Microsoft July 2026 Patch Tuesday: 569 CVEs, Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP)

Microsoft July 2026 Patch Tuesday (TL-2026-1327), also tracked as July 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-14. It has no confirmed attribution, affects Microsoft Active Directory Federation Services (AD FS), references 18 CVEs (CVE-2026-56155, CVE-2026-56164, CVE-2026-55944), maps to 18 MITRE ATT&CK techniques (T1005, T1021, T1068), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-1327

Threat ID
TL-2026-1327
Also known as
July 2026 Patch Tuesday, Microsoft Patch Tuesday July 2026
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, manufacturing, education, retail, energy
Target regions
North America, Europe, Asia Pacific, Global
Detection rules
9
Indicators of compromise
32

Malware and tooling in Microsoft July 2026 Patch Tuesday

Malware and tooling: MDASH (Microsoft AI-assisted vulnerability discovery/triage tooling)

Microsoft's July 2026 Patch Tuesday is its largest release on record (569 CVEs, 56-59 rated Critical), fixing two zero-days confirmed exploited in the wild by Microsoft's DART incident-response team: CVE-2026-56155 (AD FS local elevation-of-privilege to admin) and CVE-2026-56164 (SharePoint Server unauthenticated network elevation-of-privilege). Also patched: critical Dynamics NAV/365 Business Central deserialization RCE (CVE-2026-55944, CVSS 9.8, 'Exploitation More Likely'), critical Windows DHCP Server RCE (CVE-2026-50518, CVSS 9.8), and a publicly-disclosed-before-patch BitLocker bypass (CVE-2026-50661).

How Microsoft July 2026 Patch Tuesday works

On July 14, 2026, Microsoft released its largest Patch Tuesday to date, addressing 569 vulnerabilities across the Windows and Microsoft 365 ecosystem (56-59 rated Critical, ~510 Important; figures vary slightly by counting methodology and exclude the 468 separately-tracked Chromium/Edge fixes). Three zero-days were disclosed, two of which CISA confirmed as actively exploited in the wild and added to the Known Exploited Vulnerabilities (KEV) catalog on the same day.

CVE-2026-56155 is an Insufficient Granularity of Access Control (CWE-1220) vulnerability in Active Directory Federation Services (AD FS), CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A locally-authorized attacker can elevate to administrator privileges. It was reported by Jeremy Kingston and Scott Clark of Microsoft's Detection and Response Team (DART), strongly suggesting it was discovered during incident response to an active intrusion rather than proactive research. Microsoft has not disclosed exploitation methodology. Because AD FS underpins federated authentication trust across hybrid Azure AD/on-premises environments, exploitation risks pivoting toward broader identity-infrastructure compromise, structurally similar in impact to prior AD FS golden-SAML style token-forging abuse (though no confirmed golden-SAML linkage has been published for this CVE). CISA KEV due date: 2026-07-28.

CVE-2026-56164 is a Missing Authentication for Critical Function (CWE-306) vulnerability in Microsoft SharePoint Server, CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). An unauthenticated network attacker can send a crafted POST request to elevate privileges over the network without credentials or user interaction. Affects SharePoint Server 2019, SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Enterprise Server 2016. Microsoft credits Jayson Frost (Mandiant), Genwei Jiang (Google Cloud FLARE/OTF), and an anonymous researcher. Microsoft's guidance recommends enabling Antimalware Scan Interface (AMSI) with Request Body Scan set to Full mode to detect malicious POST requests as a compensating control. CISA KEV due date: 2026-07-17 (accelerated, reflecting active exploitation urgency). Despite the 'Moderate' CVSS label, on-prem SharePoint farms are a top patch priority: SharePoint EoP bugs have repeatedly been chained by attackers with separate RCE vulnerabilities for full server takeover (as seen with the concurrently-exploited, CISA-KEV-listed CVE-2026-45659 SharePoint RCE, a related but distinct flaw in the same product patched around the same period).

CVE-2026-55944 is a Deserialization of Untrusted Data (CWE-502) RCE in Microsoft Dynamics NAV and Dynamics 365 Business Central (On-Premises), CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthenticated remote attacker sends a crafted login request that triggers deserialization of attacker-controlled data, resulting in code execution with no authentication or user interaction required. Affects Dynamics NAV 2018 versions prior to 11.0.50704.0. Microsoft rates this 'Exploitation More Likely' though it is not (yet) confirmed exploited in the wild.

CVE-2026-50518 is a Critical Windows DHCP Server RCE, CVSS 9.8, also rated 'Exploitation More Likely' by Microsoft. Related DHCP-stack flaws patched the same day include CVE-2026-50370 (DHCP Server RCE, CVSS 8.8, Exploitation More Likely) and CVE-2026-54128 (DHCP Client RCE, CVSS 8.4, Exploitation More Likely), plus CVE-2026-56159 (DHCP Server RCE, CVSS 9.8, Exploitation Unlikely) — collectively indicating a concentrated set of weaknesses in the Windows DHCP implementation this cycle that warrant prioritized patching of DHCP infrastructure regardless of individual likelihood ratings.

CVE-2026-50661 is a Windows BitLocker Security Feature Bypass, CVSS 6.1, publicly disclosed prior to patch availability (Microsoft 'Exploitation Less Likely'). Exploitation requires physical access to the target device to bypass Device Encryption and access data at rest. The disclosure has been associated in open reporting with the 'GreatXML' flaw class attributed to threat-research groups tracked as Chaotic Eclipse / Nightmare Eclipse, publicly disclosed June 10, 2026 ahead of the coordinated patch.

The release also lands amid a broader July 2026 multi-vendor patch wave: Adobe ColdFusion CVE-2026-48282 (subsequently exploited in attacks), four critical SAP flaws across NetWeaver/Commerce Cloud/AppRouter, and confirmed active exploitation of Cisco Unified CM CVE-2026-20230 — underscoring that defenders are managing simultaneous zero-day pressure across identity (AD FS), collaboration (SharePoint), ERP (Dynamics/SAP), and unified communications (Cisco) surfaces this cycle.

MITRE ATT&CK techniques used in TL-2026-1327

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol

Persistence

T1078 Valid Accounts

Discovery

T1082 System Information Discovery

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution; T1204 User Execution

Impact

T1486 Data Encrypted for Impact; T1499 Endpoint Denial of Service

Credential Access

T1528 Steal Application Access Token; T1606 Forge Web Credentials

Affected products and versions in Microsoft July 2026 Patch Tuesday

  • Microsoft — Active Directory Federation Services (AD FS)
    Vulnerable versions: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025
    Fixed in: July 2026 cumulative update
  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2016; SharePoint Enterprise Server 2016; SharePoint Server 2019; SharePoint Server Subscription Edition
    Fixed in: July 2026 security update
  • Microsoft — Dynamics NAV / Dynamics 365 Business Central
    Vulnerable versions: Dynamics NAV 2018 prior to 11.0.50704.0; Dynamics 365 Business Central On-Premises (pre-July 2026)
    Fixed in: 11.0.50704.0; July 2026 On-Premises update
  • Microsoft — Windows DHCP Server / Client
    Vulnerable versions: Windows Server (DHCP Server role, all supported versions); Windows (DHCP Client, all supported versions)
    Fixed in: July 2026 cumulative update
  • Microsoft — Windows BitLocker Device Encryption
    Vulnerable versions: Windows (BitLocker component, versions prior to July 2026 update)
    Fixed in: July 2026 cumulative update

Remediation for Microsoft July 2026 Patch Tuesday

Patches

  • July 2026 Cumulative Update for Active Directory Federation Services (CVE-2026-56155)
  • July 2026 Security Update for SharePoint Server 2019 / Subscription Edition / 2016 / Enterprise Server 2016 (CVE-2026-56164)
  • Dynamics NAV 2018 update to 11.0.50704.0 or later / Dynamics 365 Business Central On-Premises July 2026 update (CVE-2026-55944)
  • July 2026 Cumulative Update for Windows Server (DHCP Server/Client roles) (CVE-2026-50518, CVE-2026-50370, CVE-2026-54128, CVE-2026-56159)
  • July 2026 Cumulative Update for Windows (BitLocker component) (CVE-2026-50661)

Immediate actions

  • Apply the July 2026 cumulative updates for AD FS servers (CVE-2026-56155) and all SharePoint Server 2016/2019/Enterprise 2016/Subscription Edition farms (CVE-2026-56164) as top priority — both are confirmed exploited zero-days on CISA KEV.
  • Patch Dynamics NAV/365 Business Central on-premises deployments to versions ≥11.0.50704.0 to close CVE-2026-55944 (unauthenticated deserialization RCE, Exploitation More Likely).
  • Patch all Windows DHCP Server and DHCP Client roles for CVE-2026-50518, CVE-2026-50370, CVE-2026-54128, and CVE-2026-56159.
  • For SharePoint, enable AMSI integration and set Request Body Scan Mode to Full to detect malicious POST requests exploiting CVE-2026-56164 as an interim compensating control if patching is delayed.
  • Follow CISA BOD 26-04: remediate CVE-2026-56164 by 2026-07-17 and CVE-2026-56155 by 2026-07-28, or discontinue use of the affected product if a vendor mitigation is unavailable.

Workarounds

  • SharePoint: enable AMSI with Request Body Scan set to Full as a stopgap detection control for CVE-2026-56164 exploitation attempts.
  • BitLocker: enforce pre-boot authentication (PIN/TPM+PIN) and physical device security controls to reduce CVE-2026-50661 exposure where patching is delayed.
  • DHCP: restrict DHCP server/client network exposure to trusted management segments until patched.

Longer-term hardening

  • Deploy EDR/behavioral monitoring on AD FS servers with alerting on anomalous local privilege escalation and token-signing certificate access, given AD FS's role as a federated-identity trust anchor.
  • Review SharePoint farm exposure to the internet; restrict anonymous/unauthenticated network access to SharePoint endpoints where feasible.
  • Establish accelerated patch-validation and deployment pipelines for DHCP infrastructure given the recurring pattern of DHCP RCE vulnerabilities across recent Patch Tuesdays.
  • Enforce full-disk encryption defense-in-depth (e.g., pre-boot authentication/PIN) to reduce BitLocker bypass exposure from physical-access attacks.

CVEs associated with Microsoft July 2026 Patch Tuesday

Weaknesses (CWE) in Microsoft July 2026 Patch Tuesday

CWE-1220, CWE-306, CWE-502

Timeline of Microsoft July 2026 Patch Tuesday

  • BitLocker-related 'GreatXML' flaw class publicly disclosed by threat-research groups Chaotic Eclipse/Nightmare Eclipse ahead of coordinated patch, feeding into CVE-2026-50661.
  • CISA adds the related SharePoint RCE CVE-2026-45659 to the Known Exploited Vulnerabilities catalog, warning of active exploitation and elevating scrutiny on SharePoint infrastructure ahead of Patch Tuesday.
  • Microsoft attributes the unprecedented 569/570-CVE volume in part to its internal MDASH AI-assisted vulnerability discovery/triage tooling accelerating pre-release bug finding; researchers note the release skews toward Elevation of Privilege (254 CVEs, ~44.6%) and Remote Code Execution (145 CVEs, ~25.4%), with 59 rated Critical (48 RCE, 9 EoP, 1 bypass, 1 spoofing).
  • Microsoft discloses a third zero-day, CVE-2026-50661 (BitLocker Device Encryption bypass), alongside the two actively-exploited AD FS/SharePoint flaws; unlike the other two it is 'Exploitation Less Likely' and requires physical device access, not confirmed exploited in the wild.
  • CISA adds CVE-2026-56155 and CVE-2026-56164 to the Known Exploited Vulnerabilities catalog, setting remediation due dates of 2026-07-28 and 2026-07-17 respectively under BOD 26-04.
  • CVE-2026-56155 (AD FS EoP) and CVE-2026-56164 (SharePoint EoP) confirmed exploited in the wild as zero-days; CVE-2026-56155 discovered by Microsoft DART during incident response.
  • Microsoft releases July 2026 Patch Tuesday, its largest ever at 569 CVEs (56-59 rated Critical), including fixes for CVE-2026-56155, CVE-2026-56164, CVE-2026-55944, CVE-2026-50518, CVE-2026-50661, and the DHCP-related CVE-2026-50370, CVE-2026-54128, CVE-2026-56159.
  • CISA BOD 26-04 remediation deadline for CVE-2026-56164 (SharePoint EoP) for federal civilian agencies.
  • CISA BOD 26-04 remediation deadline for CVE-2026-56155 (AD FS EoP) for federal civilian agencies.

Sources cited for Microsoft July 2026 Patch Tuesday

Threats related to Microsoft July 2026 Patch Tuesday

Detection coverage for TL-2026-1327

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1327 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats