Global -- Coalition sent just 49 Zero-Day Alerts (ZDAs) between May 1 and August 1, 2026, even as Microsoft's July Patch Tuesday swelled to 569 vulnerabilities, and 94% of its policyholders did not receive a single one.
Microsoft's Patch Tuesday count nearly triples in one month
June's Patch Tuesday set a record with 206 vulnerabilities. July's release nearly tripled that to 569. Before Microsoft adopted multi-model AI for vulnerability discovery, it typically shipped around 100 fixes a month. Windows said in July that it would apply AI across security analysis to find flaws earlier and at greater scale, which Coalition says likely contributed to the jump.
Attackers are also moving faster. Anthropic disclosed earlier this year that Mythos could create working exploits for newly discovered vulnerabilities in hours rather than weeks.
Coalition flags four July flaws out of 569
Roughly 60 of the July fixes were rated critical and more than 500 important. Coalition sent two ZDAs on Patch Tuesday itself, covering SharePoint and Windows Message Queuing.
The SharePoint flaw CVE-2026-56164 was added to CISA's Known Exploited Vulnerabilities catalog the day it was published and was exploited as a true zero-day. Its CVSS score was only 5.4, but Coalition's analysis found it could serve as an entry point for more severe flaws. NVD enrichment later raised it to 9.8.
CVE-2026-58644, a remote code execution (RCE) flaw requiring Site Owner privileges, joined the CISA catalog two days later. Those are the privileges CVE-2026-56164 grants. CVE-2026-50522 is a standalone SharePoint RCE that lets an unauthorized attacker execute code over a network. CVE-2026-50447, a heap-based buffer overflow in Windows Message Queuing, allows the same.
Coalition says many of the flaws it selected scored low on CVSS individually. Attackers once had to chain vulnerabilities by hand, but AI agents now allow a fully automated workflow. As Microsoft accounts for entire attack chains, Coalition expects the total volume of fixes to keep growing.
Small businesses make up 59% of alerted policyholders
Of the policyholders that received a ZDA, 59% have fewer than 25 employees. Coalition says small and midsize businesses are typically the most strapped for resources and often lack vulnerability management processes, so a Patch Tuesday of nearly 600 flaws could mean a month-long challenge. Each ZDA includes remediation steps. Coalition says the alerts supplement, rather than replace, a policyholder's own patching practices.
Among policyholders that got alerts, 91% received only one. Coalition reports a reasonably balanced spread of ZDAs across industries.
Exploited share of new CVEs stayed below 2.2%
Between 2018 and 2025, the share of newly published CVEs with confirmed exploitation remained below 2.2%, even as annual CVE volume grew 2.5 times. Coalition weighs business impact and the likelihood of exploitation when deciding which flaws warrant an alert. It argues that CVSS scores offer a baseline but do not translate directly into real-world business impact.
Policyholders can also use third-party risk management and attack surface monitoring through the Coalition Control platform.