# Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS and SharePoint (CVE-2026-56155, CVE-2026-56164)

> Microsoft's July 2026 Patch Tuesday fixed a record 622 vulnerabilities (57 critical), including two flaws confirmed under active exploitation: CVE-2026-56155, a local privilege-escalation bug in Active Directory Federation Services (AD FS), and CVE-2026-56164, a critical missing-authentication/spoofing flaw in on-premises SharePoint Server tied to a ToolShell-style attack chain. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog the same day and ordered federal agencies to mitigate within days.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-19T03:06:29.018Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1336
- **ID:** TL-2026-1336
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** APT27 (China)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50522, CVE-2026-58644, CVE-2026-50518, CVE-2026-50370, CVE-2026-54128, CVE-2026-57092, CVE-2026-56190, CVE-2026-56188, CVE-2026-55944, CVE-2026-55010, CVE-2026-50327, CVE-2026-50655, CVE-2026-54992, CVE-2026-50661, CVE-2026-55008, CVE-2026-42982, CVE-2026-50392, CVE-2026-50444, CVE-2026-50680, CVE-2026-54127

## Description

On July 14, 2026, Microsoft shipped its largest Patch Tuesday to date, addressing 622 CVEs (416 in Windows, 164 in Office products), 57 rated critical. Two vulnerabilities were confirmed exploited in the wild at release. CVE-2026-56155 is an Elevation of Privilege vulnerability in Active Directory Federation Services caused by insufficient granularity of access control (CWE-1220); an authorized local attacker with low privileges can escalate to administrator, which is particularly dangerous because AD FS underpins federated authentication trust across hybrid Azure AD/on-premises environments and is a favored pivot point once an attacker has an initial foothold, echoing prior AD FS golden-SAML style attacks. Microsoft credited Jeremy Kingston and Scott Clark of its own Detection and Response Team (DART) with the finding, suggesting it was surfaced during an active incident-response engagement. CVE-2026-56164 is a Missing Authentication for Critical Function vulnerability (CWE-306) in Microsoft SharePoint Server that lets an unauthorized, unauthenticated attacker elevate privileges over the network with no user interaction. Despite Microsoft's own 'Moderate' severity label, NVD scores it CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because it is remotely reachable and trivially weaponizable. CISA added CVE-2026-56164 to the KEV catalog on July 14, 2026, and observed post-exploitation activity consistent with the 2025 'ToolShell' SharePoint attack chain: attackers deserialize untrusted data server-side to gain code execution as the IIS worker process (w3wp.exe), then steal ASP.NET machine keys (ValidationKey/DecryptionKey) to forge ViewState payloads for durable, re-exploitable remote code execution even after the initial vulnerability is patched, and drop lightweight .aspx web shells (e.g., spinstall0.aspx and the spinstallN.aspx family) under SharePoint LAYOUTS/wwwroot paths for persistence. Security reporting ties active exploitation of this vulnerability class to China-nexus threat actors Linen Typhoon, Violet Typhoon, and Storm-2603, the same clusters Microsoft previously linked to on-premises SharePoint ToolShell exploitation, with Storm-2603 historically pivoting stolen access into ransomware deployment. Eleven additional critical remote-code-execution bugs were flagged by Microsoft as 'more likely' to be exploited, including CVE-2026-50522 and CVE-2026-58644 (SharePoint deserialization RCE, CVSS 9.8, demonstrated at Pwn2Own Berlin), CVE-2026-50518 and CVE-2026-50370 (Windows DHCP Server heap-based buffer overflow RCE, CVSS 9.8, network-reachable), CVE-2026-54128 (Windows DHCP Client use-after-free), CVE-2026-57092 (Windows VMSwitch elevation of privilege via use-after-free, CVSS 9.9, the month's highest score, enabling a low-privileged guest to fully compromise the Hyper-V host across the VM boundary), CVE-2026-56190 (RDP RCE via uninitialized resource, CWE-908, CVSS 9.8), CVE-2026-56188 (Windows Server networking race condition), CVE-2026-55944 (Dynamics NAV/365 deserialization RCE), CVE-2026-55010 (Minecraft Bedrock heap overflow), CVE-2026-50327 (Windows Media heap overflow), CVE-2026-50655 (Media Foundation heap overflow), and CVE-2026-54992 (Message Queuing heap overflow). Also disclosed was CVE-2026-50661, a publicly-known BitLocker security-feature-bypass affecting physical-access scenarios, and CVE-2026-55008, a cross-site scripting flaw in Exchange Server. Given internet-exposed SharePoint and DHCP infrastructure, unauthenticated deserialization RCE, and confirmed nation-state exploitation, defenders should prioritize patching AD FS and on-premises SharePoint immediately, hunt for ToolShell-pattern web shells and machine-key theft, and rotate ASP.NET machine keys post-patch since key theft survives patching.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1486 Data Encrypted for Impact

## Sources

- [Microsoft Patch Tuesday for July 2026 — Talos Intelligence](https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/)
- [Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days - SecurityWeek](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/)
- [Zero Day Initiative — The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [NVD CVE-2026-56155 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56155)
- [NVD CVE-2026-56164 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-56164)
- [Hackers Can Steal IIS Machine Keys by Exploiting SharePoint Deserialization Vulnerability](https://cybersecuritynews.com/iis-machine-keys/)
- [Hackers Target SharePoint Flaw to Access IIS Machine Keys](https://gbhackers.com/hackers-target-sharepoint-flaw/)
- [Detecting the ToolShell SharePoint Exploit](https://www.anomali.com/blog/detecting-the-toolshell-sharepoint-exploit)
- [ToolShell Unleashed: Decoding the SharePoint Attack Chain](https://www.trellix.com/blogs/research/toolshell-unleashed-decoding-the-sharepoint-attack-chain/)
- [Disrupting active exploitation of on-premises SharePoint vulnerabilities](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/)
- [Patchpocalypse Now: Microsoft tops last month's record with 622 Patch Tuesday CVEs](https://www.theregister.com/security/2026/07/14/patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves/5271434)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1336