Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS, CVE-2026-56164 SharePoint) Among Record 570+ Fixes

Microsoft July 2026 Patch Tuesday (TL-2026-1430), also tracked as July 2026 Patch Tuesday Zero-Days, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-17. It has no confirmed attribution, affects Microsoft Active Directory Federation Services (AD FS), references 2 CVEs (CVE-2026-56155, CVE-2026-56164), maps to 21 MITRE ATT&CK techniques (T1005, T1021, T1068), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-1430

Threat ID
TL-2026-1430
Also known as
July 2026 Patch Tuesday Zero-Days, AD FS DKM ACL Privilege Escalation
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-17
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, enterpriseit, identityinfrastructure, finance, health, technology
Target regions
Global
Detection rules
9
Indicators of compromise
19

Malware and tooling in Microsoft July 2026 Patch Tuesday

Malware and tooling: Antimalware Scan Interface (AMSI) with Request Body Scan Full mode

Microsoft's July 2026 Patch Tuesday (a record 569-622 CVEs depending on counting methodology) shipped fixes for two zero-days confirmed exploited in the wild: CVE-2026-56155, an Active Directory Federation Services elevation-of-privilege flaw rooted in insufficient DKM-container ACL granularity that grants attackers administrator privileges from a low-privileged local foothold, and CVE-2026-56164, an unauthenticated network-exploitable SharePoint Server elevation-of-privilege flaw caused by a missing authentication check on the client.svc endpoint. Both were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14 with mandated federal remediation deadlines.

How Microsoft July 2026 Patch Tuesday works

On 2026-07-14 Microsoft released its July 2026 Patch Tuesday update, the largest on record, addressing between 569 and 622 vulnerabilities depending on the outlet's counting methodology (Tenable reported 569, Malwarebytes and BleepingComputer reported 622/570+) across Windows, Office, SQL Server, Exchange, Azure, Edge, and VS Code. Microsoft attributed the record volume in part to an internal AI-powered vulnerability discovery system now surfacing flaws proactively across the Windows codebase. Three zero-days were disclosed in the release, two of which were confirmed exploited in the wild.

CVE-2026-56155 affects Active Directory Federation Services (AD FS) and is classified under CWE-1220 (Insufficient Granularity of Access Control). The root cause is insufficiently granular permissions on the AD FS Distributed Key Manager (DKM) Active Directory container, which stores the symmetric key material used to protect AD FS token-signing and token-decryption certificate private keys. An authenticated attacker with only low local privileges on an AD FS server can abuse these loose ACLs to read protected key material and elevate to administrator. Because AD FS brokers federated single sign-on for every relying-party application trusting it, an attacker who reaches administrator on the AD FS host gains the ability to forge signed authentication tokens (a Golden-SAML-style attack) and impersonate any federated user across every connected service without further authentication. Microsoft credited Jeremy Kingston and Scott Clark of its own Detection and Response Team (DART) with discovering the flaw, indicating it surfaced during incident-response investigation of active attacks rather than proactive research. CVE-2026-56155 carries a CVSSv3.1 base score of 7.8 (Important) and a reported temporal score of 7.2. The July 14 update introduces an audit mode that detects insecure DKM container ACL configurations and logs Windows Event ID 1132 in the AD FS Admin event log, but it does not automatically change permissions; administrators must opt in immediately via the RemediateDkmAcl registry key, after which Microsoft will begin automatically remediating unconfigured environments starting 2026-10-13. CVE-2026-56155 can plausibly be chained with a remote code execution vulnerability to escalate a network foothold to full identity-infrastructure compromise, a pattern Microsoft's own guidance and third-party analysis both flag as consistent with ransomware intrusion chains.

