July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Days

July 2026 Patch Tuesday (TL-2026-1437), also tracked as July 2026 Patch Tuesday, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-17 and last reviewed 2026-07-28. It is attributed to Storm-2603 (China) with medium confidence, affects Microsoft SharePoint Enterprise Server 2016, references 10 CVEs (CVE-2026-58644, CVE-2026-56155, CVE-2026-56164), maps to 26 MITRE ATT&CK techniques (T1003.001, T1005, T1016), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1437

Threat ID
TL-2026-1437
Also known as
July 2026 Patch Tuesday, SharePoint ToolShell-class exploitation wave
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-17
Last reviewed
2026-07-28
Attribution
Storm-2603
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government administration, finance, health, energy, technology, education
Target regions
North America, Europe, Asia Pacific
Detection rules
9
Indicators of compromise
27
Updates
2026-07-28 · revalidated 1× · latest source

Malware and tooling in July 2026 Patch Tuesday

Malware and tooling: WarLock, ToolShell exploit chain

Microsoft's July 2026 Patch Tuesday (622 CVEs, its largest on record) shipped fixes for multiple zero-days under active exploitation: CVE-2026-58644, a network-reachable, unauthenticated SharePoint Server deserialization-of-untrusted-data RCE (CVSS 9.8) whose exploitation status flipped to 'detected' the day after release; CVE-2026-56155, an AD FS Distributed Key Manager (DKM) container access-control flaw (CVSS 7.8) that exposes federation token-signing key material; and CVE-2026-56164, an unauthenticated SharePoint missing-authentication elevation-of-privilege bug (CVSS 5.3 per Microsoft, 9.8 per NVD) being chained with legacy SharePoint bugs to steal IIS machine keys. CISA added all three to KEV within 48 hours and issued a hardening alert referencing the July 2025 'ToolShell' campaign (Linen Typhoon, Violet Typhoon, Storm-2603/Warlock ransomware) as the operational precedent for this attack pattern. A fourth flaw, CVE-2026-50661 (BitLocker security-feature-bypass, CVSS 6.1), was publicly known pre-release and requires physical device access.

How July 2026 Patch Tuesday works

On July 14, 2026, Microsoft released its July Patch Tuesday update covering 622 CVEs — the largest single release in Patch Tuesday history — including at least four vulnerabilities of immediate operational concern to defenders.

CVE-2026-58644 is a CVSS 9.8 deserialization-of-untrusted-data (CWE-502) remote code execution vulnerability in Microsoft Office SharePoint Server (Enterprise Server 2016 builds before 16.0.5556.1005, Server 2019 builds before 16.0.10417.20153, and Subscription Edition builds before 16.0.19725.20384). The flaw is network-reachable, requires no authentication and no user interaction, and allows an attacker to send a crafted serialized payload that SharePoint deserializes without adequate validation, resulting in arbitrary code execution in the context of the SharePoint application pool. Microsoft's exploitation-status field was updated from 'Exploitation More Likely' to 'Detected' on July 15, 2026, one day after release, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. It shares an identical root cause and CVSS score with the same-day CVE-2026-50522, which Zero Day Initiative researchers publicly demonstrated at Pwn2Own Berlin — Microsoft nonetheless listed CVE-2026-50522 as 'Exploit Maturity Unknown' at release, drawing criticism from the ZDI team, which noted it had handed Microsoft a working exploit.

CVE-2026-56164 is a CWE-306 (Missing Authentication for Critical Function) elevation-of-privilege flaw in on-premises SharePoint Server (2016, 2019, Subscription Edition) that lets an unauthenticated attacker reach a critical function over the network with no user interaction and no valid SharePoint credentials. Microsoft's CNA scored it 5.3 (low integrity impact only), but NVD's independent CVSS assessment rated it 9.8, reflecting a significant severity disagreement driven by differing assumptions about downstream impact once the missing-authentication gap is used as a pivot. CISA's KEV entry (effective July 14, 2026) and its accompanying alert describe active campaigns chaining CVE-2026-56164 together with older, previously disclosed SharePoint weaknesses (the 2025 ToolShell-class bugs CVE-2025-49704/CVE-2025-49706/CVE-2025-53770/CVE-2025-53771, plus 2026 SharePoint RCEs CVE-2026-32201 and CVE-2026-45659) to steal ASP.NET/IIS machine keys, forge __VIEWSTATE deserialization payloads for persistence, and deploy malware. The July 2025 ToolShell campaign that established this playbook was attributed to Chinese nation-state actors Linen Typhoon and Violet Typhoon, plus the ransomware affiliate Storm-2603, which deployed Warlock ransomware against victims across finance, healthcare, government, and energy sectors — CISA explicitly cites this precedent as the operational template for the July 2026 wave. This ToolShell-class exploitation chain is separately catalogued by MITRE ATT&CK as Campaign C0058.

CVE-2026-56155 is a CWE-1220 (Insufficient Granularity of Access Control) local elevation-of-privilege vulnerability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in Active Directory Federation Services (AD FS). The flaw exists in insufficiently restrictive permissions on the AD FS Distributed Key Manager (DKM) Active Directory container, which stores the symmetric key material that protects AD FS token-signing and token-decryption certificate private keys. A low-privileged local attacker — commonly an attacker who has already obtained a foothold via another vector — can abuse the loose ACL to read or tamper with DKM key material, enabling forgery of SAML/WS-Fed tokens and full compromise of the federation trust boundary, which in hybrid-identity environments cascades into Entra ID / Microsoft 365 access. Microsoft lists exploitation as 'Detected'; CISA added it to KEV on July 14, 2026 with a federal remediation deadline of July 28, 2026 under BOD 22-01. Microsoft's remediation is phased: from the July 14, 2026 update onward, the AD FS service audits the DKM container ACL at every service start and every 24 hours, logging Event ID 1132 in the AD FS Admin log when permissions require attention; a registry key allows administrators to control enforcement, and by October 13, 2026 unconfigured environments will have insecure ACLs automatically remediated.

CVE-2026-50661 is a CWE-693 (Protection Mechanism Failure) BitLocker security-feature-bypass vulnerability (CVSS 6.1, vector reflecting a Physical attack vector, no privileges, no user interaction, high confidentiality/integrity impact) affecting a broad range of Windows 10, Windows 11, and Windows Server releases. It was publicly known before the July 2026 patch shipped, and several researchers have suggested a possible connection to the publicly discussed 'GreatXML' BitLocker-bypass research, though Microsoft has not confirmed this. Exploitation requires sustained physical possession of the target device (e.g., a stolen or unattended laptop) to defeat full-disk encryption protections. Microsoft shipped branch-specific cumulative-update fixes (KB5099535, KB5099538, KB5099539, KB5099540, KB5101649, KB5101650, among others).

CISA's July 15, 2026 alert additionally reiterates concern over two other SharePoint bugs in the same exploitation cluster — CVE-2026-45659 (CVSS 8.8 RCE, actively exploited despite Microsoft's initial 'less likely' assessment) and CVE-2026-55040 (CVSS 9.1, 'Exploitation More Likely') — and recommends organizations enable AMSI integration on every SharePoint web application, rotate IIS machine keys, restrict/eliminate external SharePoint exposure, block external access to SharePoint Central Administration, and hunt for post-exploitation indicators consistent with the ToolShell playbook.

MITRE ATT&CK techniques used in TL-2026-1437

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1528 Steal Application Access Token; T1552.004 Unsecured Credentials: Private Keys; T1556 Modify Authentication Process; T1606.002 Forge Web Credentials: SAML Tokens; T1649 Steal or Forge Authentication Certificates

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery

Lateral Movement

T1021.006 Remote Services: Windows Remote Management; T1210 Exploitation of Remote Services; T1550.001 Use Alternate Authentication Material: Application Access Token

stealth

T1055 Process Injection

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.002 Valid Accounts: Domain Accounts; T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1070 Indicator Removal

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Persistence

T1078 Valid Accounts; T1505 Server Software Component

Initial Access

T1190 Exploit Public-Facing Application; T1200 Hardware Additions

Impact

T1486 Data Encrypted for Impact

persistence

T1505.003 Server Software Component: Web Shell

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in July 2026 Patch Tuesday

  • Microsoft — SharePoint Enterprise Server 2016
    Vulnerable versions: before 16.0.5556.1005
    Fixed in: 16.0.5556.1005 (July 2026 CU)
  • Microsoft — SharePoint Server 2019
    Vulnerable versions: before 16.0.10417.20153
    Fixed in: 16.0.10417.20153 (July 2026 CU)
  • Microsoft — SharePoint Server Subscription Edition
    Vulnerable versions: before 16.0.19725.20384
    Fixed in: 16.0.19725.20384 (July 2026 CU)
  • Microsoft — Active Directory Federation Services (AD FS)
    Vulnerable versions: Windows Server editions hosting AD FS prior to July 2026 CU
    Fixed in: July 2026 cumulative update (DKM ACL hardening phase 1)
  • Microsoft — Windows BitLocker
    Vulnerable versions: Windows 10 1607/1809/21H2/22H2, Windows 11 (incl. 24H2/25H2/26H1), Windows Server 2016/2019/2022/2025 pre-July 2026 update
    Fixed in: KB5099535, KB5099538, KB5099539, KB5099540, KB5101649, KB5101650

Remediation for July 2026 Patch Tuesday

Patches

  • CVE-2026-58644: SharePoint Enterprise Server 2016 build 16.0.5556.1005+, Server 2019 build 16.0.10417.20153+, Subscription Edition build 16.0.19725.20384+
  • CVE-2026-56155: July 2026 AD FS cumulative update (DKM ACL hardening phase 1; registry-key controlled; automatic full enforcement by 2026-10-13)
  • CVE-2026-56164: July 2026 SharePoint Server security update (2016/2019/Subscription Edition)
  • CVE-2026-50661: KB5099535 (Windows 10 1607 / Server 2016), KB5099538 (Windows 10 1809 / Server 2019), KB5099539 (Windows 10 21H2/22H2), KB5099540 (Windows Server 2022), KB5101649/KB5101650 (Windows 11 24H2/25H2/26H1, Server 2025)

Immediate actions

  • Apply the July 2026 Patch Tuesday updates to all SharePoint Server 2016, 2019, and Subscription Edition farms, prioritizing internet-exposed instances first
  • Apply the July 2026 cumulative update to all AD FS servers to obtain the DKM container ACL hardening logic for CVE-2026-56155
  • Enable Antimalware Scan Interface (AMSI) integration on every SharePoint web application
  • Rotate ASP.NET machine keys / IIS machine keys on all SharePoint servers, whether or not compromise is confirmed
  • Restrict or eliminate external internet exposure of on-premises SharePoint Server unless business-critical
  • Block external network access to SharePoint Central Administration
  • Review the AD FS Admin event log for Event ID 1132 (DKM container permissions requiring attention)

Workarounds

  • If patching is delayed, disable or firewall external access to on-premises SharePoint Server entirely
  • For AD FS, restrict local logon rights on federation servers to minimize the low-privilege local foothold CVE-2026-56155 requires
  • For BitLocker, enforce pre-boot PIN authentication so physical access alone is insufficient to bypass disk encryption

Longer-term hardening

  • Deploy EDR/behavioral detection on all SharePoint and AD FS servers with alerting tuned to deserialization and __VIEWSTATE anomalies
  • Establish tailored, centralized logging for SharePoint and AD FS with sufficient retention for post-incident hunting
  • Enforce BitLocker with Pre-Boot Authentication (PIN/TPM+PIN) and strict recovery-key governance on high-risk endpoints (laptops, executive/admin machines) to reduce CVE-2026-50661 blast radius
  • Move toward SharePoint Online / modernized hybrid identity to reduce on-premises exposure to future ToolShell-class chains
  • Implement network segmentation isolating AD FS and SharePoint infrastructure from general user segments

CVEs associated with July 2026 Patch Tuesday

CVE-2026-58644, CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-50522, CVE-2026-45659, CVE-2026-32201, CVE-2026-55040, CVE-2026-57092, CVE-2026-55008

Weaknesses (CWE) in July 2026 Patch Tuesday

CWE-502, CWE-1220, CWE-306, CWE-693, CWE-287, CWE-269, CWE-863, CWE-1230, CWE-347, CWE-79

Timeline of July 2026 Patch Tuesday

  • CVE-2026-45659 (SharePoint RCE, CVSS 8.8) patched by Microsoft; exploitation initially assessed 'less likely'
  • CVE-2026-32201 (SharePoint spoofing, CVSS 6.5) publicly disclosed
  • CISA adds CVE-2026-45659 to KEV catalog after confirming active exploitation, despite Microsoft's earlier 'exploitation less likely' rating
  • SOCRadar publishes 'July 2026 Patch Tuesday Zero-Day Vulnerabilities' blog flagging active exploitation of CVE-2026-58644 and CVE-2026-56155
  • CISA adds CVE-2026-56155 and CVE-2026-56164 to the KEV catalog the same day as patch release, with federal deadlines of 2026-07-28 and 2026-07-17 respectively
  • Microsoft ships July 2026 Patch Tuesday covering 622 CVEs (largest single release on record), including CVE-2026-58644, CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, and CVE-2026-50522
  • CISA publishes 'CISA Urges SharePoint Hardening After New Exploitations' alert covering CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-55040, and CVE-2026-58644, citing the July 2025 ToolShell campaign as operational precedent
  • Microsoft updates CVE-2026-58644 exploitation status from 'Exploitation More Likely' to 'Detected', one day after release
  • Rapid7 confirms active in-the-wild exploitation of CVE-2026-58644, the day CISA adds it to the KEV catalog.
  • CISA adds CVE-2026-58644 to the Known Exploited Vulnerabilities catalog
  • Researchers (SideHustleBuilds, SecurityWeek, Cybersecurity Dive) describe the combined CVE-2026-58644 / CVE-2026-56164 / CVE-2026-56155 chain as 'SharePoint's Second ToolShell' (ToolShell v2), a faster, identity-infrastructure-linked rerun of the July 2025 ToolShell campaign.
  • CISA BOD 22-01 federal remediation deadline for CVE-2026-56164 (SharePoint EoP)
  • CISA BOD 22-01 federal remediation deadline for CVE-2026-58644 (SharePoint deserialization RCE).
  • CISA BOD 22-01 federal remediation deadline for CVE-2026-56155 (AD FS DKM EoP)
  • Microsoft's phased AD FS DKM container ACL hardening reaches full automatic enforcement for unconfigured environments (CVE-2026-56155 fix completion)

Update history for TL-2026-1437

Sources cited for July 2026 Patch Tuesday

Threats related to July 2026 Patch Tuesday

Detection coverage for TL-2026-1437

As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1437 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats