# Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days in AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164), Plus Unpatched BitLocker Bypass (CVE-2026-50661)

> Microsoft's July 2026 Patch Tuesday shipped a record 622 CVEs (57-62 Critical), including two zero-days with confirmed in-the-wild exploitation: an AD FS elevation-of-privilege flaw (CVE-2026-56155) letting an already-authenticated low-privileged local attacker reach administrative control of identity infrastructure, and a SharePoint elevation-of-privilege flaw (CVE-2026-56164) letting an unauthenticated remote attacker escalate privileges with no user interaction. A publicly disclosed but patched physical-access BitLocker bypass (CVE-2026-50661) and an unpatched, not-yet-CVE-assigned Windows User Profile Service hive-loading flaw ('LegacyHive', released by researcher MSNightmare/Nightmare-Eclipse) round out the release.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1350
- **ID:** TL-2026-1350
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-57092, CVE-2026-50522, CVE-2026-58644, CVE-2026-56190, CVE-2026-50518, CVE-2026-55040

## Description

On July 14, 2026, Microsoft released its largest Patch Tuesday to date: 622 unique CVEs (some trackers report 569-570 due to differing de-duplication), including 57-62 rated Critical, 48 critical Remote Code Execution flaws, 7 critical Elevation of Privilege issues, 1 critical spoofing vulnerability, and 1 critical security-feature-bypass. Windows accounted for 416 CVEs, Office for 82, and Microsoft Edge for 46 (21 Microsoft-original, the rest inherited Chromium). Microsoft attributes the record volume in part to AI-assisted vulnerability discovery via its internal MDASH scanning system.

Two vulnerabilities carry confirmed active exploitation. CVE-2026-56155 is an insufficient-access-control-granularity flaw (CWE-1220) in Active Directory Federation Services (AD FS) discovered by Microsoft's own Detection and Response Team (DART) — credited to Jeremy Kingston and Scott Clark — while responding to real-world incidents, strongly suggesting it was already being abused in live intrusions before disclosure. It requires local access and low privileges (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) but grants full administrative elevation once triggered; because AD FS tokens establish trust across hybrid Azure AD/on-premises environments, exploitation enables attackers to forge or manipulate federated authentication trust in a manner reminiscent of Golden SAML attack patterns, giving durable enterprise-wide identity compromise.

CVE-2026-56164 is a missing-authentication-for-critical-function flaw (CWE-306) in on-premises Microsoft SharePoint Server (2016, 2019, and Subscription Edition), discovered by Mandiant incident responders and Google's FLARE team. It is remotely exploitable over the network by a fully unauthenticated attacker with no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 5.3 — rated only Moderate despite trivial reachability). Microsoft and third-party analysts (Talos, ZDI) stress the CVSS score understates real-world risk: 'when something this reachable is being actively abused, patch it now and worry about the score later.' The disclosure lands the same day SharePoint Server 2016 and 2019 reach end of extended support, complicating remediation for organizations that have not migrated. Pre-patch mitigation is enabling AMSI (Anti-Malware Scan Interface) integration on SharePoint/IIS worker processes with Request Body Scan mode set to Full so malicious POST payloads are detected before code execution.

A third vulnerability, CVE-2026-50661, is a protection-mechanism-failure flaw (CWE-693) in Windows BitLocker Device Encryption allowing an unauthenticated attacker with physical access to bypass full-disk encryption and read data directly off the storage device (CVSS 3.1 AV:P/AC:L/PR:N/UI:N, base 6.1). It was publicly disclosed with proof-of-concept code prior to patch release but has no confirmed in-the-wild exploitation; it continues a pattern of BitLocker physical-access bypasses disclosed through 2026 (e.g., the earlier 'YellowKey' CVE-2026-45585) and researchers note a possible but unconfirmed link to the 'GreatXML' bypass technique attributed to the Nightmare-Eclipse persona. It received an official Microsoft patch in this release, distinguishing it from YellowKey which initially shipped with mitigation-only guidance.

Separately, roughly 30 minutes after Microsoft's official Patch Tuesday disclosures, researcher MSNightmare (associated with the Nightmare-Eclipse persona, whose prior releases have been confirmed exploited in the wild) published proof-of-concept code for an unpatched, not-yet-CVE-assigned flaw in the Windows User Profile Service (profsvc), publicly nicknamed 'LegacyHive.' The bug allows a standard user to abuse the service's hive-loading mechanism to mount arbitrary registry hives with elevated privileges, enabling registry-based persistence, credential theft, and security-product tampering. The public PoC as released requires secondary user-account credentials, though the author claims an unrestricted variant exists. No patch is available as of this writing.

Other critical vulnerabilities in the same release with high blast-radius potential include: CVE-2026-57092 (Windows VMSwitch Elevation of Privilege, CVSS 9.9, a use-after-free enabling a low-privileged guest to escalate to host/hypervisor compromise across VM boundaries); CVE-2026-50522 and CVE-2026-58644 (SharePoint Remote Code Execution, CVSS 9.8 each, deserialization flaws demonstrated at Pwn2Own Berlin, network-reachable without authentication); CVE-2026-56190 (Windows RDP Remote Code Execution, CVSS 9.8, exploiting uninitialized resources, unauthenticated and network-reachable); CVE-2026-50518 (Windows DHCP Server Remote Code Execution, CVSS 9.8, heap-based buffer overflow, unauthenticated and network-reachable); and CVE-2026-55040 (SharePoint JWT Authentication Bypass, disputed severity — Rapid7 rates it 5.3 while ZDI treats it as Critical 9.1 — discovered by Rapid7 Labs at Pwn2Own Berlin and chainable with a separate, still-unpatched remote code execution bug to reach unauthenticated RCE; the companion RCE is scheduled for the August 2026 release).

CISA added both actively-exploited zero-days to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14, giving CVE-2026-56164 (SharePoint) an accelerated remediation due date of 2026-07-17 given its unauthenticated network reachability, and CVE-2026-56155 (AD FS) a due date of 2026-07-28, both under BOD 26-04 risk-based prioritization guidance. Talos released Snort 2 rules (SIDs 1:66733-1:66743, 1:66745-1:66785, 1:66791-1:66793, 1:66800-1:66807) and Snort 3 rules (SIDs 1:301555-1:301579, 1:301581-1:301583) covering disclosed vulnerabilities in this release.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1134 Access Token Manipulation
- T1606 Forge Web Credentials
- T1649 Steal or Forge Authentication Certificates
- T1556 Modify Authentication Process
- T1003 OS Credential Dumping
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1547 Boot or Logon Autostart Execution
- T1112 Modify Registry
- T1078 Valid Accounts
- T1087 Account Discovery
- T1082 System Information Discovery
- T1550 Use Alternate Authentication Material
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1486 Data Encrypted for Impact
- T1587 Develop Capabilities

## Sources

- [July 2026 Patch Tuesday Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-july-2026/)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/)
- [Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [CVE-2026-56155 - Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2026-56155)
- [CVE-2026-56164 - Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2026-56164)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Microsoft's Record 570-Patch Tuesday Closes Active AD FS, SharePoint Zero-Days — Here's What to Do](https://windowsnews.ai/article/microsofts-record-570-patch-tuesday-closes-active-ad-fs-sharepoint-zero-days-heres-what-to-do.438209)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [Windows Bitlocker Zero-Day Vulnerability (YellowKey) & GreenPlasma Privilege Escalation POC Public Release](https://success.trendmicro.com/en-US/solution/KA-0023413)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1350