Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)

Microsoft July 2026 Patch Tuesday (TL-2026-1334), also tracked as July 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-07-14 and last reviewed 2026-08-06. It has no confirmed attribution, affects Microsoft SharePoint Server, references 15 CVEs (CVE-2026-56164, CVE-2026-56155, CVE-2026-50661), maps to 36 MITRE ATT&CK techniques (T1005, T1021, T1033), and is covered by 9 detection rules and 54 indicators of compromise.

Key facts for TL-2026-1334

Threat ID
TL-2026-1334
Also known as
July 2026 Patch Tuesday, The Mother of All Releases
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-08-06
Attribution confidence
LOW
Motivation
ESPIONAGE
Target sectors
government administration, finance, health, software, telecoms, business-services, consumer-goods
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
54
Updates
2026-08-06 · 2 updates · revalidated 2× · latest source

Malware and tooling in Microsoft July 2026 Patch Tuesday

Malware and tooling: LockBit, Warlock ransomware (X2anylock)

Microsoft's July 2026 Patch Tuesday fixed a record 622 CVEs (independent counts range 569-622), more than tripling June's prior high. Two flaws are under active exploitation as zero-days: an unauthenticated, network-exploitable SharePoint Server elevation-of-privilege bug (CVE-2026-56164, CVSS 5.3) discovered by Mandiant and Google FLARE, and an Active Directory Federation Services elevation-of-privilege flaw (CVE-2026-56155, CVSS 7.8) discovered by Microsoft DART that lets a locally-authenticated attacker escalate to administrator on authentication token-signing infrastructure. A publicly disclosed but not-yet-exploited BitLocker security-feature-bypass (CVE-2026-50661, CVSS 6.1) requires physical device access. The release also includes the month's highest-severity flaw, a CVSS 9.9 use-after-free elevation of privilege in Windows VMSwitch/Hyper-V (CVE-2026-57092), a critical unauthenticated SharePoint deserialization RCE pair (CVE-2026-50522/CVE-2026-58644, CVSS 9.8) demonstrated at Pwn2Own Berlin, a SharePoint JWT authentication-bypass (CVE-2026-55040, CVSS 9.1, disputed 5.3-9.1) whose paired RCE is not patched until August 2026, and critical SQL Server RCEs (CVE-2026-54117/CVE-2026-54118, CVSS 8.8). Microsoft also removed the Kerberos RC4 fallback rollback switch this month, which will break authentication for any service account not explicitly configured for AES.

How Microsoft July 2026 Patch Tuesday works

Microsoft's July 2026 Patch Tuesday is the largest security update in the company's history, addressing 622 CVEs by Microsoft's own count (ZDI counted 621; several trade outlets reported an intermediate 569-570 figure before final numbers settled), more than triple June 2026's prior record of roughly 200. The scale is attributed in reporting to Microsoft's internal MDASH AI-assisted vulnerability-discovery system, which alone reportedly surfaced 16 bugs in May 2026, alongside an industry-wide rise in automated patch-diffing that shortens the window between disclosure and working exploit code.

Two vulnerabilities are confirmed under active exploitation as zero-days, both elevation-of-privilege bugs rather than the more commonly weaponized RCE class, illustrating that CVSS severity alone is an unreliable prioritization signal this cycle. CVE-2026-56164 is a missing-authentication-for-critical-function flaw in on-premises Microsoft SharePoint Server (2016, 2019, Enterprise Server 2016, and Subscription Edition) that lets an unauthenticated attacker escalate privileges over the network with no user interaction, discovered by Mandiant incident responders and Google's FLARE team. It follows the well-documented 'ToolShell' SharePoint exploit-chain lineage (CVE-2025-49704/49706/53770/53771) that Storm-2603, a suspected China-based ransomware actor, and espionage actors Threat Group-3390 and ZIRCONIUM weaponized in mid-2025 to drop web shells (spinstall0.aspx and renamed variants such as spinstall1.aspx/spinstall2.aspx) that exfiltrate ASP.NET MachineKey material, enabling persistent unauthenticated code execution even after patching unless keys are rotated. Storm-2603's campaign went on to deploy Warlock (aka X2anylock) and LockBit ransomware via w3wp.exe-spawned command execution and Defender-disabling registry edits through services.exe, compromising 300+ organizations. A related follow-on SharePoint KEV entry, CVE-2026-45659, continued this Warlock-ransomware pattern into 2026, underscoring that unauthenticated SharePoint EoP/RCE chains remain an active, repeatable playbook for the same actor cluster. Microsoft's AMSI-in-Full-Mode integration is the primary in-product mitigation for CVE-2026-56164 by scanning malicious POST requests to affected ASPX endpoints.

