# Microsoft July 2026 Patch Tuesday: Record 622 Flaws Fixed, Two Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-56155)

> Microsoft's July 2026 Patch Tuesday fixed a record 622 CVEs (independent counts range 569-622), more than tripling June's prior high. Two flaws are under active exploitation as zero-days: an unauthenticated, network-exploitable SharePoint Server elevation-of-privilege bug (CVE-2026-56164, CVSS 5.3) discovered by Mandiant and Google FLARE, and an Active Directory Federation Services elevation-of-privilege flaw (CVE-2026-56155, CVSS 7.8) discovered by Microsoft DART that lets a locally-authenticated attacker escalate to administrator on authentication token-signing infrastructure. A publicly disclosed but not-yet-exploited BitLocker security-feature-bypass (CVE-2026-50661, CVSS 6.1) requires physical device access. The release also includes the month's highest-severity flaw, a CVSS 9.9 use-after-free elevation of privilege in Windows VMSwitch/Hyper-V (CVE-2026-57092), a critical unauthenticated SharePoint deserialization RCE pair (CVE-2026-50522/CVE-2026-58644, CVSS 9.8) demonstrated at Pwn2Own Berlin, a SharePoint JWT authentication-bypass (CVE-2026-55040, CVSS 9.1, disputed 5.3-9.1) whose paired RCE is not patched until August 2026, and critical SQL Server RCEs (CVE-2026-54117/CVE-2026-54118, CVSS 8.8). Microsoft also removed the Kerberos RC4 fallback rollback switch this month, which will break authentication for any service account not explicitly configured for AES.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-08-06T20:28:17.492Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1334
- **ID:** TL-2026-1334
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 54 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56164, CVE-2026-56155, CVE-2026-50661, CVE-2026-57092, CVE-2026-50522, CVE-2026-58644, CVE-2026-55040, CVE-2026-54117, CVE-2026-54118, CVE-2026-55008, CVE-2026-56190, CVE-2026-50518, CVE-2026-56188, CVE-2026-32201, CVE-2026-45659

## Description

Microsoft's July 2026 Patch Tuesday is the largest security update in the company's history, addressing 622 CVEs by Microsoft's own count (ZDI counted 621; several trade outlets reported an intermediate 569-570 figure before final numbers settled), more than triple June 2026's prior record of roughly 200. The scale is attributed in reporting to Microsoft's internal MDASH AI-assisted vulnerability-discovery system, which alone reportedly surfaced 16 bugs in May 2026, alongside an industry-wide rise in automated patch-diffing that shortens the window between disclosure and working exploit code.

Two vulnerabilities are confirmed under active exploitation as zero-days, both elevation-of-privilege bugs rather than the more commonly weaponized RCE class, illustrating that CVSS severity alone is an unreliable prioritization signal this cycle. CVE-2026-56164 is a missing-authentication-for-critical-function flaw in on-premises Microsoft SharePoint Server (2016, 2019, Enterprise Server 2016, and Subscription Edition) that lets an unauthenticated attacker escalate privileges over the network with no user interaction, discovered by Mandiant incident responders and Google's FLARE team. It follows the well-documented 'ToolShell' SharePoint exploit-chain lineage (CVE-2025-49704/49706/53770/53771) that Storm-2603, a suspected China-based ransomware actor, and espionage actors Threat Group-3390 and ZIRCONIUM weaponized in mid-2025 to drop web shells (spinstall0.aspx and renamed variants such as spinstall1.aspx/spinstall2.aspx) that exfiltrate ASP.NET MachineKey material, enabling persistent unauthenticated code execution even after patching unless keys are rotated. Storm-2603's campaign went on to deploy Warlock (aka X2anylock) and LockBit ransomware via w3wp.exe-spawned command execution and Defender-disabling registry edits through services.exe, compromising 300+ organizations. A related follow-on SharePoint KEV entry, CVE-2026-45659, continued this Warlock-ransomware pattern into 2026, underscoring that unauthenticated SharePoint EoP/RCE chains remain an active, repeatable playbook for the same actor cluster. Microsoft's AMSI-in-Full-Mode integration is the primary in-product mitigation for CVE-2026-56164 by scanning malicious POST requests to affected ASPX endpoints.

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services caused by insufficient granularity of access control, requiring local access and low privileges to trigger but granting administrator-level privileges on the token-signing infrastructure that underpins hybrid Azure AD/on-premises authentication trust. Microsoft DART (Detection and Response Team) is credited with discovery; Microsoft has not disclosed the specific privilege grant or exploitation methodology. Because AD FS issues SAML tokens, compromise of this component mirrors the risk profile of 'Golden SAML' attacks, in which a stolen token-signing certificate lets an adversary forge arbitrary SAML assertions and impersonate any federated identity indefinitely, bypassing MFA and conditional access entirely.

A third, publicly disclosed but not-yet-exploited zero-day, CVE-2026-50661, is a BitLocker security-feature bypass requiring physical device access; public PoCs already exist. It continues 2026's BitLocker-bypass trend alongside CVE-2026-45585 ('YellowKey', which targeted the Windows Recovery Environment rather than BitLocker's core encryption) and an unconfirmed possible link to a researcher-disclosed flaw referred to in reporting as 'GreatXML'/'Nightmare-Eclipse'/'Chaotic-Eclipse' (no official Microsoft confirmation).

Beyond the zero-days, the release's highest CVSS score (9.9) belongs to CVE-2026-57092, a use-after-free elevation-of-privilege in Windows VMSwitch that lets a low-privileged attacker escalate across the VM boundary to full Hyper-V host compromise — an urgent patch for any virtualization host. CVE-2026-50522 (paired with CVE-2026-58644), both CVSS 9.8, are unauthenticated deserialization-of-untrusted-data RCEs in SharePoint Server demonstrated at Pwn2Own Berlin; exploit maturity is listed as unknown but the attack surface (internet-facing SharePoint) mirrors the ToolShell precedent closely. CVE-2026-55040 is a SharePoint JWT authentication-bypass rated critically differently by researchers (Rapid7 Labs: 5.3, ZDI: 9.1) that chains into an as-yet-unpatched RCE arriving in the August 2026 release, making it a priority to track even though it cannot yet be fully exploited. CVE-2026-55008 is a stored XSS in Outlook Web Access (filed by Microsoft as spoofing, CVSS 9.6) triggered simply by a victim opening a crafted email in OWA, executing arbitrary JavaScript in their browser session. CVE-2026-54117/CVE-2026-54118 are paired critical RCEs in SQL Server (CVSS 8.8 each). Additional named vulnerabilities in this release include CVE-2026-56190 (RDP RCE), CVE-2026-50518 (Windows DHCP Server RCE, one of five DHCP RCEs this month), and CVE-2026-56188 (Windows Server network-driver RCE), alongside 95 total RCEs across the Windows product line and 21 NTFS/ReFS driver bugs.

A significant operational change ships alongside the vulnerabilities: Microsoft removed the Kerberos RC4 fallback rollback switch this month. Authentication will now fail outright for any service account not explicitly configured for AES, requiring organizations to audit RC4 usage (using audit events Microsoft made available in January 2026), rotate passwords on flagged accounts to force AES key generation, and identify legacy clients still requiring RC4 before deploying — Microsoft and downstream analysts explicitly recommend deploying this particular change last, after validating authentication in a test environment, due to the risk of production authentication outages.

CISA issued guidance urging SharePoint hardening in response to the renewed exploitation activity, consistent with its prior additions of SharePoint ToolShell-family and Warlock-linked CVEs (including CVE-2026-45659) to the Known Exploited Vulnerabilities catalog.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1112 Modify Registry
- T1606 Forge Web Credentials
- T1552 Unsecured Credentials
- T1033 System Owner/User Discovery
- T1550 Use Alternate Authentication Material
- T1071 Application Layer Protocol
- T1486 Data Encrypted for Impact
- T1595.002 Active Scanning: Vulnerability Scanning
- T1592.002 Gather Victim Host Information: Software
- T1588.005 Obtain Capabilities: Exploits
- T1587.001 Develop Capabilities: Malware
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1048 Exfiltration Over Alternative Protocol
- T1036 Masquerading
- T1070 Indicator Removal
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1098 Account Manipulation
- T1053 Scheduled Task/Job
- T1105 Ingress Tool Transfer
- T1572 Protocol Tunneling

## Sources

- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [Zero Day Initiative — The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://securityboulevard.com/2026/07/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164/)
- [Microsoft discloses 'the mother of all' vulnerability loads, tripling June's previous record](https://cyberscoop.com/microsoft-patch-tuesday-july-2026/)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [Microsoft July 2026 Security Updates: Critical BitLocker and AD FS Fixes](https://www.ntcompatible.com/story/microsoft-july-2026-security-updates-critical-bitlocker-and-ad-fs-fixes)
- [SharePoint ToolShell Exploitation, Campaign C0058](https://attack.mitre.org/campaigns/C0058/)
- [Disrupting active exploitation of on-premises SharePoint vulnerabilities](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)
- [Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems](https://thehackernews.com/2025/07/storm-2603-exploits-sharepoint-flaws-to.html)
- [Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks](https://thehackernews.com/2025/08/storm-2603-exploits-sharepoint-flaws-to.html)
- [CVE-2026-45659: SharePoint on KEV and Warlock ransomware](https://hard2bit.com/en/blog/cve-2026-45659-sharepoint-kev-storm2603-warlock/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1334