# July 2026 Patch Tuesday: Microsoft Fixes 622 CVEs Including Three Actively-Targeted Zero-Days (CVE-2026-56155 AD FS EoP, CVE-2026-56164 SharePoint EoP, CVE-2026-50661 BitLocker Bypass)

> Microsoft's July 2026 Patch Tuesday addressed a record 622 CVEs (59 Critical), including three zero-days. CVE-2026-56155 (AD FS elevation of privilege) and CVE-2026-56164 (SharePoint Server elevation of privilege) are confirmed under active exploitation and added to the CISA Known Exploited Vulnerabilities catalog with a July 17, 2026 remediation deadline. CVE-2026-50661 (BitLocker security-feature bypass) requires physical device access and is publicly disclosed but not yet observed in active attacks.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1372
- **ID:** TL-2026-1372
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-50661, CVE-2026-56155, CVE-2026-56164

## Description

Microsoft's July 2026 Patch Tuesday release is the largest in the company's 20-year vulnerability-disclosure history, fixing 622 CVEs (roughly triple June 2026's count of 206) including 59 vulnerabilities rated Critical. Three zero-day vulnerabilities were disclosed alongside the fix, two of which were confirmed under active exploitation at time of release and added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services (AD FS) stemming from insufficient granularity of access control (CWE-1220). It requires an attacker to already hold authenticated, low-privileged local access to the AD FS host, from which they can escalate to administrator-level control. Because AD FS signs trusted security tokens used enterprise-wide for single sign-on and federated authentication, compromise of an AD FS host has outsized blast radius: an attacker with administrative control can alter federation trust settings, extract token-signing certificates, disable security controls, forge SAML/WS-Federation tokens for lateral movement into every service that trusts the federation, and use the host as a pivot point for further intrusion — a technique with strong overlap to historical Golden SAML abuse against ADFS infrastructure. Microsoft's DART (Detection and Response Team) identified the vulnerability while investigating live incident-response engagements, indicating it was discovered via observed attacker activity rather than proactive research. Microsoft assigned it Important severity with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-56164 is a missing-authentication-for-critical-function flaw (CWE-306) in Microsoft SharePoint Server (on-premises) that allows an unauthenticated, network-based attacker to elevate privileges without any user interaction. NVD independently scored the flaw 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while Microsoft's own CNA scoring rated it 5.3 Moderate (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) — a significant scoring divergence that understated real-world risk and is cited industry-wide as a case study in why CVSS base scores alone should not drive patch triage when active exploitation is confirmed. The flaw was reported by Mandiant (Jayson Frost) and Google Cloud/FLARE (Genwei Jiang), plus an anonymous researcher, and affects SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Critically, SharePoint Server 2016 and 2019 reached end of extended support on the same day (July 14, 2026) the patch was released, and no paid Extended Security Updates (ESU) program exists for on-prem SharePoint, creating acute remediation pressure for organizations still running those versions. Microsoft's interim mitigation is enabling Antimalware Scan Interface (AMSI) integration with SharePoint's Request Body Scan mode set to Full, pending patch deployment. This disclosure lands amid an active exploitation wave against separate, previously-patched SharePoint flaws (CVE-2026-32201, CVE-2026-45659) referenced in the same CISA guidance, and alongside newly disclosed critical SharePoint RCE pairs CVE-2026-50522/CVE-2026-58644 (untrusted-data deserialization, CVSS 9.8 each, no auth/user interaction required, CVE-2026-50522 publicly demonstrated at Pwn2Own Berlin) and CVE-2026-55040 (a security-feature bypass discovered by Rapid7's Stephen Fewer that chains with a separate embargoed vulnerability to achieve unauthenticated RCE) — collectively making SharePoint the highest-density target surface in this release.

CVE-2026-50661 is a protection-mechanism-failure security-feature bypass in Windows BitLocker Device Encryption. An attacker with physical, hands-on access to a target device can defeat BitLocker's disk-encryption guarantees and access data on the system drive without the encryption key or user credentials, undermining the primary defense against data theft from lost or stolen hardware. Microsoft rates it CVSS 6.1 (Medium) and its own exploitability index as 'Less Likely,' and as of release it was publicly disclosed but not observed in active attacks; however, researchers have already published proof-of-concept material, and it continues a recurring pattern of BitLocker bypass disclosures (e.g., the CVE-2026-45585 'YellowKey' bypass earlier in 2026). Patches were shipped across the full supported Windows client/server matrix via cumulative updates: KB5099535 (Windows 10 1607 / Server 2016), KB5099538 (Windows 10 1809 / Server 2019), KB5099539 (Windows 10 21H2/22H2), KB5099540 (Server 2022), and KB5101649/KB5101650 (recent Windows 11 releases / Server 2025).

The broader July 2026 release also included the highest-severity flaw of the batch, CVE-2026-57092, a Windows VMSwitch elevation-of-privilege use-after-free (CVSS 9.9) allowing a low-privileged attacker to cross VM boundaries and fully compromise the hypervisor host, plus a Windows DHCP Server heap-overflow RCE (CVE-2026-50518, CVSS 9.8, unauthenticated/network-reachable), Microsoft Copilot RCE (CVE-2026-48561), two Microsoft Defender RCEs (CVE-2026-55011, CVE-2026-55012), a DirectX Graphics Kernel RCE (CVE-2026-50382), and further DHCP client/server RCE variants (CVE-2026-54128, CVE-2026-50370). Security researchers characterized the record CVE volume as consistent with accelerating AI-assisted vulnerability discovery pipelines feeding Microsoft's internal triage process.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1606 Forge Web Credentials
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1069 Permission Groups Discovery
- T1550 Use Alternate Authentication Material
- T1210 Exploitation of Remote Services
- T1484 Domain or Tenant Policy Modification
- T1505 Server Software Component
- T1486 Data Encrypted for Impact
- T1491 Defacement
- T1005 Data from Local System
- T1203 Exploitation for Client Execution
- T1595 Active Scanning
- T1587 Develop Capabilities

## Sources

- [July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days](https://www.malwarebytes.com/blog/bugs/2026/07/july-2026-patch-tuesday-fixes-622-microsoft-cves-including-three-zero-days)
- [The July 2026 Security Update Review](https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack](https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html)
- [Microsoft July 2026 Patch Tuesday fixes massive flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [AI-driven bug hunting fuels record Microsoft Patch Tuesday](https://www.helpnetsecurity.com/2026/07/15/microsoft-patch-tuesday-sharepoint-cve-2026-56164/)
- [CVE-2026-56164 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-56164)
- [Known Exploited Vulnerabilities Catalog - CISA (CVE-2026-56164)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56164)
- [Microsoft Active Directory Services 0-Day Vulnerability Actively Exploited in the Wild](https://cybersecuritynews.com/active-directory-services-0-day-exploited/)
- [CVE-2026-56155 - Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2026-56155)
- [Windows BitLocker 0-Day Vulnerability Allows Hackers to Bypass Security Feature](https://cybersecuritynews.com/windows-bitlocker-0-day-vulnerability-2/)
- [CVE-2026-50661: Protection mechanism failure in Windows BitLocker — Severity, CVSS & Fix](https://www.strix.ai/cve/CVE-2026-50661)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://securityboulevard.com/2026/07/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164/)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (Tenable)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [CVE-2026-56164 - Vulnerability-Lookup](https://vulnerability.circl.lu/vuln/CVE-2026-56164)
- [Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1372