All Articles

What Happened

Microsoft's July 2026 Patch Tuesday, released July 14, is the largest security release the company has ever shipped. BleepingComputer counts 570 flaws using its Microsoft-only methodology. Tenable counts 569 CVEs: 56 critical, 510 important, 3 moderate. The one-CVE difference comes down to inclusion criteria, not substance.

Three zero days are in the batch. Two were exploited in the wild before patches existed. One, a BitLocker bypass, was publicly disclosed but not known to be exploited.

Elevation of privilege dominates the release at 43.8 percent of fixed CVEs, with remote code execution at 25.1 percent, per Tenable. Separately, Google fixed 468 Chromium flaws that flow into Microsoft Edge this month; those are not in the 570 count.

The Two Exploited Zero Days

CVE-2026-56155: AD FS Elevation of Privilege (CVSSv3 7.8)

Microsoft describes the root cause as insufficient granularity of access control in Active Directory Federation Services. An authorized attacker with low privileges on an AD FS server can elevate to administrator locally.

The discovery credit matters here: the flaw is credited to Jeremy Kingston and Scott Clark of Microsoft's Detection and Response Team (DART), the incident response unit. As BleepingComputer notes, DART credit indicates the bug was likely found while working active intrusions. Microsoft has not published exploitation details, victim counts, or actor attribution.

AD FS is identity infrastructure. Admin on an AD FS server means the ability to tamper with token signing, which is the SAML forgery path (Golden SAML) that made the 2020 SolarWinds intrusions so painful. Treat this as a tier 0 patch.

CVE-2026-56164: SharePoint Server Missing Authentication (CVSSv3 5.3)

Do not let the moderate rating and 5.3 score set your priority. The advisory text reads: missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network. Unauthenticated, network-reachable, and already exploited in the wild.

• Affected versions: SharePoint Server 2016, SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (per Tenable). On-premises only.
• Mitigation while you patch: Microsoft says enabling AMSI integration on the server and setting Request Body Scan mode to Full helps, because AMSI can detect the malicious POST requests used in exploitation.
• Discovery credit: Jayson Frost of Mandiant Incident Response, Genwei Jiang of Google Cloud, FLARE OTF, and an anonymous researcher. Two incident response teams in the credits is another signal this was found in live victim environments.

If you followed the ToolShell exploitation wave against on-prem SharePoint in 2025, the playbook is familiar: hunt for anomalous unauthenticated POST requests in IIS logs and check for unexpected files in SharePoint layouts directories before trusting the patch.

CVE-2026-50661: BitLocker Bypass, Disclosed but Not Exploited

The third zero day is a BitLocker security feature bypass (CVSSv3 6.1) requiring physical access to the device. Microsoft rates exploitation less likely and credits an anonymous researcher. Tenable speculates, unconfirmed, that it may correspond to the GreatXML bypass disclosed publicly on June 10. Relevant mostly for lost-laptop and insider threat models.

Why 570 Fixes in One Month

The volume is not an accident. Microsoft said last week that its multi-model agentic scanning harness (MDASH), an AI-driven vulnerability discovery system, is now finding flaws across the Windows codebase at scale, and that "customers will see a higher volume of security updates included in each security release" (Microsoft, quoted by Tenable). Plan patch windows and reboot cycles for this being the new normal, not a spike.

Beyond the Zero Days: What Deserves Priority

The KEV Entry and BOD 26-04

CISA added four CVEs to the KEV catalog on July 14: both Microsoft zero days plus CVE-2026-15409 (SonicWall SMA1000 SSRF) and CVE-2026-15410 (SonicWall SMA1000 code injection). If you run SMA1000 remote access appliances, that is a second exploited-edge-device fire to fight this week.

Under Binding Operational Directive 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control post-exploitation, and must check whether the system was compromised before the patch landed. That compromise-check expectation is the part worth copying even if you are not a federal agency: for exploited-in-the-wild flaws, patching without hunting is closing the door with the intruder possibly inside.

This has been a heavy vulnerability week overall. See our coverage of the Progress ShareFile Storage Zone Controller zero day and the SAP July 2026 Patch Day with its CVSS 9.9 NetWeaver ABAP flaw, both landing in the same cycle.

Remediations and Detections

1. Patch AD FS servers first. CVE-2026-56155 is local EoP to admin on identity infrastructure. Schedule emergency maintenance rather than waiting for the monthly window.
2. Hunt on AD FS before and after patching. Review AD FS audit and Security event logs for unexpected local group membership changes, new local admins, and anomalous service account logons. If you run Defender for Identity or equivalent, review AD FS-related alerts back several weeks, since DART discovery implies real intrusions predate the patch.
3. Patch on-prem SharePoint 2016, 2019, and Subscription Edition. Where patching lags, enable AMSI integration with Request Body Scan mode set to Full now.
4. Hunt SharePoint exploitation: review IIS logs for unauthenticated POST requests to unusual endpoints, unexpected privilege changes on SharePoint service and farm accounts, and new files in web-accessible SharePoint directories.
5. Patch or isolate SonicWall SMA1000 appliances per the KEV addition of CVE-2026-15409 and CVE-2026-15410. Edge remote-access devices rarely have EDR; assume compromise checks mean config review and log export.
6. Sequence the rest by exploitability: Dynamics NAV/Business Central on-prem (CVE-2026-55944), DHCP Server cluster, then the kernel EoP set.
7. Re-baseline patch capacity. With Microsoft's AI discovery pipeline in production, 500-plus CVE months will recur. If your patch SLA math assumed 100-200 CVEs a month, redo it.

Immediate Action Checklist

• Today: Emergency-patch AD FS and internet-reachable SharePoint. Enable AMSI Full scan on SharePoint that cannot patch today.
• Today: Patch or take offline SonicWall SMA1000 appliances.
• This week: Compromise assessment on AD FS and SharePoint (logs, accounts, file system) covering the pre-patch window.
• This week: Patch CVE-2026-55944 and the DHCP Server criticals.
• This month: Update patch-window capacity planning for sustained higher CVE volume.

If you do one thing today: patch your AD FS servers and pull their audit logs for the last 30 days. An exploited elevation of privilege flaw on the system that signs your federation tokens is not a backlog item.

Community Note

Both exploited zero days were found by incident responders inside real environments, which means the gap between "vulnerable" and "already compromised" was zero for some organizations. If you want an outside-in view of which of your exposed assets an attacker would actually reach first, the community can use FireCompass Free Explorer, a free self-serve AI pen test. No asset list to upload, no credit card, it discovers and tests your attack surface the way an attacker would.

Related on CISOPlatform

• Progress ShareFile Zero Day: Path Traversal Behind the Storage Zone Controller Shutdown
• SAP July 2026 Patch Day: CVSS 9.9 NetWeaver ABAP Flaw Leads 16 New Security Notes
• CISA's GitHub Credential Leak Postmortem: 7 Lessons Every CISO Must Act On Now

Join the Discussion

Three questions for practitioners:

• For CVE-2026-56164, are you enabling AMSI Full request body scanning on SharePoint as a stopgap, and what performance impact are you seeing on large farms?
• How are you executing the BOD 26-04 style compromise check on AD FS? Which log sources and lookback window are you using?
• With Microsoft signaling sustained 500-plus CVE months from AI-driven discovery, are you changing patch SLAs, adding maintenance windows, or accepting longer exposure?

Sources

• BleepingComputer: Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days (July 14, 2026)
• Tenable: Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)
• CISA: Adds Four Known Exploited Vulnerabilities to Catalog (July 14, 2026)