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services caused by insufficient granularity of access control, requiring local access and low privileges to trigger but granting administrator-level privileges on the token-signing infrastructure that underpins hybrid Azure AD/on-premises authentication trust. Microsoft DART (Detection and Response Team) is credited with discovery; Microsoft has not disclosed the specific privilege grant or exploitation methodology. Because AD FS issues SAML tokens, compromise of this component mirrors the risk profile of 'Golden SAML' attacks, in which a stolen token-signing certificate lets an adversary forge arbitrary SAML assertions and impersonate any federated identity indefinitely, bypassing MFA and conditional access entirely.

A third, publicly disclosed but not-yet-exploited zero-day, CVE-2026-50661, is a BitLocker security-feature bypass requiring physical device access; public PoCs already exist. It continues 2026's BitLocker-bypass trend alongside CVE-2026-45585 ('YellowKey', which targeted the Windows Recovery Environment rather than BitLocker's core encryption) and an unconfirmed possible link to a researcher-disclosed flaw referred to in reporting as 'GreatXML'/'Nightmare-Eclipse'/'Chaotic-Eclipse' (no official Microsoft confirmation).

Beyond the zero-days, the release's highest CVSS score (9.9) belongs to CVE-2026-57092, a use-after-free elevation-of-privilege in Windows VMSwitch that lets a low-privileged attacker escalate across the VM boundary to full Hyper-V host compromise — an urgent patch for any virtualization host. CVE-2026-50522 (paired with CVE-2026-58644), both CVSS 9.8, are unauthenticated deserialization-of-untrusted-data RCEs in SharePoint Server demonstrated at Pwn2Own Berlin; exploit maturity is listed as unknown but the attack surface (internet-facing SharePoint) mirrors the ToolShell precedent closely. CVE-2026-55040 is a SharePoint JWT authentication-bypass rated critically differently by researchers (Rapid7 Labs: 5.3, ZDI: 9.1) that chains into an as-yet-unpatched RCE arriving in the August 2026 release, making it a priority to track even though it cannot yet be fully exploited. CVE-2026-55008 is a stored XSS in Outlook Web Access (filed by Microsoft as spoofing, CVSS 9.6) triggered simply by a victim opening a crafted email in OWA, executing arbitrary JavaScript in their browser session. CVE-2026-54117/CVE-2026-54118 are paired critical RCEs in SQL Server (CVSS 8.8 each). Additional named vulnerabilities in this release include CVE-2026-56190 (RDP RCE), CVE-2026-50518 (Windows DHCP Server RCE, one of five DHCP RCEs this month), and CVE-2026-56188 (Windows Server network-driver RCE), alongside 95 total RCEs across the Windows product line and 21 NTFS/ReFS driver bugs.

A significant operational change ships alongside the vulnerabilities: Microsoft removed the Kerberos RC4 fallback rollback switch this month. Authentication will now fail outright for any service account not explicitly configured for AES, requiring organizations to audit RC4 usage (using audit events Microsoft made available in January 2026), rotate passwords on flagged accounts to force AES key generation, and identify legacy clients still requiring RC4 before deploying — Microsoft and downstream analysts explicitly recommend deploying this particular change last, after validating authentication in a test environment, due to the risk of production authentication outages.

CISA issued guidance urging SharePoint hardening in response to the renewed exploitation activity, consistent with its prior additions of SharePoint ToolShell-family and Warlock-linked CVEs (including CVE-2026-45659) to the Known Exploited Vulnerabilities catalog.