CVE-2026-56164 affects on-premises Microsoft SharePoint Server (2016, 2019, Enterprise Server 2016, and Subscription Edition) and is classified under CWE-306 (Missing Authentication for a Critical Function). The vulnerability allows an unauthenticated, unauthorized attacker to elevate privileges over the network with no prior credentials and no user interaction, via direct HTTP requests to the SharePoint client service endpoint at /_vti_bin/client.svc. Despite carrying only a CVSSv3.1 base score of 5.3 (Moderate), the flaw is being actively exploited, illustrating that network reachability and authentication bypass matter more than the raw base score once abuse is confirmed. Microsoft credited Jayson Frost of Mandiant, Genwei Jiang of Google Cloud/FLARE, additional members of the FLARE OTF, and an anonymous researcher — again a discovery pattern consistent with incident-response findings from live attacks rather than proactive bug hunting. As interim mitigation ahead of patching, Microsoft recommends enabling Antimalware Scan Interface (AMSI) integration with Request Body Scan mode set to Full, which can detect and block malicious POST requests targeting the flaw. No public proof-of-concept exploit code and no detailed indicators of compromise for CVE-2026-56164 were available in cited reporting as of publication.

The same July release also disclosed a third zero-day, CVE-2026-50661, a Windows BitLocker Device Encryption security-feature-bypass flaw requiring physical access to the target device (publicly disclosed but not confirmed exploited), and 59 additional Critical-severity vulnerabilities spanning Office applications, Windows Media Foundation, Microsoft Defender, Remote Desktop Client, SQL Server, DHCP, DirectX Graphics Kernel, and Windows GDI+ — including a Windows VMSwitch use-after-free elevation-of-privilege flaw (CVSS 9.9) enabling guest-to-host compromise across Hyper-V VM boundaries, two SharePoint remote code execution vulnerabilities via untrusted-data deserialization (CVSS 9.8, demonstrated at Pwn2Own Berlin), and a Remote Desktop Protocol RCE (CVSS 9.8) rooted in uninitialized resource use. Neither Microsoft nor third-party researchers have publicly attributed the active exploitation of CVE-2026-56155 or CVE-2026-56164 to a named threat actor or group as of this writing; the discovery credits to Microsoft DART and Mandiant/Google FLARE indicate the activity was caught during live incident response rather than disclosed by the intruders' identity.

MITRE ATT&CK techniques used in TL-2026-1430

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services; T1550 Use Alternate Authentication Material

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1484 Domain or Tenant Policy Modification; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Discovery

T1069 Permission Groups Discovery; T1082 System Information Discovery

Persistence

T1098 Account Manipulation

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

lateral-movement

T1210 Exploitation of Remote Services; T1550 Use Alternate Authentication Material

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1531 Account Access Removal

Credential Access

T1552 Unsecured Credentials; T1606 Forge Web Credentials

Reconnaissance

T1595 Active Scanning

defense-impairment

T1600 Weaken Encryption

Affected products and versions in Microsoft July 2026 Patch Tuesday

  • Microsoft — Active Directory Federation Services (AD FS)
    Vulnerable versions: AD FS on Windows Server, DKM container ACL misconfigured prior to July 2026 update
    Fixed in: Windows Server with July 2026 cumulative update applied and RemediateDkmAcl registry key set
  • Microsoft — SharePoint Server
    Vulnerable versions: SharePoint Server 2016; SharePoint Enterprise Server 2016; SharePoint Server 2019; SharePoint Server Subscription Edition
    Fixed in: SharePoint Server 2016/2019/Subscription Edition with July 2026 security update applied

Remediation for Microsoft July 2026 Patch Tuesday

Patches

  • Microsoft July 2026 Patch Tuesday cumulative update resolving CVE-2026-56155 (AD FS elevation of privilege)
  • Microsoft July 2026 Patch Tuesday cumulative update resolving CVE-2026-56164 (SharePoint Server elevation of privilege)

Immediate actions

  • Apply the July 2026 cumulative Windows/Office/SharePoint updates immediately across all AD FS servers and on-premises SharePoint farms
  • On AD FS servers, opt in to DKM container ACL remediation now by setting the RemediateDkmAcl registry key rather than waiting for Microsoft's automatic remediation on 2026-10-13
  • Monitor the AD FS Admin event log for Event ID 1132, which flags insecure DKM container ACL configurations
  • On SharePoint Server, enable AMSI integration and set Request Body Scan mode to Full to detect and block malicious POST requests exploiting CVE-2026-56164
  • Inventory and prioritize patching of internet-facing SharePoint instances and any AD FS servers reachable by low-privileged accounts
  • Comply with CISA BOD 26-04 required actions and forensics triage guidance for both KEV-listed CVEs; federal agencies must remediate CVE-2026-56164 by 2026-07-17 and CVE-2026-56155 by 2026-07-28

Workarounds

  • AD FS: set the RemediateDkmAcl registry key to immediately tighten DKM container ACLs ahead of Microsoft's automatic enforcement on 2026-10-13
  • SharePoint: enable AMSI with Request Body Scan mode Full as an interim compensating control pending patch deployment

Longer-term hardening

  • Review AD FS DKM container ACLs and federated token-signing certificate handling as part of standing identity-infrastructure hardening
  • Restrict local logon rights on AD FS servers to the minimum required set of administrators
  • Segment and restrict network reachability to on-premises SharePoint client service endpoints (/_vti_bin/client.svc) from untrusted networks
  • Establish a Patch Tuesday triage process that prioritizes KEV-listed and actively-exploited CVEs ahead of raw CVSS-score ranking, given CVE-2026-56164's active exploitation despite a Moderate 5.3 score
  • Review incident-response playbooks for post-compromise identity abuse (forged SAML tokens, unusual AD FS admin activity) covering the exploitation window since July 2026

CVEs associated with Microsoft July 2026 Patch Tuesday

CVE-2026-56155, CVE-2026-56164

Weaknesses (CWE) in Microsoft July 2026 Patch Tuesday

CWE-1220, CWE-306

Timeline of Microsoft July 2026 Patch Tuesday

  • Microsoft credits Jayson Frost (Mandiant), Genwei Jiang (Google Cloud), the FLARE OTF, and an anonymous researcher with discovering CVE-2026-56164.
  • Microsoft credits its own Detection and Response Team (DART) researchers Jeremy Kingston and Scott Clark with discovering CVE-2026-56155, indicating the flaw surfaced during incident-response investigation of active attacks.
  • CISA adds CVE-2026-56164 to the Known Exploited Vulnerabilities catalog as the 'Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability', setting a federal remediation due date of 2026-07-17.
  • CISA adds CVE-2026-56155 to the Known Exploited Vulnerabilities catalog as the 'Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability', setting a federal remediation due date of 2026-07-28.
  • Microsoft ships the July 2026 Patch Tuesday cumulative update, resolving between 569 and 622 CVEs (outlet-dependent count) including CVE-2026-56155 (AD FS EoP) and CVE-2026-56164 (SharePoint EoP).
  • Zero Day Initiative and SOCPrime publish technical reviews of the July 2026 release, detailing the DKM container ACL root cause for CVE-2026-56155 and the unauthenticated client.svc exposure for CVE-2026-56164.
  • Tenable, Malwarebytes, and BleepingComputer independently publish analyses corroborating active in-the-wild exploitation of both CVE-2026-56155 and CVE-2026-56164.
  • NSFOCUS Global publishes an advisory flagging CVE-2026-56155 and CVE-2026-56164 as the two actively exploited zero-days in the July 2026 release (source article for this threat record).
  • CISA BOD 26-04 remediation deadline for CVE-2026-56164 for U.S. federal civilian executive branch agencies.
  • CISA BOD 26-04 remediation deadline for CVE-2026-56155 for U.S. federal civilian executive branch agencies.
  • Microsoft's scheduled date for automatically remediating AD FS DKM container ACL misconfigurations on environments that have not manually set the RemediateDkmAcl registry key.

Sources cited for Microsoft July 2026 Patch Tuesday

Threats related to Microsoft July 2026 Patch Tuesday

Detection coverage for TL-2026-1430

As of 2026-07-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1430 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats