those builds face a countdown where unpatched vulnerabilities become permanently exposed after the cutoff unless extended security updates are purchased.

What end users should do right now

For most people running Windows Update automatically, the patch installs itself within a day or two of release. But a manual check speeds things up: open Settings > Windows Update and click “Check for updates.”

After the reboot, a quick sanity check avoids surprises:

  • Confirm your version and build number against the list above by typing “winver” into the Start menu.
  • Launch your most-used applications—especially browsers, VPN clients, and remote desktop tools—and verify they connect and behave normally.
  • If you use OneDrive, ensure files still sync and the status icons appear correctly. The lifecycle warning isn’t about the July patch, but it’s a useful reminder to verify your cloud backup is current.

If something breaks, a rollback is straightforward. Go to Settings > Windows Update > Update history > Uninstall updates, select the cumulative update, and follow the prompts. But treat that as a temporary step while you troubleshoot; leaving the system unpatched against 570 vulnerabilities is not a long-term solution.

IT administrators: a condensed checklist

The scale of this release makes it a “patch tonight, not this weekend” situation even for conservative shops. Here’s a focused action plan:

  1. Inventory by build number. Use Intune, Configuration Manager, or your RMM platform to identify devices on Windows 11 24H2/25H2, Windows 11 23H2, and Windows 10 22H2. Prioritize any internet-facing machines and those holding sensitive data.
  2. Validate line-of-business apps. The Recycle Bin fix and SHA-2 changes have implications for file-handling applications and RDP gateways. Spin up a pilot ring that tests not just logins, but actual workflows—delete a file, establish an RDP session, run a secure boot attestation.
  3. Deploy in phases. Push to the pilot ring immediately, wait 24-48 hours for early signals, then accelerate to production.
  4. Watch known-issue channels. Microsoft’s Windows release health dashboard and third-party trackers (BleepingComputer, Neowin) often surface gotchas within the first week.
  5. Tackle lifecycle exposure. For machines running Windows 10 22H1 or earlier, note the August 15 OneDrive cutoff and the October 13 broader EOS. Plan migrations or ESU purchases now rather than after the deadline.

Beyond patch Tuesday: account security, search updates, and a Fallout bombshell

Account recovery remains a weak link. Two high-profile cases this week illustrated the fragility of Microsoft account security. Streamer Joshua Khane reported being permanently locked out after his account was compromised and its security details changed; only after widespread media attention was his account restored on July 16. In Brazil, a court ordered Microsoft to restore a hacked and suspended account and pay approximately $400 in damages. Neither case creates a universal precedent, but they underscore a hard truth: when an attacker alters the very credentials recovery depends on, the system too often fails the legitimate user.

The practical takeaway for anyone with a Microsoft account: treat it like a primary identity. Enable passwordless sign-in or a strong unique password plus multifactor authentication. Keep recovery email and phone numbers current. Maintain an independent backup of OneDrive data. Store receipts, subscription records, and device serials offline—they may be the only proof of ownership during a recovery dispute.

Windows Search finally gets a privacy-first toggle. An Experimental channel rollout now lets users disable web and Microsoft Store suggestions from Windows Search. Found under Settings > Privacy & security > Search, the switch removes promotional clutter and turns search into a local-first tool. The update also improves typo tolerance and labels results more clearly. It’s a welcome shift in product philosophy, though it’s currently limited to testers.

Fallout 5 is real, but it’s in pre-production. Bethesda confirmed the next Fallout is being built on Creation Engine 3 alongside The Elder Scrolls VI, which remains the studio’s primary focus. Remasters of Fallout 3 and Fallout: New Vegas are also planned. For Windows and Xbox players, “pre-production” means the game is years away; the near-term signals will be the remasters and the engine’s modding capabilities.

What to watch next

The July patches will generate feedback for at least two weeks. Administrators should monitor the Windows release health dashboard and community forums for any latent compatibility issues. The August Patch Tuesday will likely be lighter, but the lifecycle deadlines loom. With three months until the October end-of-support wave, every sustained Windows 10 deployment needs a concrete migration or extended-support plan. Meanwhile, the search improvements rolling out in Experimental suggest a broader availability could arrive with the 24H2 fall update—a quiet but meaningful quality-of-life upgrade.