# July 2026 Patch Tuesday: Two Actively Exploited Microsoft Zero-Days (SharePoint EoP CVE-2026-56164, AD FS EoP CVE-2026-56155) Plus SharePoint JWT Auth Bypass CVE-2026-55040

> Microsoft's July 2026 Patch Tuesday addressed a record 622 vulnerabilities (416 Windows). Two SharePoint/AD FS elevation-of-privilege flaws (CVE-2026-56164, CVE-2026-56155) are confirmed actively exploited and listed on CISA's KEV catalog. A third, critical SharePoint JWT authentication bypass (CVE-2026-55040, CVSS 9.1) was coordinated-disclosed by Rapid7 as the first half of an unauthenticated RCE chain whose second component is embargoed for the August 2026 release.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1339
- **ID:** TL-2026-1339
- **Severity:** HIGH (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56164, CVE-2026-56155, CVE-2026-55040, CVE-2026-50663, CVE-2026-50661, CVE-2026-57092

## Description

On 14 July 2026, Microsoft shipped its largest Patch Tuesday on record: 622 CVEs, including 416 Windows-related fixes. Two of the disclosed flaws were already being exploited as zero-days in the wild and were immediately added to CISA's Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-56164, a missing-authentication elevation-of-privilege flaw in Microsoft SharePoint Server (CWE-306), and CVE-2026-56155, an insufficient-access-control-granularity elevation-of-privilege flaw in Active Directory Federation Services (AD FS) (CWE-1220).

CVE-2026-56164 is network-reachable and requires no authentication or user interaction — Microsoft notes an attacker 'does not require significant prior knowledge of the system, and can achieve repeatable success,' and CISA states active exploitation is enabling threat actors to gain unauthorized access to on-premises SharePoint Server instances, establish remote code execution, and conduct post-exploitation activity including theft of IIS machine keys — a technique consistent with prior SharePoint ToolShell-style campaigns where stolen ASP.NET machine keys are used to forge viewstate payloads for persistent, re-authenticatable RCE even after the initial vulnerability is patched.

CVE-2026-56155 affects AD FS, Microsoft's identity federation/SSO infrastructure, and requires local access with low privileges to trigger — consistent with a second-stage privilege-escalation vector used after an attacker has already obtained a foothold, allowing pivoting toward domain administrator control of federated identity trust.

A third vulnerability, CVE-2026-55040 (CWE-1390, Weak Authentication), is a critical SharePoint Server JWT-token-validation bypass with a CVSS v3.1 base score of 9.1 (Microsoft's own scoring lists 5.3). It was discovered and coordinated-disclosed by Stephen Fewer, Senior Principal Security Researcher at Rapid7, built originally for a Rapid7 Labs Pwn2Own Berlin entry. Multiple flaws in SharePoint's JWT validation pipeline let a remote, unauthenticated attacker impersonate any SharePoint site user — including administrators — provided the attacker knows the target's Active Directory Security Identifier (SID) or User Principal Name (UPN) in advance. Rapid7 Labs has privately chained CVE-2026-55040 with a second, still-embargoed remote-code-execution vulnerability to achieve full unauthenticated RCE; that second bug is scheduled for disclosure/patch in Microsoft's August 2026 Patch Tuesday. CVE-2026-55040 itself is not currently listed as exploited in the wild, but public availability of exploitation research for the auth-bypass half creates meaningful risk ahead of the RCE half's disclosure.

The July release also included several other notable items referenced for context and completeness: CVE-2026-57092, a CVSS 9.9 use-after-free elevation-of-privilege flaw in the Windows Hyper-V VMSwitch component enabling guest-to-host VM escape; CVE-2026-50661, a Windows BitLocker security-feature-bypass (CVSS 6.1) believed to correspond to the publicly disclosed 'GreatXML' technique released in June 2026 by the pseudonymous researcher Nightmare Eclipse (aka Chaotic Eclipse), which abuses the WinRE (Windows Recovery Environment) trust boundary and a Defender Offline Scan artifact to plant attacker-controlled recovery-partition XML and obtain a SYSTEM-privileged command prompt with physical access, bypassing full-disk encryption; and CVE-2026-50663, a remote-code-execution flaw in Age of Empires II: Definitive Edition triggered by opening a malicious game scenario file that places files in unexpected filesystem locations.

The report underscores a broader industry trend of 'uncoordinated' disclosure: pseudonymous researchers such as Nightmare Eclipse are publishing zero-day exploit code and technical writeups (including public GitHub-style repositories) ahead of, or without, vendor coordination, compressing defenders' patch windows and increasing the operational tempo threat actors can exploit. All identified CVEs affect widely deployed enterprise infrastructure (SharePoint Server, AD FS, Windows Server, Hyper-V, BitLocker) and should be prioritized per CISA Binding Operational Directive 26-04 guidance, with the two KEV-listed flaws remediated ahead of their federal due dates (2026-07-17 for CVE-2026-56164, 2026-07-28 for CVE-2026-56155).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1211 Exploitation for Stealth
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1505 Server Software Component
- T1505.003 Web Shell
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1210 Exploitation of Remote Services
- T1550 Use Alternate Authentication Material
- T1087 Account Discovery
- T1070 Indicator Removal
- T1611 Escape to Host
- T1006 Direct Volume Access
- T1003 OS Credential Dumping
- T1091 Replication Through Removable Media
- T1543 Create or Modify System Process

## Sources

- [Patch Tuesday - July 2026 (Rapid7)](https://www.rapid7.com/blog/post/em-patch-tuesday-july-2026)
- [CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)](https://www.rapid7.com/blog/post/ve-cve-2026-55040-microsoft-sharepoint-jwt-token-authentication-bypass-fixed/)
- [Microsoft Security Response Center - CVE-2026-56164](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164)
- [Microsoft Security Response Center - CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155)
- [Microsoft Security Response Center - CVE-2026-55040](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [Zero Day Initiative - The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (Tenable)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (Security Boulevard)](https://securityboulevard.com/2026/07/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164/)
- [Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days (SecurityWeek)](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [Microsoft Patch Tuesday for July 2026 - Snort rules and prominent vulnerabilities (Talos)](https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/)
- [Nightmare Eclipse drops claimed BitLocker bypass for Microsoft Windows](https://www.theregister.com/security/2026/06/11/nightmare-eclipse-drops-claimed-bitlocker-bypass-for-microsoft-windows/5254371)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1339