Microsoft’s Mammoth July Patch Tuesday: 570 Flaws, 3 Zero-Days, and an Urgent Call to Update Windows

Microsoft’s July 2026 Patch Tuesday update is not one to treat as routine maintenance. Rolled out on July 14, the cumulative release packs fixes for a staggering 570 vulnerabilities—including three zero-days that were publicly disclosed before patches landed. KB5101650 (Windows 11 24H2 and 25H2), KB5099414 (Windows 11 23H2), and KB5099539 (Windows 10) are essential installations for every Windows device, but they also introduce known compatibility snags and continue a Secure Boot certificate refresh that demands attention from IT departments. Combine that with looming end-of-support dates, and the message is clear: this month’s updates require more than a cursory click on “Check for updates.”

What’s in the July 2026 patches

The headline numbers are extraordinary. According to Neowin’s weekly roundup, the July updates address a total of 570 security flaws. Three of those are classified as zero-days—meaning exploit details or active attacks surfaced before Microsoft could ship a fix. Microsoft has not yet published a full breakdown of those zero-day CVEs, but the volume alone makes this the largest Patch Tuesday batch in recent memory.

KB5101650 advances Windows 11 24H2 and 25H2 to builds 26100.8875 and 26200.8875, respectively. KB5099414 serves Windows 11 23H2, while KB5099539 covers all supported Windows 10 editions. Alongside the security fixes, the updates include two notable compatibility warnings:

• OLE Automation and Office: Third-party applications that rely on OLE Automation may encounter errors when interacting with Microsoft Office. Microsoft advises developers and IT teams to test mission-critical apps that use this inter-process communication mechanism.
• TDI transport hardening: A security change in this update affects software built around unregistered third-party TDI (Transport Driver Interface) transports. Networking tools, VPN clients, and older hardware utilities that depend on TDI could break unless updated or replaced.

Additionally, Microsoft temporarily blocked the update for a subset of Dell systems with Intel processors after Dell reported potential unexpected shutdowns, performance degradation, overheating, and battery drain. This kind of safeguard underscores why even mandatory security patches should be validated in waves.

Who is affected—and how to respond

Home users and small offices

If you own a Windows 11 or Windows 10 PC at home, install the relevant cumulative update immediately. Windows Update will handle the download automatically unless you’ve paused updates. There’s no reason to delay: the zero-days and other critical vulnerabilities expose your system to real-world attacks.

• Check for updates manually: Go to Settings > Windows Update and hit “Check for updates.”
• If your Dell PC isn’t offered the update, don’t force it. Microsoft and Dell are working on a fix. Using third-party workarounds could lead to hardware damage or data loss.
• After installation, perform a quick reboot, and confirm your PC is running build 26100.8875 or 26200.8875 (24H2/25H2) by typing “winver” in the Start menu.

IT administrators and managed fleets

The July patches demand more thorough preparation than a typical Patch Tuesday. The OLE and TDI changes risk breaking older line-of-business applications, so a controlled deployment ring is critical.

• Test thoroughly: Spin up a validation group with a mix of hardware and software. Pay special attention to Office macros, custom automation scripts, and any networking or telephony software that interfaces with the Windows network stack.
• Monitor Secure Boot: Microsoft continues to renew Secure Boot certificates that started expiring in June 2026. This update carries additional certificate and boot manager changes. Check your Windows Update for Business reports and firmware inventories; disconnected or air-gapped machines may fall behind.
• Track Dell advisories: If your organization uses affected Dell/Intel configurations, review Dell’s support bulletin and postpone deployment until the interoperability issue is resolved.
• End-of-support inventory: IT teams should already be cataloging devices running Windows 11 24H2 Home or Pro, which lose support on October 13, 2026. Enterprise and Education editions have until October 12, 2027, but the split licensing complicates lifecycle management. Windows 10 Enterprise LTSB 2016 hits end of support on October 13 as well—plan migrations for industrial PCs, kiosks, or lab equipment now.

Timeline pressure: Support clocks are ticking

Three critical dates loom on the support calendar:

Don’t mistake Windows Server 2022’s transition for a sudden cliff. The server release enters extended support for another five years, so migrations can be strategic rather than panicked. Conversely, Windows 10 LTSB 2016 is a hard stop—devices still on that branch will need a full OS upgrade or replacement.

Secure Boot certificate renewal: Don’t ignore it

The July cumulative update continues a phased rollout of new Secure Boot certificates. Starting in June 2026, Microsoft began refreshing the certificates that underpin the boot-chain trust on Windows devices. A device without the updated certificates will still boot and receive updates, but its long-term security posture degrades—especially against bootkits and early-boot malware.

For most consumer PCs, this renewal is a silent background event. For enterprise fleets, it’s a different story. Firmware configurations, custom boot loaders, dual-boot setups, and devices that have been off the network can all derail what looks like a straightforward certificate update. Administrators should audit Secure Boot status across their endpoints, check for configuration drift, and ensure that recovery procedures exist for machines that fail the update.

Also this week: A calmer Windows Search and an account-security wake-up call

Windows Search cleans up
Microsoft pushed a noteworthy change to the Experimental channel: Windows Search is losing promotional content and getting a new privacy toggle. The update, flagged in a Windows Insider Blog post, removes ads and marketing suggestions from web results, and lets users choose whether to include web and Microsoft Store results at all. Local apps, settings, and files now rank higher when they’re the stronger match, and the search box better handles misspellings and partial names.

For years, Windows Search has been a marriage of local launcher and Microsoft commerce gateway. This refinement shows a rare degree of restraint. The changes aren’t yet in the release channel, but they signal an overdue course correction that will please power users and everyday Windows owners alike.

Microsoft account recovery is not guaranteed
A story that blew up this week serves as a stark reminder: Dutch streamer Joshua Khane lost access to his 25-year-old Microsoft account—along with its email, OneDrive files, Xbox library, and more—after an attacker changed the security details. Neowin first reported the loss, and Video Games Chronicle later confirmed that Microsoft restored the account following media attention.

That’s a happy ending for Khane, but it’s not a reliable safety net for the rest of us. A single compromised Microsoft account can lock you out of Windows sign-in, game purchases, cloud files, and subscriptions. Take these steps today:
- Enable multi-factor authentication (MFA) using an authenticator app, not just SMS.
- Save recovery codes for your Microsoft account in a secure offline location.
- Verify your alternate email and phone number at account.microsoft.com/security.
- Back up irreplaceable OneDrive content to an external drive or another cloud service. Sync is not backup.

Gaming footnote
For those tracking Microsoft’s gaming division, Bethesda announced that Fallout 5 is in pre-production and that Obsidian Entertainment is working on its own Fallout spin-off. The Elder Scrolls VI remains the studio’s primary focus, and remasters of Fallout 3 and New Vegas are also in development, though without release dates. The news doesn’t affect your Windows desktop today, but it’s a bright spot for RPG fans wondering where Microsoft’s Xbox studios are headed.

Your patching checklist

1. Install now: Run Windows Update and install KB5101650 (24H2/25H2), KB5099414 (23H2), or KB5099539 (Windows 10). Don’t defer this one.
2. Check Dell compatibility: If you’re on a Dell Intel system and don’t see the update, wait for the all-clear from Dell before forcing anything.
3. Test OLE and TDI dependencies: For business PCs, validate any app that automates Office or uses legacy network transports before broad deployment.
4. Audit Secure Boot: Confirm that managed devices are picking up the renewed certificates. Schedule remediation for any stragglers.
5. Face the support deadlines: Identify all devices running Windows 11 24H2 Home/Pro and Windows 10 LTSB 2016. Build a migration roadmap with a hard October deadline.
6. Lock down your Microsoft account: Turn on MFA, check recovery info, and create a local backup of vital OneDrive files.

Outlook

July’s 570-fix payload is unlikely to become the norm, but it reflects an escalating threat landscape and Microsoft’s growing willingness to pack security hardening alongside traditional vulnerability patches. The Secure Boot renewal will continue for months, and the October end-of-support dates will sharpen the urgency for millions of devices. In the near term, the Windows Search overhaul should graduate from Experimental to broader Insider rings, giving users a glimpse of a less cluttered, more respectful search experience. For now, though, the immediate priority is clear: patch, test, and prepare.