MITRE ATT&CK techniques used in TL-2026-1334

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1550 Use Alternate Authentication Material; T1550.004 Use Alternate Authentication Material: Web Session Cookie

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal; T1211 Exploitation for Stealth

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Persistence

T1053 Scheduled Task/Job; T1098 Account Manipulation; T1505 Server Software Component

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Impact

T1486 Data Encrypted for Impact

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files; T1606 Forge Web Credentials

Resource Development

T1587.001 Develop Capabilities: Malware; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in Microsoft July 2026 Patch Tuesday

  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2016; SharePoint Enterprise Server 2016; SharePoint Server 2019; SharePoint Server Subscription Edition
    Fixed in: July 2026 cumulative update
  • Microsoft — Active Directory Federation Services
    Vulnerable versions: AD FS on Windows Server (hybrid Azure AD/on-prem deployments)
    Fixed in: July 2026 security update
  • Microsoft — Windows (BitLocker)
    Vulnerable versions: Windows client and server with BitLocker enabled
    Fixed in: July 2026 security update
  • Microsoft — Windows Hyper-V / VMSwitch
    Vulnerable versions: Windows Server and Windows client hosts running Hyper-V
    Fixed in: July 2026 security update
  • Microsoft — SQL Server
    Vulnerable versions: Affected Microsoft SQL Server releases
    Fixed in: July 2026 security update
  • Microsoft — Exchange Server / Outlook Web Access
    Vulnerable versions: Exchange Server with OWA enabled
    Fixed in: July 2026 security update
  • Microsoft — Windows Server 2016
    Vulnerable versions: Windows Server 2016 (extended support)
    Fixed in: End of extended support 2026-07-14; upgrade required
  • Microsoft — Windows Server 2019
    Vulnerable versions: Windows Server 2019 (extended support)
    Fixed in: End of extended support 2026-07-14; upgrade required

Remediation for Microsoft July 2026 Patch Tuesday

Patches

  • Apply Microsoft's July 2026 cumulative security updates for CVE-2026-56164, CVE-2026-56155, CVE-2026-57092, CVE-2026-50522, CVE-2026-58644, CVE-2026-55040, CVE-2026-54117, CVE-2026-54118, CVE-2026-55008, CVE-2026-50661, CVE-2026-56190, CVE-2026-50518, CVE-2026-56188
  • Track the still-unpatched RCE component chained to CVE-2026-55040, scheduled for Microsoft's August 2026 release

Immediate actions

  • Patch CVE-2026-56164 (SharePoint Server EoP) on all on-premises SharePoint Server 2016/2019/Subscription Edition instances immediately; both are actively exploited zero-days
  • Patch CVE-2026-56155 (AD FS EoP) on all Active Directory Federation Services servers immediately
  • Enable AMSI in Full Mode on SharePoint Server to scan and block malicious POST requests targeting CVE-2026-56164
  • Rotate ASP.NET machine keys on all on-premises SharePoint servers regardless of patch status, consistent with the ToolShell/spinstall0.aspx precedent where key theft persists after patching
  • Hunt for spinstall0.aspx and renamed variants (spinstall1.aspx, spinstall2.aspx, etc.) and other unauthorized ASPX files under SharePoint _layouts/15/ directories
  • Note Windows Server 2016/2019 reached end of extended support on 2026-07-14, coinciding with this release

Workarounds

  • Where immediate patching of SharePoint is not possible, restrict external/internet access to on-premises SharePoint Server endpoints as an interim compensating control
  • For CVE-2026-50661 (BitLocker), enforce physical device security controls (e.g., pre-boot authentication, chassis intrusion detection) until patched
  • Audit and remediate RC4 Kerberos dependencies BEFORE deploying the RC4-fallback-removal patch; deploy that specific patch last and only after validating authentication in a test environment

Longer-term hardening

  • Deploy EDR/behavioral detection tuned to w3wp.exe spawning cmd.exe, whoami, or other discovery/LOLBin commands on SharePoint hosts
  • Monitor services.exe for unauthorized Windows Defender registry modifications
  • Implement network segmentation isolating Hyper-V management interfaces to reduce CVE-2026-57092 VMSwitch attack surface
  • Review AD FS token-signing certificate access controls and rotate token-signing certificates if compromise of CVE-2026-56155 is suspected
  • Establish a patch-diffing-aware rapid deployment process given the shrinking window between disclosure and working exploits

CVEs associated with Microsoft July 2026 Patch Tuesday

Weaknesses (CWE) in Microsoft July 2026 Patch Tuesday

CWE-306, CWE-284, CWE-1259, CWE-416, CWE-502, CWE-345, CWE-79, CWE-94, CWE-20, CWE-1390

Timeline of Microsoft July 2026 Patch Tuesday

Showing the 20 most recent tracked events.

