Microsoft Patch Tuesday July 2026: 2 Zero-Days Exploited in Attacks, 570 Flaws Fixed

CVE-2026-56155 is an elevation of privilege flaw in Active Directory Federation Services (AD FS) — the Windows Server role that provides federated identity and single sign-on for hybrid Azure AD environments and SAML-based applications. Insufficient granularity of access control in the AD FS service allows an authorized but low-privileged local attacker to escalate to administrator without user interaction and with low attack complexity. Microsoft's Detection and Response Team (DART) credited the discovery, which indicates the flaw was identified while investigating active attacks rather than during internal security review.

CVE-2026-56164 in SharePoint Server exploits a missing authentication check for a critical API function accessible over the network. An unauthenticated attacker who can reach the SharePoint Server's HTTPS endpoint sends a specially crafted POST request to a specific API path and receives elevated permissions without supplying valid credentials. This makes the flaw meaningfully more dangerous than CVE-2026-56155: no local access, no authentication, and no user interaction is required — only network reachability to the server.

Microsoft's recommended mitigation for CVE-2026-56164 is enabling the Antimalware Scan Interface (AMSI) integration in SharePoint and setting the Request Body Scan mode to Full. AMSI scans incoming POST request bodies and can detect and block the malicious payload patterns used to trigger the vulnerability. This is an interim control, not a patch substitute. Organizations that enable AMSI now and patch within 48 hours are in a defensible position; organizations that do neither face active exploitation.

Microsoft's AI-powered vulnerability discovery system, which the company announced earlier in 2026, contributed to the record-breaking CVE count this cycle. The 570-flaw total reflects expanded automated scanning applied to Windows internals and third-party components integrated into Microsoft products — a long-term security benefit that creates short-term patch burden.

Any organization running on-premises Microsoft SharePoint Server 2016, 2019, or Subscription Edition is directly exposed to CVE-2026-56164. Organizations using SharePoint Online through Microsoft 365 are not affected — this is an on-premises-only vulnerability. Deployments with SharePoint Server accessible from the internet face external attack without authentication. Internal-only deployments face exploitation by any attacker who has already reached the internal network.

Any organization using Active Directory Federation Services as its identity federation layer is exposed to CVE-2026-56155. AD FS is deployed by organizations running hybrid Azure AD configurations, supporting SAML-based SSO, or federating identity across multiple Active Directory forests. A compromised AD FS server enables an attacker to issue arbitrary security tokens, bypassing authentication controls across every application that trusts the federation service — typically email, VPNs, cloud services, and enterprise applications.

Federal agencies under Binding Operational Directive 26-04 face a mandatory July 17, 2026 remediation deadline for CVE-2026-56164 (today) and July 28, 2026 for CVE-2026-56155. Agencies that cannot apply patches before the deadline must discontinue use of the affected product. This is not advisory guidance — noncompliance with BOD 26-04 deadlines is reportable to CISA.

Private organizations face no regulatory deadline but should treat the combination of on-premises SharePoint and AD FS as a high-priority exposure. An attacker who exploits CVE-2026-56164 to gain elevated SharePoint permissions can pivot to AD FS, creating a path from unauthenticated network access to enterprise-wide SSO token forgery. For context on prior SharePoint patch urgency, the July 4 deadline for CVE-2026-45659 followed the same escalation pattern.

The 570 vulnerabilities in Microsoft Patch Tuesday July 2026 represent a four to six times increase over a typical monthly release. Microsoft's breakdown shows 59 critical-severity vulnerabilities, 254 elevation of privilege flaws, 145 remote code execution vulnerabilities, 102 information disclosure flaws, 35 denial-of-service vulnerabilities, and 17 security feature bypasses. The three zero-days account for a small fraction of the total but carry the highest urgency because exploitation is confirmed before patches were available.

CVE-2026-55944 demands immediate attention alongside the two zero-days. This CVSS 9.8 deserialization flaw in Microsoft Dynamics NAV and 365 Business Central allows an unauthenticated remote attacker to execute arbitrary code with no user interaction. Organizations running on-premises Dynamics NAV or Business Central should treat this as a third critical patch-now priority alongside the zero-days. No authentication, no user interaction, and no network position requirement — any reachable Dynamics instance is a target.

Five DHCP vulnerabilities rated Critical (CVSS 8.4 to 9.8) also appear in this release, affecting both Windows DHCP Server and Windows DHCP Client. The client-side flaws are particularly significant: a malicious DHCP server on the same network segment can exploit any unpatched Windows machine that requests an IP address lease. This is relevant to corporate guest networks, hotel networks, and any environment where the network layer is not fully trusted.

CVE-2026-50661, the publicly disclosed BitLocker security feature bypass, requires physical access to the target machine and is therefore lower priority for most organizations but critical for any with a large laptop fleet or remote-work device program where physical theft is a realistic scenario. Review the July 14 threat brief for the broader adversary environment driving this patch cycle.

Neither CVE-2026-56155 nor CVE-2026-56164 has a published proof-of-concept exploit as of today, but both are confirmed exploited in the wild, which means tooling exists in threat actor hands. Detection relies on behavioral telemetry rather than signature-based IOC matching.

For CVE-2026-56164 on SharePoint Server, monitor IIS logs on the w3wp.exe worker process for POST requests to SharePoint API paths (/_api/web, /_api/contextinfo) that return HTTP 200 responses for requests without valid authentication headers. Baseline normal authenticated traffic volumes first, then alert on any unauthenticated POST that returns a non-401 or non-403 response. Also watch for file writes to SharePoint layout directories (C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS\ and the \16\ equivalent) from IIS worker processes — the standard webshell deployment indicator after privilege escalation.

For CVE-2026-56155 on AD FS, monitor Windows Security Event ID 4672 (Special Privileges assigned to new logon) on the AD FS server for unexpected privilege assignments, and AD FS operational logs for Event IDs 1200 and 1201 (token issuance) at unusual volumes or for unexpected relying party applications. DART's involvement in discovering this vulnerability suggests the exploitation pattern involves local privilege escalation followed by token manipulation.

For the broader Patch Tuesday scope, Windows Defender and Microsoft Sentinel customers should verify threat intelligence updates are current as of July 8, 2026. Microsoft ships signature updates alongside patches for CVEs where behavioral detection is feasible.

No CVE-specific Sigma rule exists yet for CVE-2026-56155 or CVE-2026-56164, which were publicly disclosed on July 8, 2026. New CVE-specific rules typically take 48 to 72 hours after public disclosure to appear in SigmaHQ's emerging-threats ruleset.

The two rules below target post-exploitation behavior on SharePoint Server systems consistent with CVE-2026-56164 abuse. The first rule detects file writes to SharePoint layout directories from unexpected parent processes — the standard webshell deployment pattern after a privilege escalation exploit succeeds. The second rule detects suspicious commands spawned by w3wp.exe, the IIS worker process that hosts SharePoint, including encoded PowerShell invocations used to establish persistent access or lateral movement.

Both rules require Windows Sysmon or an EDR with equivalent file_event and process_creation telemetry. Use sigma-cli to convert the YAML to Splunk SPL, Microsoft Sentinel KQL, or Elastic query syntax. Deploy on all hosts running SharePoint Server 2016, 2019, and Subscription Edition. Alert noise is low in a normal SharePoint environment — any match warrants immediate triage.

The remediation path for the two actively exploited zero-days is clear: apply the July 2026 Patch Tuesday cumulative update. No standalone hotfix or partial patch exists for CVE-2026-56155 or CVE-2026-56164 — the full cumulative update is required. The specific KB numbers are KB5101650 for Windows 11 (24H2 and 23H2), KB5099539 for Windows 10 and Windows Server 2025/2022/2019, available through Windows Update, WSUS, and the Microsoft Update Catalog.

For organizations that cannot patch immediately, the SharePoint interim mitigation is available today without downtime. Enable AMSI integration and set Request Body Scan to Full in SharePoint Central Administration. This blocks the specific POST payload pattern used to exploit CVE-2026-56164. Confirm AMSI is active by checking SharePoint Unified Logging Service (ULS) logs for AMSI-related entries after enabling.

No interim mitigation exists for CVE-2026-56155 in AD FS. Organizations that cannot patch AD FS servers immediately should isolate them from direct external access, enforce network-level restrictions on who can reach the AD FS service endpoints, and increase logging verbosity on the AD FS operational event channel.

Microsoft Patch Tuesday July 2026 is not a routine update cycle. The record 570-flaw count, two actively exploited zero-days, a CVSS 9.8 unauthenticated RCE, and five critical DHCP vulnerabilities arriving in a single month create a compounding risk environment for any Microsoft-dependent organization.

The two zero-days represent the highest-risk combination in this release. CVE-2026-56164's unauthenticated network attack surface for SharePoint means external attackers need nothing but a reachable server. CVE-2026-56155's AD FS privilege escalation means an attacker who gains any foothold can immediately escalate to domain-level SSO control. Together, they create a path from anonymous internet access to enterprise-wide authentication compromise in two steps: reach SharePoint, then escalate to AD FS administrator.

The CISA KEV designation for both CVEs confirms active exploitation is real, not theoretical. Microsoft's DART team discovered CVE-2026-56155 during incident response, which means attackers were already using this technique before any defender had a patch to deploy. Organizations that have delayed applying July 2026 Patch Tuesday since July 8 have been running unpatched against confirmed in-the-wild exploitation for nine days.

Closing these gaps before Monday reduces your organization's exposure substantially. Apply the July 2026 cumulative update to every Windows Server instance today, enable AMSI on SharePoint as interim mitigation, and monitor AD FS privilege logs through the weekend. The attack surface for this cycle is unusually broad — and the window between patch availability and active exploitation is already closed.