# July 2026 Patch Tuesday: Actively Exploited SharePoint RCE (CVE-2026-58644) and AD FS/SharePoint Zero-Days

> Microsoft's July 2026 Patch Tuesday (622 CVEs, its largest on record) shipped fixes for multiple zero-days under active exploitation: CVE-2026-58644, a network-reachable, unauthenticated SharePoint Server deserialization-of-untrusted-data RCE (CVSS 9.8) whose exploitation status flipped to 'detected' the day after release; CVE-2026-56155, an AD FS Distributed Key Manager (DKM) container access-control flaw (CVSS 7.8) that exposes federation token-signing key material; and CVE-2026-56164, an unauthenticated SharePoint missing-authentication elevation-of-privilege bug (CVSS 5.3 per Microsoft, 9.8 per NVD) being chained with legacy SharePoint bugs to steal IIS machine keys. CISA added all three to KEV within 48 hours and issued a hardening alert referencing the July 2025 'ToolShell' campaign (Linen Typhoon, Violet Typhoon, Storm-2603/Warlock ransomware) as the operational precedent for this attack pattern. A fourth flaw, CVE-2026-50661 (BitLocker security-feature-bypass, CVSS 6.1), was publicly known pre-release and requires physical device access.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-28T15:42:40.444Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1437
- **ID:** TL-2026-1437
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2603 (China)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-58644, CVE-2026-56155, CVE-2026-56164, CVE-2026-50661, CVE-2026-50522, CVE-2026-45659, CVE-2026-32201, CVE-2026-55040, CVE-2026-57092, CVE-2026-55008

## Description

On July 14, 2026, Microsoft released its July Patch Tuesday update covering 622 CVEs — the largest single release in Patch Tuesday history — including at least four vulnerabilities of immediate operational concern to defenders.

CVE-2026-58644 is a CVSS 9.8 deserialization-of-untrusted-data (CWE-502) remote code execution vulnerability in Microsoft Office SharePoint Server (Enterprise Server 2016 builds before 16.0.5556.1005, Server 2019 builds before 16.0.10417.20153, and Subscription Edition builds before 16.0.19725.20384). The flaw is network-reachable, requires no authentication and no user interaction, and allows an attacker to send a crafted serialized payload that SharePoint deserializes without adequate validation, resulting in arbitrary code execution in the context of the SharePoint application pool. Microsoft's exploitation-status field was updated from 'Exploitation More Likely' to 'Detected' on July 15, 2026, one day after release, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. It shares an identical root cause and CVSS score with the same-day CVE-2026-50522, which Zero Day Initiative researchers publicly demonstrated at Pwn2Own Berlin — Microsoft nonetheless listed CVE-2026-50522 as 'Exploit Maturity Unknown' at release, drawing criticism from the ZDI team, which noted it had handed Microsoft a working exploit.

CVE-2026-56164 is a CWE-306 (Missing Authentication for Critical Function) elevation-of-privilege flaw in on-premises SharePoint Server (2016, 2019, Subscription Edition) that lets an unauthenticated attacker reach a critical function over the network with no user interaction and no valid SharePoint credentials. Microsoft's CNA scored it 5.3 (low integrity impact only), but NVD's independent CVSS assessment rated it 9.8, reflecting a significant severity disagreement driven by differing assumptions about downstream impact once the missing-authentication gap is used as a pivot. CISA's KEV entry (effective July 14, 2026) and its accompanying alert describe active campaigns chaining CVE-2026-56164 together with older, previously disclosed SharePoint weaknesses (the 2025 ToolShell-class bugs CVE-2025-49704/CVE-2025-49706/CVE-2025-53770/CVE-2025-53771, plus 2026 SharePoint RCEs CVE-2026-32201 and CVE-2026-45659) to steal ASP.NET/IIS machine keys, forge __VIEWSTATE deserialization payloads for persistence, and deploy malware. The July 2025 ToolShell campaign that established this playbook was attributed to Chinese nation-state actors Linen Typhoon and Violet Typhoon, plus the ransomware affiliate Storm-2603, which deployed Warlock ransomware against victims across finance, healthcare, government, and energy sectors — CISA explicitly cites this precedent as the operational template for the July 2026 wave. This ToolShell-class exploitation chain is separately catalogued by MITRE ATT&CK as Campaign C0058.

CVE-2026-56155 is a CWE-1220 (Insufficient Granularity of Access Control) local elevation-of-privilege vulnerability (CVSS 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in Active Directory Federation Services (AD FS). The flaw exists in insufficiently restrictive permissions on the AD FS Distributed Key Manager (DKM) Active Directory container, which stores the symmetric key material that protects AD FS token-signing and token-decryption certificate private keys. A low-privileged local attacker — commonly an attacker who has already obtained a foothold via another vector — can abuse the loose ACL to read or tamper with DKM key material, enabling forgery of SAML/WS-Fed tokens and full compromise of the federation trust boundary, which in hybrid-identity environments cascades into Entra ID / Microsoft 365 access. Microsoft lists exploitation as 'Detected'; CISA added it to KEV on July 14, 2026 with a federal remediation deadline of July 28, 2026 under BOD 22-01. Microsoft's remediation is phased: from the July 14, 2026 update onward, the AD FS service audits the DKM container ACL at every service start and every 24 hours, logging Event ID 1132 in the AD FS Admin log when permissions require attention; a registry key allows administrators to control enforcement, and by October 13, 2026 unconfigured environments will have insecure ACLs automatically remediated.

CVE-2026-50661 is a CWE-693 (Protection Mechanism Failure) BitLocker security-feature-bypass vulnerability (CVSS 6.1, vector reflecting a Physical attack vector, no privileges, no user interaction, high confidentiality/integrity impact) affecting a broad range of Windows 10, Windows 11, and Windows Server releases. It was publicly known before the July 2026 patch shipped, and several researchers have suggested a possible connection to the publicly discussed 'GreatXML' BitLocker-bypass research, though Microsoft has not confirmed this. Exploitation requires sustained physical possession of the target device (e.g., a stolen or unattended laptop) to defeat full-disk encryption protections. Microsoft shipped branch-specific cumulative-update fixes (KB5099535, KB5099538, KB5099539, KB5099540, KB5101649, KB5101650, among others).

CISA's July 15, 2026 alert additionally reiterates concern over two other SharePoint bugs in the same exploitation cluster — CVE-2026-45659 (CVSS 8.8 RCE, actively exploited despite Microsoft's initial 'less likely' assessment) and CVE-2026-55040 (CVSS 9.1, 'Exploitation More Likely') — and recommends organizations enable AMSI integration on every SharePoint web application, rotate IIS machine keys, restrict/eliminate external SharePoint exposure, block external access to SharePoint Central Administration, and hunt for post-exploitation indicators consistent with the ToolShell playbook.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1055 Process Injection
- T1505.003 Server Software Component: Web Shell
- T1505 Server Software Component
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1528 Steal Application Access Token
- T1552.004 Unsecured Credentials: Private Keys
- T1606.002 Forge Web Credentials: SAML Tokens
- T1649 Steal or Forge Authentication Certificates
- T1016 System Network Configuration Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1486 Data Encrypted for Impact
- T1200 Hardware Additions
- T1059 Command and Scripting Interpreter
- T1078.002 Valid Accounts: Domain Accounts
- T1556 Modify Authentication Process
- T1003.001 OS Credential Dumping: LSASS Memory
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1021.006 Remote Services: Windows Remote Management
- T1105 Ingress Tool Transfer

## Sources

- [July 2026 Patch Tuesday Zero-Day Vulnerabilities](https://socradar.io/blog/july-2026-patch-tuesday-zero-day/)
- [CISA Urges SharePoint Hardening After New Exploitations](https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations)
- [CISA sounds alarm over trio of exploited SharePoint flaws](https://www.theregister.com/security/2026/07/15/cisa-sounds-alarm-over-trio-of-exploited-sharepoint-flaws/5271814)
- [The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [CVE-2026-58644 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-58644)
- [CVE-2026-56155: AD FS DKM Container ACL Hardening](https://support.microsoft.com/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening)
- [CVE-2026-56164: SharePoint Missing Authentication, Active Exploitation, and KEV Response](https://www.penligent.ai/hackinglabs/cve-2026-56164/)
- [Microsoft Patches 622 CVEs: Active SharePoint and AD FS Zero-Days Demand First Action](https://www.techtimes.com/articles/320687/20260716/microsoft-patches-622-cves-active-sharepoint-ad-fs-zero-days-demand-first-action.htm)
- [CVE-2026-50661: Windows BitLocker Security Feature Bypass](https://www.strix.ai/cve/CVE-2026-50661)
- [CVE-2026-56155, The AD FS DKM ACL Privilege Escalation](https://www.penligent.ai/hackinglabs/cve-2026-56155/)
- [SharePoint ToolShell Exploitation, Campaign C0058](https://attack.mitre.org/campaigns/C0058/)
- [ToolShell Unleashed: Decoding the SharePoint Attack Chain](https://www.trellix.com/blogs/research/toolshell-unleashed-decoding-the-sharepoint-attack-chain/)
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-58644)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1437