  • CISA adds CVE-2026-45659 to KEV with a 3-day remediation deadline.
  • CISA adds CVE-2026-56164 to KEV with an unprecedented 3-day remediation deadline (due July 17), reflecting its assessment of exploitation velocity.
  • CISA issues guidance urging SharePoint hardening in response to the renewed active exploitation of on-premises SharePoint infrastructure.
  • Windows Server 2016 and Windows Server 2019 reach end of extended support, coinciding with the patch release and increasing urgency for affected SharePoint/AD FS hosts still running these versions.
  • CVE-2026-56155 (AD FS EoP) is confirmed under active exploitation, discovered by Microsoft DART.
  • CVE-2026-56164 (SharePoint EoP) is confirmed under active exploitation, discovered by Mandiant incident responders and Google FLARE.
  • Microsoft releases July 2026 Patch Tuesday updates addressing a record 622 CVEs (569-622 depending on counting methodology), including CVE-2026-56164, CVE-2026-56155, CVE-2026-50661, CVE-2026-57092, CVE-2026-50522/58644, CVE-2026-55040, CVE-2026-54117/54118, and CVE-2026-55008.
  • Canadian Centre for Cyber Security issues AL26-017 warning of the critical SharePoint vulnerability chain and SharePoint 2016/2019 end-of-life implications.
  • Censys publishes an advisory identifying roughly 1,500 internet-facing on-premises SharePoint instances vulnerable to CVE-2026-50522/CVE-2026-58644 across the US, Germany, France, Canada, Iran, and Australia.
  • CISA adds the companion actively-exploited flaw CVE-2026-58644 to its Known Exploited Vulnerabilities catalog; Rapid7 publishes an Emerging Threat Response detailing its in-the-wild exploitation.
  • Detection vendor Defused observes an undocumented SharePoint deserialization attack vector in live traffic, ahead of public PoC release and initially unable to attribute it to a specific CVE.
  • A PowerShell proof-of-concept for CVE-2026-50522 is published on GitHub by researcher "Janggggg"; watchTowr identifies the public PoC circulating within hours, and the honeypot network "Attacker Eye" begins capturing successful live exploitation attempts.
  • Public reporting reiterates that patching CVE-2026-50522 alone does not remediate compromise — organizations exploited pre-patch retain attacker access via stolen machine keys until those keys are explicitly rotated.
  • The Hacker News and BleepingComputer report confirmed active in-the-wild exploitation of CVE-2026-50522, with attackers sending forged WS-Federation SecurityContextToken payloads to /_trust/default.aspx to extract SharePoint machine keys.
  • CISA adds CVE-2026-50522 to KEV with active exploitation confirmed; BleepingComputer publishes a detailed analysis of the machine-key theft mechanism.
  • Switzerland's Federal Office for Information Technology and Telecommunication (BIT) detects anomalous activity on its on-premises SharePoint servers; external internet access is immediately blocked.
  • BIT confirms approximately 200 user and technical accounts had login credentials compromised; passwords reset for all affected accounts; Swiss NCSC and Microsoft engaged.
  • Microsoft's scheduled August 2026 release is expected to ship the still-outstanding RCE component chained to CVE-2026-55040's JWT authentication bypass.
  • BIT publicly discloses the breach and announces it is reinstalling compromised SharePoint servers entirely as a precaution; no confidential or particularly sensitive personal data is permitted on the affected platform.
  • BleepingComputer and Security Affairs report on the Swiss government SharePoint breach; no threat actor has claimed responsibility; CERT-EU advisory 2026-009 recommends against exposing SharePoint directly to the internet.

Update history for TL-2026-1334

Sources cited for Microsoft July 2026 Patch Tuesday

Threats related to Microsoft July 2026 Patch Tuesday

Detection coverage for TL-2026-1334

As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1334 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats