# Microsoft July 2026 Patch Tuesday: 569 CVEs, Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP)

> Microsoft's July 2026 Patch Tuesday is its largest release on record (569 CVEs, 56-59 rated Critical), fixing two zero-days confirmed exploited in the wild by Microsoft's DART incident-response team: CVE-2026-56155 (AD FS local elevation-of-privilege to admin) and CVE-2026-56164 (SharePoint Server unauthenticated network elevation-of-privilege). Also patched: critical Dynamics NAV/365 Business Central deserialization RCE (CVE-2026-55944, CVSS 9.8, 'Exploitation More Likely'), critical Windows DHCP Server RCE (CVE-2026-50518, CVSS 9.8), and a publicly-disclosed-before-patch BitLocker bypass (CVE-2026-50661).

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1327
- **ID:** TL-2026-1327
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-55944, CVE-2026-50518, CVE-2026-50661, CVE-2026-50370, CVE-2026-54128, CVE-2026-56159, CVE-2026-48564, CVE-2026-54118, CVE-2026-54117, CVE-2026-50680, CVE-2026-54127, CVE-2026-56189, CVE-2026-50474, CVE-2026-50382, CVE-2026-55129, CVE-2026-58644

## Description

On July 14, 2026, Microsoft released its largest Patch Tuesday to date, addressing 569 vulnerabilities across the Windows and Microsoft 365 ecosystem (56-59 rated Critical, ~510 Important; figures vary slightly by counting methodology and exclude the 468 separately-tracked Chromium/Edge fixes). Three zero-days were disclosed, two of which CISA confirmed as actively exploited in the wild and added to the Known Exploited Vulnerabilities (KEV) catalog on the same day.

CVE-2026-56155 is an Insufficient Granularity of Access Control (CWE-1220) vulnerability in Active Directory Federation Services (AD FS), CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A locally-authorized attacker can elevate to administrator privileges. It was reported by Jeremy Kingston and Scott Clark of Microsoft's Detection and Response Team (DART), strongly suggesting it was discovered during incident response to an active intrusion rather than proactive research. Microsoft has not disclosed exploitation methodology. Because AD FS underpins federated authentication trust across hybrid Azure AD/on-premises environments, exploitation risks pivoting toward broader identity-infrastructure compromise, structurally similar in impact to prior AD FS golden-SAML style token-forging abuse (though no confirmed golden-SAML linkage has been published for this CVE). CISA KEV due date: 2026-07-28.

CVE-2026-56164 is a Missing Authentication for Critical Function (CWE-306) vulnerability in Microsoft SharePoint Server, CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). An unauthenticated network attacker can send a crafted POST request to elevate privileges over the network without credentials or user interaction. Affects SharePoint Server 2019, SharePoint Server Subscription Edition, SharePoint Server 2016, and SharePoint Enterprise Server 2016. Microsoft credits Jayson Frost (Mandiant), Genwei Jiang (Google Cloud FLARE/OTF), and an anonymous researcher. Microsoft's guidance recommends enabling Antimalware Scan Interface (AMSI) with Request Body Scan set to Full mode to detect malicious POST requests as a compensating control. CISA KEV due date: 2026-07-17 (accelerated, reflecting active exploitation urgency). Despite the 'Moderate' CVSS label, on-prem SharePoint farms are a top patch priority: SharePoint EoP bugs have repeatedly been chained by attackers with separate RCE vulnerabilities for full server takeover (as seen with the concurrently-exploited, CISA-KEV-listed CVE-2026-45659 SharePoint RCE, a related but distinct flaw in the same product patched around the same period).

CVE-2026-55944 is a Deserialization of Untrusted Data (CWE-502) RCE in Microsoft Dynamics NAV and Dynamics 365 Business Central (On-Premises), CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthenticated remote attacker sends a crafted login request that triggers deserialization of attacker-controlled data, resulting in code execution with no authentication or user interaction required. Affects Dynamics NAV 2018 versions prior to 11.0.50704.0. Microsoft rates this 'Exploitation More Likely' though it is not (yet) confirmed exploited in the wild.

CVE-2026-50518 is a Critical Windows DHCP Server RCE, CVSS 9.8, also rated 'Exploitation More Likely' by Microsoft. Related DHCP-stack flaws patched the same day include CVE-2026-50370 (DHCP Server RCE, CVSS 8.8, Exploitation More Likely) and CVE-2026-54128 (DHCP Client RCE, CVSS 8.4, Exploitation More Likely), plus CVE-2026-56159 (DHCP Server RCE, CVSS 9.8, Exploitation Unlikely) — collectively indicating a concentrated set of weaknesses in the Windows DHCP implementation this cycle that warrant prioritized patching of DHCP infrastructure regardless of individual likelihood ratings.

CVE-2026-50661 is a Windows BitLocker Security Feature Bypass, CVSS 6.1, publicly disclosed prior to patch availability (Microsoft 'Exploitation Less Likely'). Exploitation requires physical access to the target device to bypass Device Encryption and access data at rest. The disclosure has been associated in open reporting with the 'GreatXML' flaw class attributed to threat-research groups tracked as Chaotic Eclipse / Nightmare Eclipse, publicly disclosed June 10, 2026 ahead of the coordinated patch.

The release also lands amid a broader July 2026 multi-vendor patch wave: Adobe ColdFusion CVE-2026-48282 (subsequently exploited in attacks), four critical SAP flaws across NetWeaver/Commerce Cloud/AppRouter, and confirmed active exploitation of Cisco Unified CM CVE-2026-20230 — underscoring that defenders are managing simultaneous zero-day pressure across identity (AD FS), collaboration (SharePoint), ERP (Dynamics/SAP), and unified communications (Cisco) surfaces this cycle.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1211 Exploitation for Stealth
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1140 Deobfuscate/Decode Files or Information
- T1486 Data Encrypted for Impact
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1204 User Execution
- T1021 Remote Services
- T1499 Endpoint Denial of Service
- T1548 Abuse Elevation Control Mechanism
- T1189 Drive-by Compromise

## Sources

- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD - CVE-2026-56155](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56155)
- [NVD - CVE-2026-56164](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56164)
- [NVD - CVE-2026-55944](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-55944)
- [MSRC Security Update Guide - CVE-2026-56155](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155)
- [MSRC Security Update Guide - CVE-2026-56164](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164)
- [SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation](https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html)
- [CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability](https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/)
- [Microsoft said exploitation was 'less likely' ... but CISA just added SharePoint RCE to KEV list](https://www.theregister.com/security/2026/07/02/microsoft-said-exploitation-was-less-likely-but-cisa-just-added-sharepoint-rce-to-kev-list/5265886)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1327