Reported by 4 outlets
Microsoft July 2026 Patch Tuesday — Record 622 CVEs, Two Exploited Zero-Days, Rapid7 SharePoint Auth Bypass
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Microsoft's July 2026 Patch Tuesday shipped 622 vulnerabilities, 56 Critical and 510 Important, more than triple the previous record of 198 from June. Two were already exploited: CVE-2026-56155, an AD FS elevation of privilege rated CVSS 7.8 with vector AV:L/PR:L, so an ordinary authenticated account escalates to federation administrator, credited to Microsoft DART and therefore found during a live incident; and CVE-2026-56164, a missing-authentication elevation in SharePoint Server rated 5.3, credited to Mandiant Incident Response and Google Cloud FLARE. CISA placed both in the KEV catalog on July 14, 2026. Rapid7 separately disclosed CVE-2026-55040, a CVSS 9.1 JWT authentication bypass in SharePoint where knowing a target user's AD SID or UPN is enough to assume that identity, including site administrators, and chained it with an RCE whose fix lands only in the August cycle.
CISA's own deadlines price these bugs more honestly than CVSS does: the 5.3 SharePoint flaw carries a three-day federal patch deadline of July 17, while the 7.8 AD FS flaw gets fourteen days, to July 28. Both exploited bugs sit on the identity plane, so the real attack is token and session theft against federation and content infrastructure, not memory corruption, and any SharePoint server reachable from the network is exposed to an attacker who has done nothing more than enumerate a username. The volume is the second attack: 622 patches in one cycle guarantees most estates fall behind, and SharePoint Server 2016 and 2019 reaching end of support on July 14 with no ESU turns falling behind into a permanent condition for un-migrated farms. Rapid7's research sharpens the urgency, since patching CVE-2026-55040 now breaks the chain before the RCE half is patched, while a farm that misses July carries a known unauthenticated RCE path into August.
Patch AD FS against CVE-2026-56155 before the July 28 KEV deadline and SharePoint against CVE-2026-56164 before July 17, applying the CVE-2026-55040 update in the same pass to sever the auth bypass from the pending RCE. Where SharePoint patching lags, enable AMSI integration, which the advisory names as a mitigation. Treat CVE-2026-55944, the unauthenticated deserialization RCE in Dynamics NAV and Business Central rated 9.8, and the five DHCP Server RCEs, three of them rated Exploitation More Likely, as next in the queue. For hunting, CISA flags both SharePoint entries for forensic triage: review Unified Audit Log and SharePoint audit data for privileged sessions bound to SIDs or UPNs that should not hold them, and on AD FS watch for ordinary accounts receiving admin-level token issuance, since DART's credit means at least one real intrusion used this path before the patch existed. Where AD FS survives only to serve a completed Microsoft 365 migration, CISA's KEV notes link Microsoft's AD FS decommissioning guide; retiring it removes the attack class outright.
Two developments would change this assessment. Rapid7 publishes full technical detail within 30 days of the July 14 disclosure and the August Patch Tuesday carries the RCE half of the CVE-2026-55040 chain; CISA already added that CVE to KEV on August 18 with an August 21 deadline and required forensic triage, and when the exploit recipe and the missing patch coincide, mass SharePoint exploitation becomes the likeliest outcome. Second, a KEV addition for CVE-2026-55944 or the DHCP Server set would widen this from an identity-plane fire drill to unauthenticated, network-wide risk.
Timeline
-
original reporting
Microsoft July 2026 Patch Tuesday — Record 622 CVEs, Two Exploited Zero-Days, Rapid7 SharePoint Auth Bypass
bleepingcomputer.com · 91d ago · July 15th, 2026
Microsoft has shipped the largest Patch Tuesday release in history: 622 vulnerabilities across its product suite, shattering June's previous record of 198. The release includes 56 Critical and 510 Important vulnerabilities. Two vulnerabilities were exploited in the wild:
-
CVE-2026-56155 (CVSS 7.8) — Active Directory Federation Services elevation of privilege. An authorized attacker can elevate to administrator privileges. Credited to Microsoft DART, indicating discovery during active incident response. Microsoft has not disclosed exploitation details.
-
CVE-2026-56164 (CVSS 5.3) — Microsoft SharePoint Server elevation of privilege. Missing authentication for a critical function allows unauthorized privilege escalation over the network. AMSI integration can mitigate. Credited to Mandiant Incident Response and Google Cloud FLARE team.
The release also includes a publicly disclosed vulnerability: CVE-2026-50661 (CVSS 6.1) — Windows BitLocker security feature bypass. Likely patches the "GreatXML" BitLocker bypass disclosed by Nightmare Eclipse in June, which requires physical access.
Additional critical items from the massive release:
-
CVE-2026-55944 (CVSS 9.8, Exploitation More Likely) — Microsoft Dynamics NAV/Business Central RCE via untrusted data deserialization. No authentication or user interaction required.
-
Multiple DHCP Server RCEs (CVSS 8.8–9.8) — Five critical DHCP vulnerabilities, three assessed Exploitation More Likely.
-
20 Windows Kernel EoP vulnerabilities, six assessed Exploitation More Likely.
-
Nightmare Eclipse "LegacyHive" — A new PoC for mounting another user's NT user hive has emerged from the same researcher.
Rapid7 SharePoint Research (CVE-2026-55040): Rapid7 Labs disclosed a critical (CVSS 9.1) JWT token authentication bypass in Microsoft SharePoint, discovered during a zero-day research project for Pwn2Own Berlin. An unauthenticated attacker who knows a target user's AD SID or UPN can bypass authentication and assume that user's identity — including site administrators. Rapid7 has chained this with a separate RCE vulnerability for unauthenticated remote code execution. The RCE component will be patched in the August Patch Tuesday cycle; patching CVE-2026-55040 now breaks the full chain. Full technical details will be published within 30 days.
Lifecycle note: SharePoint Server 2016 and 2019 reached end of extended support today (July 14, 2026). No ESU is available — only SharePoint Subscription Edition remains supported.
Action: Prioritize AD FS patching (CVE-2026-56155) and SharePoint updates (CVE-2026-56164, CVE-2026-55040). The Rapid7 SharePoint auth bypass + pending RCE chain makes unpatched SharePoint servers an urgent target.
-
-
update from cisa.gov
CISA KEV: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability (CVE-2026-56155)
cisa.gov · 92d ago · July 14th, 2026
CISA added CVE-2026-56155 to the Known Exploited Vulnerabilities catalog on July 14, 2026, one day before this story was first seen, describing an insufficient granularity of access control flaw in AD FS that lets an authorized attacker elevate privileges locally (CWE-1220). The entry assigns a federal patch deadline of July 28, 2026, marks known ransomware campaign use as Unknown, and unusually links Microsoft's AD FS decommissioning guide alongside the MSRC advisory in its notes.
-
update from cisa.gov
CISA KEV: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability (CVE-2026-56164)
cisa.gov · 92d ago · July 14th, 2026
The entry is flagged for forensic triage under CISA's BOD 26-04 guidance and links the MSRC advisory and NVD record.
-
update from nvd.nist.gov
NVD: CVE-2026-56155 Detail (Microsoft AD FS elevation of privilege)
nvd.nist.gov · 91d ago · July 14th, 2026
The record carries a CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:L/UI:N, and references the Microsoft MSRC update guide as its source.
-
update from cybersecurefox.com
CVE-2026-56155: exploited AD FS vulnerability 🔗 https:// cybersecurefox.com/en/cve-2026 -56155-ad-fs-privilege-escalation-exploited # CVE -2
cybersecurefox.com · 11d ago · October 2nd, 2026
CVE-2026-56155: exploited AD FS vulnerability 🔗 https:// cybersecurefox.com/en/cve-2026 -56155-ad-fs-privilege-escalation-exploited # CVE -2
via Mastodon https://cybersecurefox.com/en/cve-2026-56155-ad-fs-privilege-escalation-exploited