July 2026 Patch Tuesday: Microsoft Fixes 622 CVEs Including Three Actively-Targeted Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP, CVE-2026-50661 BitLocker Bypass)

July 2026 Patch Tuesday (TL-2026-1372), also tracked as July 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-15. It has no confirmed attribution, affects Microsoft Active Directory Federation Services (AD FS), references 3 CVEs (CVE-2026-50661, CVE-2026-56155, CVE-2026-56164), maps to 20 MITRE ATT&CK techniques (T1005, T1068, T1069), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-1372

Threat ID
TL-2026-1372
Also known as
July 2026 Patch Tuesday
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, manufacturing, critical-infrastructure, professional-services
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in July 2026 Patch Tuesday

Malware and tooling: Antimalware Scan Interface (AMSI)

Microsoft's July 2026 Patch Tuesday addressed a record 622 CVEs (59 Critical), including three zero-days. CVE-2026-56155 (AD FS elevation of privilege) and CVE-2026-56164 (SharePoint Server elevation of privilege) are confirmed under active exploitation and added to the CISA Known Exploited Vulnerabilities catalog with a July 17, 2026 remediation deadline. CVE-2026-50661 (BitLocker security-feature bypass) requires physical device access and is publicly disclosed but not yet observed in active attacks.

How July 2026 Patch Tuesday works

Microsoft's July 2026 Patch Tuesday release is the largest in the company's 20-year vulnerability-disclosure history, fixing 622 CVEs (roughly triple June 2026's count of 206) including 59 vulnerabilities rated Critical. Three zero-day vulnerabilities were disclosed alongside the fix, two of which were confirmed under active exploitation at time of release and added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services (AD FS) stemming from insufficient granularity of access control (CWE-1220). It requires an attacker to already hold authenticated, low-privileged local access to the AD FS host, from which they can escalate to administrator-level control. Because AD FS signs trusted security tokens used enterprise-wide for single sign-on and federated authentication, compromise of an AD FS host has outsized blast radius: an attacker with administrative control can alter federation trust settings, extract token-signing certificates, disable security controls, forge SAML/WS-Federation tokens for lateral movement into every service that trusts the federation, and use the host as a pivot point for further intrusion — a technique with strong overlap to historical Golden SAML abuse against ADFS infrastructure. Microsoft's DART (Detection and Response Team) identified the vulnerability while investigating live incident-response engagements, indicating it was discovered via observed attacker activity rather than proactive research. Microsoft assigned it Important severity with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-56164 is a missing-authentication-for-critical-function flaw (CWE-306) in Microsoft SharePoint Server (on-premises) that allows an unauthenticated, network-based attacker to elevate privileges without any user interaction. NVD independently scored the flaw 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while Microsoft's own CNA scoring rated it 5.3 Moderate (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) — a significant scoring divergence that understated real-world risk and is cited industry-wide as a case study in why CVSS base scores alone should not drive patch triage when active exploitation is confirmed. The flaw was reported by Mandiant (Jayson Frost) and Google Cloud/FLARE (Genwei Jiang), plus an anonymous researcher, and affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Critically, SharePoint Server 2016 and 2019 reached end of extended support on the same day (July 14, 2026) the patch was released, and no paid Extended Security Updates (ESU) program exists for on-prem SharePoint, creating acute remediation pressure for organizations still running those versions. Microsoft's interim mitigation is enabling Antimalware Scan Interface (AMSI) integration with SharePoint's Request Body Scan mode set to Full, pending patch deployment. This disclosure lands amid an active exploitation wave against separate, previously-patched SharePoint flaws (CVE-2026-32201, CVE-2026-45659) referenced in the same CISA guidance, and alongside newly disclosed critical SharePoint RCE pairs CVE-2026-50522/CVE-2026-58644 (untrusted-data deserialization, CVSS 9.8 each, no auth/user interaction required, CVE-2026-50522 publicly demonstrated at Pwn2Own Berlin) and CVE-2026-55040 (a security-feature bypass discovered by Rapid7's Stephen Fewer that chains with a separate embargoed vulnerability to achieve unauthenticated RCE) — collectively making SharePoint the highest-density target surface in this release.

CVE-2026-50661 is a protection-mechanism-failure security-feature bypass in Windows BitLocker Device Encryption. An attacker with physical, hands-on access to a target device can defeat BitLocker's disk-encryption guarantees and access data on the system drive without the encryption key or user credentials, undermining the primary defense against data theft from lost or stolen hardware. Microsoft rates it CVSS 6.1 (Medium) and its own exploitability index as 'Less Likely,' and as of release it was publicly disclosed but not observed in active attacks; however, researchers have already published proof-of-concept material, and it continues a recurring pattern of BitLocker bypass disclosures (e.g., the CVE-2026-45585 'YellowKey' bypass earlier in 2026). Patches were shipped across the full supported Windows client/server matrix via cumulative updates: KB5099535 (Windows 10 1607 / Server 2016), KB5099538 (Windows 10 1809 / Server 2019), KB5099539 (Windows 10 21H2/22H2), KB5099540 (Server 2022), and KB5101649/KB5101650 (recent Windows 11 releases / Server 2025).

The broader July 2026 release also included the highest-severity flaw of the batch, CVE-2026-57092, a Windows VMSwitch elevation-of-privilege use-after-free (CVSS 9.9) allowing a low-privileged attacker to cross VM boundaries and fully compromise the hypervisor host, plus a Windows DHCP Server heap-overflow RCE (CVE-2026-50518, CVSS 9.8, unauthenticated/network-reachable), Microsoft Copilot RCE (CVE-2026-48561), two Microsoft Defender RCEs (CVE-2026-55011, CVE-2026-55012), a DirectX Graphics Kernel RCE (CVE-2026-50382), and further DHCP client/server RCE variants (CVE-2026-54128, CVE-2026-50370). Security researchers characterized the record CVE volume as consistent with accelerating AI-assisted vulnerability discovery pipelines feeding Microsoft's internal triage process.

MITRE ATT&CK techniques used in TL-2026-1372

Collection

T1005 Data from Local System

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1611 Escape to Host

Discovery

T1069 Permission Groups Discovery

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Lateral Movement

T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material

Defense Evasion

T1211 Exploitation for Stealth

defense-impairment

T1484 Domain or Tenant Policy Modification; T1685 Disable or Modify Tools

Impact

T1486 Data Encrypted for Impact; T1491 Defacement

Persistence

T1505 Server Software Component

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1606 Forge Web Credentials

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in July 2026 Patch Tuesday

  • Microsoft — Active Directory Federation Services (AD FS)
    Vulnerable versions: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025; Server Core installations of the above
    Fixed in: July 14, 2026 cumulative security updates for the listed Windows Server releases
  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2016 (Enterprise) before 16.0.5561.1001; SharePoint Server 2019 before 16.0.10417.20175; SharePoint Server Subscription Edition before 16.0.19725.20434
    Fixed in: 16.0.5561.1001 (SharePoint 2016); 16.0.10417.20175 (SharePoint 2019); 16.0.19725.20434 (Subscription Edition)
  • Microsoft — Windows BitLocker Device Encryption
    Vulnerable versions: Windows 10 Version 1607; Windows 10 Version 1809; Windows 10 Version 21H2/22H2; Windows 11 (recent releases); Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025
    Fixed in: KB5099535; KB5099538; KB5099539; KB5099540; KB5101649; KB5101650

Remediation for July 2026 Patch Tuesday

Patches

  • KB5099535 — Windows 10 Version 1607 / Windows Server 2016
  • KB5099538 — Windows 10 Version 1809 / Windows Server 2019
  • KB5099539 — Windows 10 Version 21H2/22H2
  • KB5099540 — Windows Server 2022
  • KB5101649 / KB5101650 — Windows 11 (recent releases) / Windows Server 2025
  • SharePoint Server 2016 security update to version 16.0.5561.1001 or later
  • SharePoint Server 2019 security update to version 16.0.10417.20175 or later
  • SharePoint Server Subscription Edition security update to version 16.0.19725.20434 or later

Immediate actions

  • Apply the July 2026 cumulative security updates to all Windows Server, Windows client, AD FS, and SharePoint Server systems without delay, prioritizing internet-facing SharePoint Server 2016/2019/Subscription Edition and AD FS hosts
  • Meet the CISA KEV-mandated remediation deadline of 2026-07-17 for CVE-2026-56155 and CVE-2026-56164 on federal and federally-associated systems
  • On SharePoint Server, enable Antimalware Scan Interface (AMSI) integration and set Request Body Scan mode to Full as an interim compensating control ahead of/alongside patching
  • Audit AD FS servers for signs of unauthorized administrative changes, unexpected token-signing certificate rotation, or anomalous federation trust modifications
  • Review SharePoint Server 2016/2019 deployments for migration off end-of-extended-support versions, since no paid Extended Security Updates (ESU) program exists for on-prem SharePoint
  • Enforce full-disk encryption compensating controls (e.g., pre-boot authentication PIN, TPM+PIN) on high-risk mobile/laptop fleets pending the BitLocker patch, given public PoC availability for CVE-2026-50661

Workarounds

  • SharePoint: enable AMSI integration with Request Body Scan mode set to Full
  • BitLocker: enforce pre-boot PIN/TPM+PIN authentication and restrict physical device access for high-risk assets pending patch

Longer-term hardening

  • Deploy EDR/XDR with behavioral detection tuned for AD FS token-signing certificate access and SharePoint web-shell/deserialization post-exploitation activity
  • Segment and harden identity infrastructure (AD FS, ADFS proxy/WAP servers) away from general-purpose administrative access
  • Establish a compensating-control workflow for out-of-support on-prem SharePoint and other identity/collaboration platforms lacking ESU coverage
  • Build a CVSS-independent patch-triage process that weights confirmed active exploitation and CISA KEV membership over raw base score, given the CVE-2026-56164 scoring divergence between NVD (9.8) and Microsoft (5.3)

CVEs associated with July 2026 Patch Tuesday

CVE-2026-50661, CVE-2026-56155, CVE-2026-56164

Weaknesses (CWE) in July 2026 Patch Tuesday

CWE-1220, CWE-306, CWE-693

Timeline of July 2026 Patch Tuesday

  • Microsoft's June 2026 Patch Tuesday addresses 206 CVEs, setting the baseline against which July's 622-CVE release is roughly triple in volume.
  • CVE-2026-50522, a related SharePoint RCE patched in the same release, is noted as having been publicly demonstrated at Pwn2Own Berlin.
  • SharePoint Server 2016 and SharePoint Server 2019 reach end of extended support on the same day the CVE-2026-56164 patch is released, with no paid Extended Security Updates program available for on-prem SharePoint.
  • Microsoft ships its July 2026 Patch Tuesday release: 622 CVEs total, 59 rated Critical, including three zero-days (CVE-2026-56155, CVE-2026-56164, CVE-2026-50661) and cumulative updates KB5099535/KB5099538/KB5099539/KB5099540/KB5101649/KB5101650.
  • Microsoft DART (Detection and Response Team) identifies CVE-2026-56155 in AD FS while investigating active incident-response engagements, indicating the flaw was found via real-world attacker activity.
  • Security media (Malwarebytes, BleepingComputer, The Hacker News, Help Net Security, Forbes, Zero Day Initiative) publish analysis of the record-setting release and the two actively-exploited zero-days.
  • CISA issues hardening recommendations for SharePoint Server, noting concurrent active exploitation of separate, previously-patched SharePoint flaws (CVE-2026-32201 and CVE-2026-45659).
  • CISA adds CVE-2026-56155 and CVE-2026-56164 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation and setting a remediation due date of 2026-07-17.
  • CISA-mandated remediation deadline for CVE-2026-56155 and CVE-2026-56164 on federal and federally-associated systems per Binding Operational Directive 22-01.

Sources cited for July 2026 Patch Tuesday

Threats related to July 2026 Patch Tuesday

Detection coverage for TL-2026-1372

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1372 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats