# Microsoft July 2026 Patch Tuesday: Two Actively Exploited Zero-Days (CVE-2026-56155 AD FS, CVE-2026-56164 SharePoint) Among Record 570+ Fixes

> Microsoft's July 2026 Patch Tuesday (a record 569-622 CVEs depending on counting methodology) shipped fixes for two zero-days confirmed exploited in the wild: CVE-2026-56155, an Active Directory Federation Services elevation-of-privilege flaw rooted in insufficient DKM-container ACL granularity that grants attackers administrator privileges from a low-privileged local foothold, and CVE-2026-56164, an unauthenticated network-exploitable SharePoint Server elevation-of-privilege flaw caused by a missing authentication check on the client.svc endpoint. Both were added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-14 with mandated federal remediation deadlines.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1430
- **ID:** TL-2026-1430
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-56164, CVE-2026-50661

## Description

On 2026-07-14 Microsoft released its July 2026 Patch Tuesday update, the largest on record, addressing between 569 and 622 vulnerabilities depending on the outlet's counting methodology (Tenable reported 569, Malwarebytes and BleepingComputer reported 622/570+) across Windows, Office, SQL Server, Exchange, Azure, Edge, and VS Code. Microsoft attributed the record volume in part to an internal AI-powered vulnerability discovery system now surfacing flaws proactively across the Windows codebase. Three zero-days were disclosed in the release, two of which were confirmed exploited in the wild.

CVE-2026-56155 affects Active Directory Federation Services (AD FS) and is classified under CWE-1220 (Insufficient Granularity of Access Control). The root cause is insufficiently granular permissions on the AD FS Distributed Key Manager (DKM) Active Directory container, which stores the symmetric key material used to protect AD FS token-signing and token-decryption certificate private keys. An authenticated attacker with only low local privileges on an AD FS server can abuse these loose ACLs to read protected key material and elevate to administrator. Because AD FS brokers federated single sign-on for every relying-party application trusting it, an attacker who reaches administrator on the AD FS host gains the ability to forge signed authentication tokens (a Golden-SAML-style attack) and impersonate any federated user across every connected service without further authentication. Microsoft credited Jeremy Kingston and Scott Clark of its own Detection and Response Team (DART) with discovering the flaw, indicating it surfaced during incident-response investigation of active attacks rather than proactive research. CVE-2026-56155 carries a CVSSv3.1 base score of 7.8 (Important) and a reported temporal score of 7.2. The July 14 update introduces an audit mode that detects insecure DKM container ACL configurations and logs Windows Event ID 1132 in the AD FS Admin event log, but it does not automatically change permissions; administrators must opt in immediately via the RemediateDkmAcl registry key, after which Microsoft will begin automatically remediating unconfigured environments starting 2026-10-13. CVE-2026-56155 can plausibly be chained with a remote code execution vulnerability to escalate a network foothold to full identity-infrastructure compromise, a pattern Microsoft's own guidance and third-party analysis both flag as consistent with ransomware intrusion chains.

CVE-2026-56164 affects on-premises Microsoft SharePoint Server (2016, 2019, Enterprise Server 2016, and Subscription Edition) and is classified under CWE-306 (Missing Authentication for a Critical Function). The vulnerability allows an unauthenticated, unauthorized attacker to elevate privileges over the network with no prior credentials and no user interaction, via direct HTTP requests to the SharePoint client service endpoint at /_vti_bin/client.svc. Despite carrying only a CVSSv3.1 base score of 5.3 (Moderate), the flaw is being actively exploited, illustrating that network reachability and authentication bypass matter more than the raw base score once abuse is confirmed. Microsoft credited Jayson Frost of Mandiant, Genwei Jiang of Google Cloud/FLARE, additional members of the FLARE OTF, and an anonymous researcher — again a discovery pattern consistent with incident-response findings from live attacks rather than proactive bug hunting. As interim mitigation ahead of patching, Microsoft recommends enabling Antimalware Scan Interface (AMSI) integration with Request Body Scan mode set to Full, which can detect and block malicious POST requests targeting the flaw. No public proof-of-concept exploit code and no detailed indicators of compromise for CVE-2026-56164 were available in cited reporting as of publication.

The same July release also disclosed a third zero-day, CVE-2026-50661, a Windows BitLocker Device Encryption security-feature-bypass flaw requiring physical access to the target device (publicly disclosed but not confirmed exploited), and 59 additional Critical-severity vulnerabilities spanning Office applications, Windows Media Foundation, Microsoft Defender, Remote Desktop Client, SQL Server, DHCP, DirectX Graphics Kernel, and Windows GDI+ — including a Windows VMSwitch use-after-free elevation-of-privilege flaw (CVSS 9.9) enabling guest-to-host compromise across Hyper-V VM boundaries, two SharePoint remote code execution vulnerabilities via untrusted-data deserialization (CVSS 9.8, demonstrated at Pwn2Own Berlin), and a Remote Desktop Protocol RCE (CVSS 9.8) rooted in uninitialized resource use. Neither Microsoft nor third-party researchers have publicly attributed the active exploitation of CVE-2026-56155 or CVE-2026-56164 to a named threat actor or group as of this writing; the discovery credits to Microsoft DART and Mandiant/Google FLARE indicate the activity was caught during live incident response rather than disclosed by the intruders' identity.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1548 Abuse Elevation Control Mechanism
- T1611 Escape to Host
- T1484 Domain or Tenant Policy Modification
- T1550 Use Alternate Authentication Material
- T1600 Weaken Encryption
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1606 Forge Web Credentials
- T1082 System Information Discovery
- T1069 Permission Groups Discovery
- T1550 Use Alternate Authentication Material
- T1021 Remote Services
- T1005 Data from Local System
- T1210 Exploitation of Remote Services
- T1531 Account Access Removal

## Sources

- [Microsoft's July Security Update of High-Risk Vulnerability Notice for Multiple Products](https://nsfocusglobal.com/microsofts-july-security-update-of-high-risk-vulnerability-notice-for-multiple-products/)
- [July 2026 Patch Tuesday fixes 622 Microsoft CVEs, including three zero-days](https://www.malwarebytes.com/blog/bugs/2026/07/july-2026-patch-tuesday-fixes-622-microsoft-cves-including-three-zero-days)
- [July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-56155, CVE-2026-56164 entries)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [CVE-2026-56164 and CVE-2026-56155 Analysis](https://socprime.com/blog/cve-2026-56164-and-cve-2026-56155-analysis/)
- [Microsoft Active Directory FS Privilege Escalation Flaw Exploited in Active Attacks](https://cyberpress.org/microsoft-ad-fs-privilege-escalation-flaw/)
- [Microsoft Active Directory Services 0-Day Vulnerability Actively Exploited in the Wild](https://cybersecuritynews.com/active-directory-services-0-day-exploited/amp/)
- [Microsoft Patches 622 CVEs: Active SharePoint and AD FS Zero-Days Demand First Action](https://www.techtimes.com/articles/320687/20260716/microsoft-patches-622-cves-active-sharepoint-ad-fs-zero-days-demand-first-action.htm)
- [CVE-2026-56164: SharePoint Missing Authentication, Active Exploitation, and KEV Response](https://www.penligent.ai/hackinglabs/cve-2026-56164/)
- [Microsoft's Record 622-CVE July 2026 Patch Tuesday Ships an Actively Exploited SharePoint Zero-Day](https://orca.security/resources/blog/microsoft-july-2026-patch-tuesday-sharepoint-zero-day/)
- [CVE-2026-56155, The AD FS DKM ACL Privilege Escalation](https://www.penligent.ai/hackinglabs/cve-2026-56155/)
- [CVE Record: CVE-2026-56155](https://www.cve.org/CVERecord?id=CVE-2026-56155)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1430