Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Fixed, Including 2 Actively Exploited Zero-Days (CVE-2026-56164, CVE-2026-56155)

Microsoft July 2026 Patch Tuesday (TL-2026-1325), also tracked as Microsoft July 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-14 and last reviewed 2026-07-19. It has no confirmed attribution, affects Microsoft SharePoint Enterprise Server 2016, references 24 CVEs (CVE-2026-56164, CVE-2026-56155, CVE-2026-50661), maps to 27 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1325

Threat ID
TL-2026-1325
Also known as
Microsoft July 2026 Patch Tuesday
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, manufacturing, critical-infrastructure
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
24
Updates
2026-07-19 · revalidated 1× · latest source

Malware and tooling in Microsoft July 2026 Patch Tuesday

Malware and tooling: AMSI (Antimalware Scan Interface) Full Request Body Scan

Microsoft's July 2026 Patch Tuesday addressed roughly 570 vulnerabilities, including two actively exploited zero-days -- a SharePoint Server elevation-of-privilege flaw (CVE-2026-56164) and an Active Directory Federation Services elevation-of-privilege flaw (CVE-2026-56155) -- a publicly disclosed BitLocker bypass (CVE-2026-50661), and two Critical RCEs in SharePoint (CVE-2026-58644) and Print Spooler (CVE-2026-58608). CISA added both zero-days to its KEV catalog the same day.

How Microsoft July 2026 Patch Tuesday works

On 2026-07-14 Microsoft shipped its largest Patch Tuesday to date, fixing approximately 570 vulnerabilities: 254 Elevation of Privilege, 145 Remote Code Execution, 102 Information Disclosure, 35 Denial of Service, 17 Security Feature Bypass, and 16 Spoofing bugs, with 59 rated Critical (48 RCE, 9 EoP, 1 bypass, 1 spoofing). Coverage attributes the record volume in part to Microsoft's newly deployed AI-assisted vulnerability-discovery tooling scanning the Windows codebase.

Two zero-days were confirmed exploited in the wild and immediately added to the CISA Known Exploited Vulnerabilities catalog: CVE-2026-56164, a missing-authentication (CWE-306) elevation-of-privilege flaw in on-premises Microsoft Office SharePoint (SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Server Subscription Edition) that lets an unauthenticated network attacker elevate privileges (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N); and CVE-2026-56155, an insufficient-access-control-granularity flaw (CWE-1220) in Active Directory Federation Services that lets an authenticated local attacker escalate to full compromise of confidentiality, integrity, and availability (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Both were credited to Jeremy Kingston and Scott Clark of Microsoft's Detection and Response Team (DART), a strong signal both were surfaced during live incident-response investigations rather than proactive research -- Microsoft has not published the specific in-the-wild exploitation methodology for either.

Although CVE-2026-56164 carries only a MEDIUM CVSS base score, its practical risk is amplified because on-prem SharePoint EoP bugs have repeatedly been chained with SharePoint deserialization RCEs (the 2025 'ToolShell' chain of CVE-2025-49706/CVE-2025-49704, and the May-2026-patched CVE-2026-45659 deserialization RCE) to achieve unauthenticated remote code execution and theft of the SharePoint ValidationKey/DecryptionKey machine keys, which grants persistent access surviving a patch. Microsoft's interim mitigation for CVE-2026-56164 is to enable AMSI (Antimalware Scan Interface) with Request Body Scan mode set to Full on affected SharePoint farms. CVE-2026-56155 (AD FS) is significant for hybrid Azure AD/on-premises identity environments: historically, compromise of an AD FS server's token-signing certificate enables 'Golden SAML' forgery, letting an attacker mint arbitrary SAML assertions and impersonate any federated user -- including Global Administrators -- against downstream cloud services, bypassing MFA/SSO controls entirely.

A third zero-day, CVE-2026-50661, is a Windows BitLocker Device Encryption bypass (CWE-693, protection mechanism failure) that was publicly disclosed but is not confirmed exploited (CVSS 3.1 6.1, AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). It requires physical access to the target device and follows the same vulnerability class as the June 2026 'YellowKey' BitLocker Windows Recovery Environment bypass (CVE-2026-45585), which used a crafted 'FsTx' folder staged on removable media or the EFI partition to trigger unrestricted SYSTEM-level shell access to the encrypted volume via WinRE in roughly 60 seconds with no password or recovery key. Microsoft's June 2026 YellowKey mitigation guidance (remove the autofstx.exe BootExecute entry from the WinRE image; enable BitLocker TPM+PIN) is the same defensive posture recommended against CVE-2026-50661-class attacks.

Two Critical-severity RCEs round out the highest-priority set: CVE-2026-58644, a deserialization-of-untrusted-data flaw (CWE-502) in the same three on-premises SharePoint products (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) -- an unauthenticated, network-exploitable RCE in the same product family as the actively-exploited EoP, meaning a SharePoint farm unpatched against both CVE-2026-56164 and CVE-2026-58644 is exposed to a full ToolShell-style unauthenticated RCE chain; and CVE-2026-58608, a race-condition/use-after-free flaw (CWE-362, CWE-416) in Windows Print Spooler components (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) affecting Windows 10, Windows 11 (24H2/25H2/26H1), and Windows Server 2012-2025 across x86/x64/ARM64 -- Print Spooler RCEs (PrintNightmare-class) have a strong history of ransomware and nation-state lateral-movement abuse due to the service's default-on, network-reachable, SYSTEM-privileged nature.

Additional Critical CVEs in the same release include CVE-2026-48561 (Copilot RCE), CVE-2026-55011/CVE-2026-55012 (Defender RCE), CVE-2026-54982/CVE-2026-54995 (RMCAST RCE), CVE-2026-50474 (Remote Desktop Client RCE), CVE-2026-56189/CVE-2026-57087/CVE-2026-57090/CVE-2026-57094 (Windows Media Foundation RCE), CVE-2026-50382 (DirectX Graphics Kernel RCE), CVE-2026-58626 (Remote Desktop Services RCE), CVE-2026-58631 (Windows Admin Center RCE), and CVE-2026-58627 (DHCP Server DoS). Elevation-of-Privilege bugs concentrated in the Windows kernel, DirectX Graphics Kernel, Desktop Window Manager, and Win32k subsystems -- the classic chain-with-initial-access pattern for SYSTEM-level takeover.

MITRE ATT&CK techniques used in TL-2026-1325

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Discovery

T1069 Permission Groups Discovery; T1082 System Information Discovery; T1518 Software Discovery

Defense Evasion

T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service

Persistence

T1078 Valid Accounts; T1505 Server Software Component

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1499 Endpoint Denial of Service

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1606 Forge Web Credentials

lateral-movement

T1550 Use Alternate Authentication Material

defense-impairment

T1556 Modify Authentication Process; T1685 Disable or Modify Tools

Resource Development

T1587 Develop Capabilities

Affected products and versions in Microsoft July 2026 Patch Tuesday

  • Microsoft — SharePoint Enterprise Server 2016
    Vulnerable versions: before 16.0.5556.1005 (CVE-2026-58644); before 16.0.5561.1001 (CVE-2026-56164)
    Fixed in: 16.0.5561.1001 or later
  • Microsoft — SharePoint Server 2019
    Vulnerable versions: before 16.0.10417.20153 (CVE-2026-58644); before 16.0.10417.20175 (CVE-2026-56164)
    Fixed in: 16.0.10417.20175 or later
  • Microsoft — SharePoint Server Subscription Edition
    Vulnerable versions: before 16.0.19725.20384 (CVE-2026-58644); before 16.0.19725.20434 (CVE-2026-56164)
    Fixed in: 16.0.19725.20434 or later
  • Microsoft — Active Directory Federation Services (Windows Server 2012 - 2025)
    Vulnerable versions: Windows Server 2012 before 6.2.9200.26226; Windows Server 2012 R2 before 6.3.9600.23291; Windows Server 2016 before 10.0.14393.9339; Windows Server 2019 before 10.0.17763.9020; Windows Server 2022 before 10.0.20348.5386; Windows Server 2025 before 10.0.26100.33158
    Fixed in: per-OS July 2026 cumulative update
  • Microsoft — Windows BitLocker Device Encryption (Windows 10/11, Windows Server 2016-2025)
    Vulnerable versions: Windows 10 1607/1809/21H2/22H2; Windows 11 24H2/25H2/26H1 (x64, ARM64); Windows Server 2016/2019/2022/2025
    Fixed in: July 2026 cumulative update
  • Microsoft — Windows Print Spooler
    Vulnerable versions: Windows 10 1607/1809/21H2/22H2; Windows 11 24H2/25H2/26H1; Windows Server 2012/2012 R2/2016/2019/2022/2025; x86, x64, ARM64
    Fixed in: July 2026 cumulative update

Remediation for Microsoft July 2026 Patch Tuesday

Patches

  • Microsoft July 2026 Patch Tuesday cumulative updates (per-product KBs) addressing CVE-2026-56164, CVE-2026-56155, CVE-2026-50661, CVE-2026-58644, CVE-2026-58608

Immediate actions

  • Apply the July 2026 cumulative/security updates to all on-premises SharePoint Server 2016, 2019, and Subscription Edition farms immediately (CVE-2026-56164, CVE-2026-58644)
  • Patch all Active Directory Federation Services servers (Windows Server 2012-2025) per CISA KEV due date 2026-07-28 (CVE-2026-56155)
  • Enable AMSI with Request Body Scan mode set to Full on SharePoint farms as an interim mitigation for CVE-2026-56164
  • Rotate SharePoint ValidationKey and DecryptionKey machine keys and the AD FS token-signing certificate after patching, in case of prior undetected compromise
  • Patch Windows Print Spooler (CVE-2026-58608) fleet-wide; disable the Print Spooler service on servers that do not require printing

Workarounds

  • AMSI Full Request Body Scan mode for SharePoint (CVE-2026-56164)
  • Remove autofstx.exe from the WinRE BootExecute registry value and enable TPM+PIN for BitLocker (CVE-2026-50661 mitigation class, per YellowKey guidance)

Longer-term hardening

  • Enforce BitLocker TPM+PIN startup authentication and restrict WinRE boot-media access to reduce exposure to physical BitLocker-bypass attacks (CVE-2026-50661)
  • Monitor AD FS token-signing certificate usage and SAML assertion issuance for anomalies indicative of Golden SAML forgery
  • Deploy EDR/behavioral detection on SharePoint and AD FS servers given the historical pattern of EoP+RCE chaining against this product family
  • Reduce SharePoint and Print Spooler external/lateral network exposure via segmentation

CVEs associated with Microsoft July 2026 Patch Tuesday

Weaknesses (CWE) in Microsoft July 2026 Patch Tuesday

CWE-306, CWE-1220, CWE-693, CWE-502, CWE-362, CWE-416, CWE-79, CWE-359, CWE-269, CWE-290

Timeline of Microsoft July 2026 Patch Tuesday

  • Viettel Cyber Security researchers demonstrate the original 'ToolShell' SharePoint deserialization/auth-bypass exploit chain (CVE-2025-49706/CVE-2025-49704) at Pwn2Own Berlin, establishing the SharePoint EoP+RCE chaining pattern later echoed by CVE-2026-56164/CVE-2026-58644.
  • CISA publishes updated guidance on active exploitation of on-premises SharePoint ToolShell vulnerabilities.
  • Microsoft patches CVE-2026-45659, a SharePoint deserialization RCE (CWE-502) in the same product family, later added to CISA KEV in July 2026.
  • Microsoft releases mitigation guidance for the 'YellowKey' BitLocker Windows Recovery Environment bypass (CVE-2026-45585), the precedent vulnerability class for CVE-2026-50661.
  • CISA adds CVE-2026-45659 (SharePoint RCE) to the Known Exploited Vulnerabilities catalog after confirmed active exploitation, days ahead of the July Patch Tuesday zero-days.
  • CISA adds CVE-2026-56155 (AD FS EoP) to the KEV catalog as 'Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability', with a remediation due date of 2026-07-28.
  • CISA adds CVE-2026-56164 (SharePoint Server EoP) to the KEV catalog as 'Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability', with a remediation due date of 2026-07-17.
  • Microsoft releases July 2026 Patch Tuesday, fixing approximately 570 vulnerabilities including CVE-2026-56164, CVE-2026-56155, CVE-2026-50661, CVE-2026-58644, and CVE-2026-58608.
  • SecurityWeek and The Register report CVE-2026-58644 being exploited in the wild soon after disclosure, alongside related SharePoint flaws CVE-2026-32201 and CVE-2026-45659.
  • Microsoft revises its CVE-2026-58644 bulletin to confirm the vulnerability was weaponized and exploited as a zero-day prior to patch availability.
  • CISA adds CVE-2026-58644 (SharePoint unauthenticated deserialization RCE) to the KEV catalog, confirming active exploitation and setting a Federal Civilian Executive Branch remediation deadline of 2026-07-19.
  • Rapid7 publishes a technical breakdown of CVE-2026-58644 confirming the CWE-502 deserialization root cause, CVSS 9.8, and associated AMSI/Defender detection signatures.
  • HKCERT publishes High Threat Security Alert A26-07-30 consolidating six Microsoft CVEs, flagging CVE-2026-58644 as exploited in the wild.
  • CISA BOD-mandated remediation deadline for CVE-2026-56164 (federal agencies).
  • CISA-mandated remediation deadline for U.S. Federal Civilian Executive Branch agencies to patch CVE-2026-58644.
  • CISA BOD-mandated remediation deadline for CVE-2026-56155 (federal agencies).

Update history for TL-2026-1325

Sources cited for Microsoft July 2026 Patch Tuesday

Threats related to Microsoft July 2026 Patch Tuesday

Detection coverage for TL-2026-1325

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1325 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats