Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164), Plus Unpatched BitLocker Bypass (CVE-2026-50661)

Microsoft July 2026 Patch Tuesday (TL-2026-1350), also tracked as July 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-07-15. It has no confirmed attribution, affects Microsoft Active Directory Federation Services (AD FS), references 9 CVEs (CVE-2026-56155, CVE-2026-56164, CVE-2026-50661), maps to 20 MITRE ATT&CK techniques (T1003, T1005, T1068), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-1350

Threat ID
TL-2026-1350
Also known as
July 2026 Patch Tuesday, LegacyHive
Severity
CRITICAL
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, manufacturing, education, criticalinfrastructure
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in Microsoft July 2026 Patch Tuesday

Malware and tooling: AMSI Full Request Body Scan

Microsoft's July 2026 Patch Tuesday shipped a record 622 CVEs (57-62 Critical), including two zero-days with confirmed in-the-wild exploitation: an AD FS elevation-of-privilege flaw (CVE-2026-56155) letting an already-authenticated low-privileged local attacker reach administrative control of identity infrastructure, and a SharePoint elevation-of-privilege flaw (CVE-2026-56164) letting an unauthenticated remote attacker escalate privileges with no user interaction. A publicly disclosed but patched physical-access BitLocker bypass (CVE-2026-50661) and an unpatched, not-yet-CVE-assigned Windows User Profile Service hive-loading flaw ('LegacyHive', released by researcher MSNightmare/Nightmare-Eclipse) round out the release.

How Microsoft July 2026 Patch Tuesday works

On July 14, 2026, Microsoft released its largest Patch Tuesday to date: 622 unique CVEs (some trackers report 569-570 due to differing de-duplication), including 57-62 rated Critical, 48 critical Remote Code Execution flaws, 7 critical Elevation of Privilege issues, 1 critical spoofing vulnerability, and 1 critical security-feature-bypass. Windows accounted for 416 CVEs, Office for 82, and Microsoft Edge for 46 (21 Microsoft-original, the rest inherited Chromium). Microsoft attributes the record volume in part to AI-assisted vulnerability discovery via its internal MDASH scanning system.

Two vulnerabilities carry confirmed active exploitation. CVE-2026-56155 is an insufficient-access-control-granularity flaw (CWE-1220) in Active Directory Federation Services (AD FS) discovered by Microsoft's own Detection and Response Team (DART) — credited to Jeremy Kingston and Scott Clark — while responding to real-world incidents, strongly suggesting it was already being abused in live intrusions before disclosure. It requires local access and low privileges (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) but grants full administrative elevation once triggered; because AD FS tokens establish trust across hybrid Azure AD/on-premises environments, exploitation enables attackers to forge or manipulate federated authentication trust in a manner reminiscent of Golden SAML attack patterns, giving durable enterprise-wide identity compromise.

CVE-2026-56164 is a missing-authentication-for-critical-function flaw (CWE-306) in on-premises Microsoft SharePoint Server (2016, 2019, and Subscription Edition), discovered by Mandiant incident responders and Google's FLARE team. It is remotely exploitable over the network by a fully unauthenticated attacker with no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 5.3 — rated only Moderate despite trivial reachability). Microsoft and third-party analysts (Talos, ZDI) stress the CVSS score understates real-world risk: 'when something this reachable is being actively abused, patch it now and worry about the score later.' The disclosure lands the same day SharePoint Server 2016 and 2019 reach end of extended support, complicating remediation for organizations that have not migrated. Pre-patch mitigation is enabling AMSI (Anti-Malware Scan Interface) integration on SharePoint/IIS worker processes with Request Body Scan mode set to Full so malicious POST payloads are detected before code execution.

A third vulnerability, CVE-2026-50661, is a protection-mechanism-failure flaw (CWE-693) in Windows BitLocker Device Encryption allowing an unauthenticated attacker with physical access to bypass full-disk encryption and read data directly off the storage device (CVSS 3.1 AV:P/AC:L/PR:N/UI:N, base 6.1). It was publicly disclosed with proof-of-concept code prior to patch release but has no confirmed in-the-wild exploitation; it continues a pattern of BitLocker physical-access bypasses disclosed through 2026 (e.g., the earlier 'YellowKey' CVE-2026-45585) and researchers note a possible but unconfirmed link to the 'GreatXML' bypass technique attributed to the Nightmare-Eclipse persona. It received an official Microsoft patch in this release, distinguishing it from YellowKey which initially shipped with mitigation-only guidance.

