# Microsoft July 2026 Patch Tuesday: 570 Flaws Fixed, 3 Zero-Days Including AD FS and SharePoint Privilege Escalation

> Microsoft's July 2026 Patch Tuesday addressed 570 vulnerabilities, including three zero-days: two actively exploited (CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server) and one publicly disclosed BitLocker encryption bypass (CVE-2026-50661) requiring physical access. 59 vulnerabilities were rated Critical, led by elevation-of-privilege (254) and remote code execution (145) flaws.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-16T13:24:21.003Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1324
- **ID:** TL-2026-1324
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-55129, CVE-2026-55049, CVE-2026-55045, CVE-2026-55140, CVE-2026-55056, CVE-2026-50314, CVE-2026-50467, CVE-2026-55022, CVE-2026-55018, CVE-2026-55127, CVE-2026-55033, CVE-2026-55132, CVE-2026-55120, CVE-2026-55043, CVE-2026-55123, CVE-2026-55040, CVE-2026-58644, CVE-2026-50522, CVE-2026-56189, CVE-2026-57087, CVE-2026-57094, CVE-2026-57090, CVE-2026-50382, CVE-2026-54122, CVE-2026-50380, CVE-2026-50474, CVE-2026-54995, CVE-2026-54982, CVE-2026-54128, CVE-2026-50518, CVE-2026-50370, CVE-2026-56159, CVE-2026-48564, CVE-2026-58542, CVE-2026-50327, CVE-2026-50655, CVE-2026-50680, CVE-2026-54127, CVE-2026-55012, CVE-2026-55011, CVE-2026-48561, CVE-2026-55944, CVE-2026-55008, CVE-2026-55010, CVE-2026-54118, CVE-2026-54117, CVE-2026-32201, CVE-2026-45659, CVE-2026-20230, CVE-2026-48282

## Description

Microsoft's July 2026 Patch Tuesday is one of the largest cumulative releases on record, addressing 570 vulnerabilities across Windows, Office, SharePoint, Exchange, SQL Server, Hyper-V, Defender, Dynamics NAV, and Minecraft Bedrock. Of the 570, 59 are rated Critical (48 RCE, 9 EoP, 1 security-feature bypass, 1 spoofing), 254 are elevation-of-privilege, 145 are remote code execution, 102 are information disclosure, 35 are denial of service, 17 are security-feature bypasses, and 16 are spoofing.

Three zero-days anchor the release. CVE-2026-56155 is an Active Directory Federation Services (AD FS) elevation-of-privilege flaw caused by insufficient granularity of access control, letting an already-authorized attacker escalate to administrative privileges locally; it is rated Important and is confirmed under active exploitation, credited to Jeremy Kingston and Scott Clark of Microsoft's Detection and Response Team (DART), implying it was discovered via incident-response engagements rather than proactive research. CVE-2026-56164 is a SharePoint Server elevation-of-privilege vulnerability rooted in missing authentication for a critical function, allowing an unauthorized network attacker to elevate privileges without credentials; it is rated Moderate but is also confirmed under active exploitation, credited to Jayson Frost (Mandiant Incident Response), Genwei Jiang and the FLARE OTF team (Google Cloud/Mandiant), and an anonymous researcher — the multi-vendor incident-response credit pattern mirrors prior SharePoint zero-day chains (e.g., ToolShell-class CVE-2026-45659/CVE-2026-45484) that were exploited for unauthenticated pre-auth access before privilege escalation. Microsoft's interim guidance for SharePoint defenders is to enable the Antimalware Scan Interface (AMSI) integration and set Request Body Scan mode to Full to gain visibility into exploitation attempts ahead of patch deployment. CVE-2026-50661 is a Windows BitLocker Device Encryption security-feature bypass that lets an attacker with physical access to a device's storage recover encrypted data; it is publicly disclosed but not reported as exploited in the wild, and was reported anonymously. It follows a pattern of BitLocker bypass disclosures across 2026 (e.g., CVE-2026-45585 'YellowKey', CVE-2026-50507), reflecting sustained researcher interest in cold-boot/physical-access attacks against Windows full-disk encryption.

Beyond the three zero-days, the release carries a heavy critical-RCE load across Office and PowerPoint (document-based code execution), SharePoint (additional critical bypass/RCE beyond the zero-day), Windows Media Foundation, DirectX Graphics, Windows GDI+, Remote Desktop Client, the RMCAST multicast driver, DHCP Client and Server, Windows Media, and Hyper-V (host-escape-class). Additional critical fixes land in Microsoft Defender, Microsoft Copilot, Dynamics NAV, Exchange, Minecraft Bedrock, and SQL Server. The same cycle saw major non-Microsoft vendors ship their own critical fixes — Adobe (ColdFusion/Campaign, including a flaw later exploited), SAP (NetWeaver, Commerce Cloud, AppRouter), BeyondTrust (Remote Support/Privileged Remote Access auth bypass), Cisco (Identity Services Engine, Catalyst Center, ClamAV, with CVE-2026-20230 confirmed exploited), Fortinet (FortiOS, FortiSandbox, FortiPAM, FortiSASE, FortiProxy), Gitea (Docker image auth bypass), Ivanti (Xtraction), Linux Kernel (VM escape), NVIDIA (Triton Inference Server, TensorRT-LLM), Progress Software (ShareFile path-traversal zero-day), Ubiquiti (UniFi OS command injection), U-Boot (firmware attack flaws), VMware (Avi Load Balancer auth bypass/RCE), and Zimbra (web client XSS) — underscoring a broad, concentrated patch-management burden across enterprise identity, collaboration, network, and virtualization stacks in the same week.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1548 Abuse Elevation Control Mechanism
- T1611 Escape to Host
- T1006 Direct Volume Access
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1069 Permission Groups Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1499 Endpoint Denial of Service
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1505 Server Software Component
- T1556 Modify Authentication Process
- T1003 OS Credential Dumping
- T1606 Forge Web Credentials
- T1550 Use Alternate Authentication Material
- T1486 Data Encrypted for Impact
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1484 Domain or Tenant Policy Modification
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1087 Account Discovery
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service

## Sources

- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [CVE-2026-56155 - Security Update Guide - Microsoft - Active Directory Federation Services Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155)
- [CVE-2026-56164 - Security Update Guide - Microsoft - Microsoft SharePoint Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164)
- [CVE-2026-50661 - Security Update Guide - Microsoft - Windows BitLocker Security Feature Bypass Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA Adds Three Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog)
- [July 2026 Patch Tuesday forecast: Is CVE tracking still practical?](https://www.helpnetsecurity.com/2026/07/10/july-2026-patch-tuesday-forecast/)
- [Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/)
- [CVE-2026-20230 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-20230)
- [Adobe patches seven max severity ColdFusion, Campaign flaws](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/)
- [Adobe Security Bulletin - ColdFusion (APSB26-64)](https://helpx.adobe.com/security/products/coldfusion/apsb26-64.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1324