# Windows 10 KB5099539 Extended Security Update Patches July 2026 Patch Tuesday Zero-Days — AD FS (CVE-2026-56155), SharePoint (CVE-2026-56164) Exploited; BitLocker (CVE-2026-50661) Publicly Disclosed

> Microsoft's KB5099539 (Windows 10 build 19045.7548 / Windows 10 Enterprise LTSC 2021 build 19044.7548) rolls in the July 2026 Patch Tuesday rollup of 570 vulnerabilities, including two actively exploited elevation-of-privilege zero-days in Active Directory Federation Services (CVE-2026-56155) and SharePoint Server (CVE-2026-56164), plus one publicly disclosed BitLocker Security Feature Bypass (CVE-2026-50661). CISA added CVE-2026-56164 to the KEV catalog on 2026-07-14 with a July 17, 2026 remediation deadline under BOD 26-04.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1326
- **ID:** TL-2026-1326
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50661

## Description

On July 14, 2026 Microsoft released KB5099539 for Windows 10 (build 19045.7548) and Windows 10 Enterprise LTSC 2021 (build 19044.7548) as part of the Extended Security Update (ESU) program, extending support through October 12, 2027. The update is bundled into Microsoft's broader July 2026 Patch Tuesday release, which fixed 570 vulnerabilities — the largest monthly total to date, attributed by Microsoft to an AI-powered vulnerability discovery system scanning the Windows codebase. The breakdown across the full rollup is 254 elevation-of-privilege, 145 remote code execution, 102 information disclosure, 35 denial-of-service, 17 security-feature-bypass, and 16 spoofing bugs, with 59 rated Critical (48 RCE, 9 EoP, 1 security bypass, 1 spoofing).

Three zero-days anchor the release. CVE-2026-56155 is an Active Directory Federation Services (AD FS) elevation-of-privilege flaw (CWE-1220, insufficient granularity of access control) rated CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) that lets an authorized local attacker escalate to full administrative privileges; Microsoft credited its own Detection and Response Team (DART) researchers Jeremy Kingston and Scott Clark, a credit pattern that typically indicates the bug was found while investigating live intrusions. CVE-2026-56164 is a SharePoint Server elevation-of-privilege vulnerability (CWE-306, missing authentication for a critical function) rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) allowing an unauthenticated network attacker to elevate privileges; it was credited to Jayson Frost (Mandiant), Genwei Jiang (Google Cloud), and an anonymous researcher, and Microsoft's interim mitigation is to enable AMSI and set SharePoint's Request Body Scan mode to Full. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on 2026-07-14 with a mandated remediation deadline of 2026-07-17 under Binding Operational Directive 26-04. CVE-2026-50661 is a publicly disclosed Windows BitLocker Security Feature Bypass (CWE-693, protection mechanism failure) rated CVSS 3.1 6.1 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) that lets an attacker with physical access to a device bypass BitLocker Device Encryption and read the underlying encrypted volume; Microsoft credited an anonymous researcher and has not disclosed in-the-wild exploitation.

The source article does not enumerate the remaining 567 CVEs, so this record documents only the three zero-days plus the notable Critical RCEs Microsoft separately called out (Defender: CVE-2026-55011/CVE-2026-55012; Copilot: CVE-2026-48561; DHCP: CVE-2026-54128, CVE-2026-50518, CVE-2026-50370, CVE-2026-56159, CVE-2026-48564; Graphics/Media: CVE-2026-50382, CVE-2026-49796, CVE-2026-50380, CVE-2026-50655, CVE-2026-50327, CVE-2026-58542). KB5099539 also carries non-security hardening (TDI transport registration enforcement, flagged via Event ID 16003 for legacy third-party transports; SHA-2 certificate thumbprint support for RDP publishers; enhanced Secure Boot certificate deployment) and fixes for OLE Automation compatibility, OneDrive shortcuts in File Explorer admin mode, Recycle Bin file naming, and input hotkey lifecycle behavior.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1200 Hardware Additions
- T1068 Exploitation for Privilege Escalation
- T1484 Domain or Tenant Policy Modification
- T1556 Modify Authentication Process
- T1548 Abuse Elevation Control Mechanism
- T1600 Weaken Encryption
- T1211 Exploitation for Stealth
- T1606 Forge Web Credentials
- T1098 Account Manipulation
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories

## Sources

- [Microsoft releases Windows 10 KB5099539 Extended Security Update](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5099539-extended-security-update/)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation (July 2026 SharePoint threat landscape context)](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/)
- [July 2026 Patch Tuesday forecast: Is CVE tracking still practical?](https://www.helpnetsecurity.com/2026/07/10/july-2026-patch-tuesday-forecast/)
- [Microsoft Security Update Guide: CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155)
- [Microsoft Security Update Guide: CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164)
- [Microsoft Security Update Guide: CVE-2026-50661](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1326