Separately, roughly 30 minutes after Microsoft's official Patch Tuesday disclosures, researcher MSNightmare (associated with the Nightmare-Eclipse persona, whose prior releases have been confirmed exploited in the wild) published proof-of-concept code for an unpatched, not-yet-CVE-assigned flaw in the Windows User Profile Service (profsvc), publicly nicknamed 'LegacyHive.' The bug allows a standard user to abuse the service's hive-loading mechanism to mount arbitrary registry hives with elevated privileges, enabling registry-based persistence, credential theft, and security-product tampering. The public PoC as released requires secondary user-account credentials, though the author claims an unrestricted variant exists. No patch is available as of this writing.

Other critical vulnerabilities in the same release with high blast-radius potential include: CVE-2026-57092 (Windows VMSwitch Elevation of Privilege, CVSS 9.9, a use-after-free enabling a low-privileged guest to escalate to host/hypervisor compromise across VM boundaries); CVE-2026-50522 and CVE-2026-58644 (SharePoint Remote Code Execution, CVSS 9.8 each, deserialization flaws demonstrated at Pwn2Own Berlin, network-reachable without authentication); CVE-2026-56190 (Windows RDP Remote Code Execution, CVSS 9.8, exploiting uninitialized resources, unauthenticated and network-reachable); CVE-2026-50518 (Windows DHCP Server Remote Code Execution, CVSS 9.8, heap-based buffer overflow, unauthenticated and network-reachable); and CVE-2026-55040 (SharePoint JWT Authentication Bypass, disputed severity — Rapid7 rates it 5.3 while ZDI treats it as Critical 9.1 — discovered by Rapid7 Labs at Pwn2Own Berlin and chainable with a separate, still-unpatched remote code execution bug to reach unauthenticated RCE; the companion RCE is scheduled for the August 2026 release).

CISA added both actively-exploited zero-days to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14, giving CVE-2026-56164 (SharePoint) an accelerated remediation due date of 2026-07-17 given its unauthenticated network reachability, and CVE-2026-56155 (AD FS) a due date of 2026-07-28, both under BOD 26-04 risk-based prioritization guidance. Talos released Snort 2 rules (SIDs 1:66733-1:66743, 1:66745-1:66785, 1:66791-1:66793, 1:66800-1:66807) and Snort 3 rules (SIDs 1:301555-1:301579, 1:301581-1:301583) covering disclosed vulnerabilities in this release.

MITRE ATT&CK techniques used in TL-2026-1350

Credential Access

T1003 OS Credential Dumping; T1556 Modify Authentication Process; T1649 Steal or Forge Authentication Certificates

Collection

T1005 Data from Local System

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1548 Abuse Elevation Control Mechanism

Persistence

T1078 Valid Accounts; T1112 Modify Registry; T1547 Boot or Logon Autostart Execution

Discovery

T1082 System Information Discovery; T1087 Account Discovery

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1486 Data Encrypted for Impact

Resource Development

T1587 Develop Capabilities

credential-access

T1606 Forge Web Credentials

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Microsoft July 2026 Patch Tuesday

  • Microsoft — Active Directory Federation Services (AD FS)
    Vulnerable versions: AD FS on Windows Server, all currently supported releases prior to July 2026 CU
    Fixed in: July 2026 Cumulative Update
  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2016; SharePoint Server 2019; SharePoint Enterprise Server 2016; SharePoint Server Subscription Edition (pre-July 2026 CU)
    Fixed in: July 2026 Cumulative Update
  • Microsoft — Windows BitLocker Device Encryption
    Vulnerable versions: All currently supported Windows client and server versions, pre-July 2026 CU
    Fixed in: July 2026 Cumulative Update
  • Microsoft — Windows User Profile Service (profsvc)
    Vulnerable versions: All currently supported Windows desktop and server versions
    Fixed in: No patch available at time of writing
  • Microsoft — Windows Hyper-V VMSwitch
    Vulnerable versions: Pre-July 2026 CU builds affected by CVE-2026-57092
    Fixed in: July 2026 Cumulative Update
  • Microsoft — Windows Remote Desktop Protocol (RDP)
    Vulnerable versions: Pre-July 2026 CU builds affected by CVE-2026-56190
    Fixed in: July 2026 Cumulative Update
  • Microsoft — Windows DHCP Server
    Vulnerable versions: Pre-July 2026 CU builds affected by CVE-2026-50518
    Fixed in: July 2026 Cumulative Update

Remediation for Microsoft July 2026 Patch Tuesday

Patches

  • Microsoft July 2026 Cumulative Update (KB references per product, released 2026-07-14) — patches CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-57092, CVE-2026-50522, CVE-2026-58644, CVE-2026-56190, CVE-2026-50518
  • No patch available yet for the unpatched 'LegacyHive' Windows User Profile Service flaw or the companion SharePoint RCE chainable with CVE-2026-55040 (expected August 2026 release)

Immediate actions

  • Prioritize and deploy the July 2026 cumulative update patching CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint) on all affected servers
  • For SharePoint Server 2016/2019/Subscription Edition, treat CVE-2026-56164 as top priority regardless of its Moderate CVSS label given unauthenticated network reachability
  • Enable AMSI integration on SharePoint and IIS worker processes with Request Body Scan mode set to Full to detect malicious POST payloads pending patch deployment
  • Meet CISA KEV due dates: 2026-07-17 for CVE-2026-56164, 2026-07-28 for CVE-2026-56155, per BOD 26-04
  • Audit AD FS servers and federated authentication logs for signs of privilege escalation or anomalous token issuance consistent with Golden SAML-style attacks
  • Deploy the BitLocker CVE-2026-50661 patch on all endpoints with physical-access exposure risk (laptops, kiosks, field devices)
  • Monitor for public release of a CVE for the unpatched 'LegacyHive' Windows User Profile Service (profsvc) hive-loading privilege escalation and apply Microsoft mitigation guidance when issued

Workarounds

  • AMSI Full Request Body Scan mode on SharePoint/IIS as an interim mitigation for CVE-2026-56164 pending patch deployment
  • Restrict local logon rights on AD FS servers to reduce the population of low-privileged accounts that could exploit CVE-2026-56155
  • Require pre-boot authentication and disable Standby/Sleep-to-RAM where BitLocker devices face elevated physical-access risk, pending CVE-2026-50661 patch rollout

Longer-term hardening

  • Migrate off SharePoint Server 2016/2019 given they reached end of extended support on the same day this zero-day was disclosed
  • Deploy EDR/XDR with behavioral detection for local privilege-escalation techniques against identity infrastructure (AD FS, ADCS, domain controllers)
  • Implement network segmentation isolating SharePoint and AD FS servers from general user network segments
  • Establish an accelerated patch-validation and rollout process for identity-infrastructure CVEs given repeated AD FS/SharePoint zero-day exploitation patterns in 2026
  • Enforce full-disk encryption pre-boot authentication (PIN/TPM+PIN) to reduce BitLocker physical-access bypass exposure

CVEs associated with Microsoft July 2026 Patch Tuesday

CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-57092, CVE-2026-50522, CVE-2026-58644, CVE-2026-56190, CVE-2026-50518, CVE-2026-55040

Weaknesses (CWE) in Microsoft July 2026 Patch Tuesday

CWE-1220, CWE-306, CWE-693, CWE-416, CWE-502, CWE-190, CWE-122

Timeline of Microsoft July 2026 Patch Tuesday

  • Windows BitLocker 'YellowKey' bypass (CVE-2026-45585) publicly disclosed with PoC, setting the pattern later followed by CVE-2026-50661
  • Cisco Talos publishes Snort 2 and Snort 3 detection rule coverage for vulnerabilities disclosed in the July 2026 release
  • Approximately 30 minutes after Microsoft's official disclosures, researcher MSNightmare (Nightmare-Eclipse persona) publishes a PoC for an unpatched Windows User Profile Service hive-loading privilege-escalation flaw, publicly dubbed 'LegacyHive', with no CVE assigned
  • CVE-2026-50661, a publicly disclosed physical-access BitLocker bypass, receives an official Microsoft patch in the same release
  • CISA adds CVE-2026-56155 and CVE-2026-56164 to the Known Exploited Vulnerabilities catalog under BOD 26-04, with due dates 2026-07-28 and 2026-07-17 respectively
  • CVE-2026-56164 disclosed as actively exploited; discovered by Mandiant incident responders and Google's FLARE team; coincides with SharePoint Server 2016/2019 reaching end of extended support
  • CVE-2026-56155 disclosed as actively exploited; discovered by Microsoft DART (Jeremy Kingston, Scott Clark) while responding to real-world intrusions
  • Microsoft releases July 2026 Patch Tuesday: 622 CVEs total, 57-62 rated Critical, including confirmed active exploitation of CVE-2026-56155 (AD FS) and CVE-2026-56164 (SharePoint)
  • CISA KEV remediation due date for CVE-2026-56164 (SharePoint) under BOD 26-04
  • CISA KEV remediation due date for CVE-2026-56155 (AD FS) under BOD 26-04

Sources cited for Microsoft July 2026 Patch Tuesday

Threats related to Microsoft July 2026 Patch Tuesday

Detection coverage for TL-2026-1350

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1350 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats