# Microsoft July 2026 Patch Tuesday: 570 Vulnerabilities Including Two Under Active Exploitation (CVE-2026-56155, CVE-2026-56164)

> Microsoft's July 2026 Patch Tuesday addresses roughly 570 vulnerabilities (59 Critical) plus 427 additional Chromium flaws affecting Edge. Two vulnerabilities are already under active zero-day exploitation: CVE-2026-56155 (AD FS elevation of privilege, CVSS 7.8) and CVE-2026-56164 (SharePoint Server elevation of privilege, CVSS 5.3), both added to the CISA KEV catalog on 2026-07-14. A previously disclosed BitLocker security-feature-bypass, CVE-2026-50661, is also patched and is believed to correspond to the publicly demonstrated 'GreatXML' WinRE trust-boundary attack. Three additional Critical remote-code-execution flaws in the Windows DHCP Client and Reliable Multicast Transport Driver (RMCAST) round out the highest-priority items in the release.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1330
- **ID:** TL-2026-1330
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-54128, CVE-2026-54982, CVE-2026-54995

## Description

On 2026-07-14 Microsoft shipped its July Patch Tuesday, addressing approximately 570 CVEs (56-59 rated Critical, ~510 Important, 3 Moderate) plus 427 Chromium/Edge CVEs — reported by different outlets as 569 or 622 depending on counting methodology and Chromium inclusion. Two vulnerabilities are confirmed exploited in the wild as zero-days prior to patch availability.

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control (CWE-1220). An authenticated, locally-positioned attacker can escalate to administrator privileges. Microsoft attributes discovery to its own Detection and Response Team (DART), indicating the flaw was found during incident-response work on a live compromise. Because AD FS underpins federated authentication trust across hybrid Azure AD/on-premises environments, successful exploitation risks broader identity-infrastructure compromise consistent with prior AD FS 'golden SAML' style attacks. CISA added it to the KEV catalog on 2026-07-14 with a 2026-07-28 remediation deadline.

CVE-2026-56164 is an elevation-of-privilege flaw in Microsoft SharePoint Server caused by missing authentication for a critical function (CWE-306), allowing an unauthenticated network attacker to escalate privileges. It affects SharePoint Enterprise Server 2016 (before build 16.0.5561.1001), SharePoint Server 2019 (before build 16.0.10417.20175), and SharePoint Server Subscription Edition (before build 16.0.19725.20434). It was credited to Jayson Frost (Mandiant) and Genwei Jiang together with the Google Cloud / Mandiant FLARE OTF team. Microsoft's interim mitigation is enabling AMSI integration with Request Body Scan mode set to Full. CISA's KEV entry carries an accelerated 2026-07-17 remediation deadline (3 days from disclosure), reflecting the elevated risk of SharePoint EoP bugs being chained with other flaws for full server takeover — a pattern seen repeatedly in prior on-premises SharePoint campaigns.

CVE-2026-50661 is a security-feature-bypass in Windows BitLocker (protection mechanism failure, CWE-693) requiring physical access to the target device; Microsoft rates it 'Exploitation Less Likely' and credits an anonymous researcher. The advisory description closely matches 'GreatXML,' a BitLocker bypass publicly disclosed on 2026-06-10 (one day after the June Patch Tuesday) by researcher Chaotic Eclipse (aka Nightmare Eclipse / MSNightmare). GreatXML abuses the WinRE (Windows Recovery Environment) trust boundary: on any system that has ever run a Microsoft Defender Offline scan, an attacker with physical access can copy a crafted unattend.xml file and a Recovery directory onto the recovery partition; WinRE processes these on reboot without proper integrity validation, granting full access to the BitLocker-protected volume without the recovery key.

Three further Critical RCEs round out the highest-severity items: CVE-2026-54128 (Windows DHCP Client, use-after-free, CWE-416, CVSS 8.4, rated 'Exploitation More Likely' by Microsoft, triggered by processing a malicious DHCP server response); CVE-2026-54982 (Reliable Multicast Transport Driver, integer underflow, CWE-191, CVSS 8.8, adjacent-network attack vector); and CVE-2026-54995 (RMCAST, use-after-free, CWE-416, CVSS 8.1, network attack vector). All three affect the current Windows 10/11 and Windows Server release matrix (Windows Server 2012 through 2025).

SANS ISC handler Johannes Ullrich, whose diary entry seeded this hunt, noted that despite the record CVE volume, patch workload should not scale proportionally: defenders 'still own the same number of Microsoft products,' with Microsoft attributing part of the volume increase to an internal AI-assisted vulnerability discovery pipeline.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1553 Subvert Trust Controls
- T1552 Unsecured Credentials
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1082 System Information Discovery
- T1685 Disable or Modify Tools
- T1542 Pre-OS Boot

## Sources

- [Microsoft Patch Tuesday July 2026 - The AI Apocalypse is Here](https://isc.sans.edu/diary/rss/33154)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://securityboulevard.com/2026/07/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164/)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [CISA KEV Catalog entry: CVE-2026-56155](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155)
- [CISA KEV Catalog entry: CVE-2026-56164](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164)
- [NVD CVE-2026-56155 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56155)
- [NVD CVE-2026-56164 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56164)
- [NVD CVE-2026-50661 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-50661)
- [NVD CVE-2026-54128 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54128)
- [NVD CVE-2026-54982 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54982)
- [NVD CVE-2026-54995 detail](https://nvd.nist.gov/vuln/detail/CVE-2026-54995)
- [New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files](https://thehackernews.com/2026/06/new-greatxml-exploit-bypasses-windows.html)
- [Nightmare Eclipse drops claimed BitLocker bypass for Microsoft Windows](https://www.theregister.com/security/2026/06/11/nightmare-eclipse-drops-claimed-bitlocker-bypass-for-microsoft-windows/5254371)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1330