Microsoft Patches 621 CVEs in Record July Release, Including Critical Copilot and Azure OpenAI Flaws

Microsoft released patches for 621 new CVEs on July 14, making it the largest single Patch Tuesday in the company’s history. The year-to-date CVE count now exceeds every prior full-year total across Microsoft’s 20-year patching record, according to Zero Day Initiative’s Dustin Childs.

Of the 621 fixes, 63 are rated Critical. Two vulnerabilities are confirmed under active exploitation. But the entries that matter most for teams running AI-assisted development and agent infrastructure are three critical flaws in Microsoft’s AI product line.

The AI Infrastructure Vulnerabilities

CVE-2026-48561 is a remote code execution vulnerability in Microsoft Copilot, rated Critical at CVSS 9.6. Microsoft has not disclosed the specific attack vector, but an RCE in a tool that generates and executes code inside developer environments carries obvious implications for supply chain integrity.

CVE-2026-45499 targets Azure OpenAI with a CVSS 9.9 elevation of privilege flaw. That score, one tenth of a point below the theoretical maximum, means an attacker could escalate from low privileges to near-complete control of the affected Azure OpenAI deployment.

CVE-2026-41106 hits Microsoft 365 Copilot with a CVSS 9.3 elevation of privilege bug. For organizations that have embedded Copilot into document workflows and email triage, an EoP at this severity means an attacker could potentially act with the same permissions as the AI assistant itself.

None of the three AI-related CVEs are listed as actively exploited yet.

The Broader Patch Landscape

Beyond the AI stack, the release includes a VMSwitch vulnerability (CVE-2026-57092) scoring CVSS 9.9 that enables a low-privileged attacker to escape a VM boundary and compromise the Hyper-V host. ZDI noted a similar technique was demonstrated at Pwn2Own Berlin against VMware ESXi earlier this year.

Two unauthenticated SharePoint RCEs (CVE-2026-50522 and CVE-2026-58644) each scored CVSS 9.8. ZDI submitted the working exploit for CVE-2026-50522 through their program after demonstrating it at Pwn2Own Berlin, making Microsoft’s “Exploit Maturity Unknown” label, as Childs put it, an odd choice for a bug “we literally handed them a working exploit” for.

A stored XSS in Outlook Web Access (CVE-2026-55008, CVSS 9.6) executes JavaScript in the victim’s browser simply by opening a crafted email. Five DHCP Server RCEs round out the critical infrastructure risks, with CVE-2026-50518 scoring CVSS 9.8 as an unauthenticated heap-based buffer overflow.

The two actively exploited bugs are an Active Directory Federation Services privilege escalation (CVE-2026-56155, CVSS 7.8) and a SharePoint authentication bypass (CVE-2026-56164, CVSS 5.3).

The Agent Infrastructure Exposure

The Copilot and Azure OpenAI CVEs land at a moment when enterprises are integrating these tools into production agent workflows. Kraken rebuilt its app around AI trading agents last week. Robinhood opened autonomous crypto trading to 70,000 agentic accounts. Federal agencies are deploying OpenClaw subagent chains for cybersecurity decisions.

A CVSS 9.6 RCE in the coding assistant those agents depend on, combined with a CVSS 9.9 EoP in the cloud AI service they call, means the attack surface is not theoretical. It is the infrastructure enterprises are building on right now.

Patch immediately. Prioritize the AI stack alongside the VMSwitch and SharePoint RCEs.