# Microsoft July 2026 Patch Tuesday: Record 622 CVEs Include Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint Server (CVE-2026-56164)

> Microsoft's July 2026 Patch Tuesday shattered all prior records, addressing roughly 570-622 CVEs (source counts vary: 569, 570, 621, 622) including two zero-days confirmed under active exploitation and added to the CISA KEV catalog: CVE-2026-56155, an Active Directory Federation Services (AD FS) elevation-of-privilege flaw (CVSS 7.8), and CVE-2026-56164, a SharePoint Server missing-authentication elevation-of-privilege flaw (CVSS 5.3). A third zero-day, CVE-2026-50661 (Windows BitLocker security-feature bypass), was publicly disclosed but not confirmed exploited. 56-63 of the CVEs fixed this cycle were rated Critical, including several CVSS 9.8-9.9 remote code execution flaws.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1331
- **ID:** TL-2026-1331
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-57092, CVE-2026-50522, CVE-2026-58644, CVE-2026-56190, CVE-2026-50518, CVE-2026-56159, CVE-2026-56188, CVE-2026-55008, CVE-2026-55944, CVE-2026-48561, CVE-2026-55011, CVE-2026-55012, CVE-2026-55010, CVE-2026-45585

## Description

On July 14, 2026, Microsoft released its largest Patch Tuesday on record, addressing between 569 and 622 CVEs depending on the counting methodology used by different research teams (Trend Micro/ZDI cites 569-621; other outlets cite 570 or 622) — more than triple June 2026's prior record of 206. Security researchers including Dustin Childs of Trend Micro's Zero Day Initiative called it 'the mother of all releases' and 'the bug apocalypse,' while Satnam Narang of Tenable attributed the volume growth to AI-assisted vulnerability discovery tooling (referred to in coverage as MDASH) rather than a genuine spike in underlying risk. Microsoft is now projecting it will exceed 2,000-3,000 disclosed CVEs for calendar year 2026, well above 2020's prior full-year record of 1,245.

Two vulnerabilities in this release were confirmed as zero-days under active exploitation in the wild and were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on the release date:

1. **CVE-2026-56155** — an elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control (CWE-1220). CVSS 3.1 base score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — a locally-authenticated, low-privileged attacker can escalate to administrator. Microsoft credits the discovery to Jeremy Kingston and Scott Clark of its own Detection and Response Team (DART), the incident-response unit that investigates active intrusions — a strong signal the bug was found via forensics on a real compromise rather than proactive research. Because AD FS underpins federated authentication trust across hybrid Azure AD / on-premises environments, ZDI analysts flagged it as a high-value pivot point for identity-infrastructure compromise, drawing comparisons to historical 'Golden SAML' token-forgery attack patterns against AD FS token-signing certificates. Affects Windows Server 2012 through Windows Server 2025 and Windows 10 hosts running the AD FS role. CISA set a remediation due date of July 28, 2026.

2. **CVE-2026-56164** — an elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function (CWE-306). CVSS 3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) — despite the 'Moderate' label, it is unauthenticated, network-reachable, and requires no user interaction, letting a remote attacker elevate privileges over the network. Credited to Jayson Frost (Mandiant) and Genwei Jiang (Google Cloud) — both threat-intelligence firms with histories of tracking SharePoint on-prem exploitation by espionage actors. Affects SharePoint Enterprise Server 2016 (< 16.0.5561.1001), SharePoint Server 2019 (< 16.0.10417.20175), and SharePoint Server Subscription Edition (< 16.0.19725.20434). Microsoft's stated mitigation is enabling Antimalware Scan Interface (AMSI) integration with Request Body Scan mode set to Full, which can detect malicious POST requests exploiting the flaw. CISA set an accelerated remediation due date of July 17, 2026 (3 days), reflecting the low exploitation bar and SharePoint's history as a preferred on-prem target for state-linked intrusion sets (ToolShell/CVE-2025-53770 lineage).

A third notable zero-day, **CVE-2026-50661**, is a Windows BitLocker Device Encryption security-feature-bypass vulnerability that was publicly disclosed prior to patch availability, though not confirmed as actively exploited. It requires physical access to the target device and exploits weaknesses in BitLocker's recovery environment rather than the core encryption implementation — researchers drew a direct parallel to the earlier 2026 BitLocker recovery-environment bypass tracked as CVE-2026-45585.

Beyond the zero-days, the release included a large cluster of Critical-rated remote code execution flaws: CVE-2026-57092 (Windows VMSwitch EoP, CVSS 9.9, use-after-free enabling guest-to-host VM escape — the highest score of the cycle); a matched pair of SharePoint deserialization RCEs, CVE-2026-50522 and CVE-2026-58644 (CVSS 9.8 each, unauthenticated, no user interaction — CVE-2026-50522 was previously demonstrated live at Pwn2Own Berlin); CVE-2026-56190 (RDP client/server RCE, CVSS 9.8, use-of-uninitialized-resource); CVE-2026-50518 (Windows DHCP Server RCE, CVSS 9.8, heap-based buffer overflow, unauthenticated network-reachable); CVE-2026-56188 (Windows Server network driver RCE, CVSS 9.8, TOCTOU race condition, assessed as potentially wormable); CVE-2026-55008 (Exchange/Outlook Web Access stored XSS, CVSS 9.6, triggered simply by opening a crafted email); and CVE-2026-55944 and CVE-2026-56159 (Dynamics NAV/365 Business Central and DHCP Server, CVSS 9.8 each). Additional Critical RCE flaws spanned Microsoft Copilot (CVE-2026-48561), Microsoft Defender (CVE-2026-55011, CVE-2026-55012), Microsoft Office (CVE-2026-55129, CVE-2026-55049, CVE-2026-55045, CVE-2026-50314, CVE-2026-50467, CVE-2026-55022, CVE-2026-55018, CVE-2026-55056, CVE-2026-55120, CVE-2026-55043, CVE-2026-55123), DirectX/GDI+ (CVE-2026-50382, CVE-2026-49796, CVE-2026-50380), the RMCAST reliable-multicast driver (CVE-2026-54995, CVE-2026-54982), Remote Desktop Client (CVE-2026-50474), and SQL Server (CVE-2026-54118, CVE-2026-54117). Windows components accounted for the largest single share of fixes (416 CVEs), followed by Office (82) and Microsoft Edge (46). Adobe separately released 88 CVEs across 12 bulletins the same day, moving to a bimonthly release cadence.

No public threat-actor attribution has been made for the exploitation of CVE-2026-56155 or CVE-2026-56164 as of this writing; ransomware use of either flaw is listed as 'Unknown' in the CISA KEV catalog. Given AD FS and SharePoint's long history as targets for state-linked espionage actors (Golden SAML abuse of AD FS by suspected Russian-nexus intrusion sets; the ToolShell SharePoint exploitation chain attributed to Chinese state-linked actors in 2025), defenders should treat both flaws as high-priority identity- and collaboration-infrastructure targeting until attribution is clarified.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1190 Exploit Public-Facing Application
- T1606 Forge Web Credentials
- T1528 Steal Application Access Token
- T1211 Exploitation for Stealth
- T1556 Modify Authentication Process
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1210 Exploitation of Remote Services
- T1046 Network Service Discovery
- T1489 Service Stop
- T1213 Data from Information Repositories
- T1219 Remote Access Tools
- T1078 Valid Accounts

## Sources

- [Microsoft Patch Tuesday July 2026 sets record with 622 CVEs, two zero-days under active exploitation](https://cyberscoop.com/microsoft-patch-tuesday-july-2026/)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://securityboulevard.com/2026/07/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164/)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [Microsoft Patches a Record 570 Security Flaws](https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/)
- [NVD - CVE-2026-56155](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56155)
- [NVD - CVE-2026-56164](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56164)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-56155](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-56164](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164)
- [MSRC Security Update Guide - CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155)
- [MSRC Security Update Guide - CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1331