The Microsoft store on Fifth Avenue in Midtown Manhattan is shown June 4, 2018 in New York City. Microsoft officially announced today an agreement to buy GitHub, a code repository company popular with software developers, for $7.5 billion in stock.
Getty images/Drew Angerer
Microsoft’s July 2026 Patch Tuesday arrived on July 14 as the largest security update in the company’s history — 622 CVEs, more than triple June’s prior record. Buried inside that volume are two vulnerabilities that matter more than the number: one in SharePoint Server that lets an unauthenticated attacker escalate privileges over the network without touching a credential or prompting a user interaction, and one in Active Directory Federation Services that lets an attacker who already has a low-privilege foothold seize administrator control over the box that signs every identity token in the organization.
Both bugs are being actively exploited right now. Federal civilian agencies face a government-mandated deadline of tomorrow — July 17 — to remediate the SharePoint flaw. For the AD FS bug, the federal deadline is July 28. Security teams that have not already deployed these patches are operating inside an active threat window, not a theoretical one.
The 622 CVEs matter — not as a number to file away, but as a structural signal about what Microsoft’s AI-powered discovery pipeline has already done to the monthly patch cadence. This is not a spike that will normalize next month. The volume is the new floor.
SharePoint Server Patch Cannot Wait: Unauthenticated Network Exploit Is Already in Use
CVE-2026-56164 is a missing-authentication vulnerability in on-premises SharePoint Server — covering SharePoint Server 2016, 2019, and the Subscription Edition — that allows an unauthenticated attacker to escalate privileges over the network. The technical class is CWE-306: Missing Authentication for Critical Function. No credentials. No user interaction. Remote.
Microsoft assigned the bug a CVSS score of 5.3, a “Moderate” rating that has drawn unanimous industry criticism. The National Vulnerability Database independently scored it 9.8 — Critical. Automox’s July 2026 patch analysis put the operational contradiction plainly: “Moderate severity and active exploitation are not the same thing. Don’t let the 5.3 talk you out of prioritizing it.” The disconnect is a known limitation of CVSS: the scoring system evaluates severity at a point in time and doesn’t adjust retroactively when active exploitation is later confirmed.
CISA’s advisory on the vulnerability is more precise about the attack pattern. Attackers are chaining CVE-2026-56164 with older, previously disclosed SharePoint weaknesses to steal Internet Information Services machine keys, establish persistence on compromised servers, and deploy malware. This is the same mechanical fingerprint as the ToolShell campaign of July 2025 — when Chinese nation-state actors Linen Typhoon, Violet Typhoon, and ransomware actor Storm-2603 exploited SharePoint at scale across finance, healthcare, government, and energy sectors. CISA added CVE-2026-56164 to its Known Exploited Vulnerabilities catalog on July 14, the same day patches shipped, and set a remediation deadline of July 17 for all Federal Civilian Executive Branch agencies.
Microsoft credits discovery to incident responders, including from Mandiant and Google’s FLARE team — a detail that signals the bug was found during active attacks rather than in a research environment. CISA’s recommended interim mitigation for organizations that cannot immediately patch: enable AMSI in Full Mode on SharePoint servers, which causes the Antimalware Scan Interface to scan POST request bodies before SharePoint processes them, intercepting malicious payloads in-flight.
SharePoint’s exploitation history makes this particularly acute. The ToolShell chain swept through unpatched on-premises servers in summer 2025. A separate SharePoint deserialization RCE — CVE-2026-45659 — was patched in an out-of-band release in May 2026; organizations that missed it remain exposed. Internet-facing, on-premises SharePoint installations should be treated as the first priority in this patch cycle, regardless of CVSS score.
There is also a compounding end-of-life factor. SharePoint Server 2016 and SharePoint Server 2019 reached end of extended support on July 14 — the exact day this patch was released. No further security updates will arrive for those versions. Organizations that cannot immediately migrate to SharePoint Server Subscription Edition are advised to remove those servers from direct internet exposure, enforce strict firewall rules, and treat the interim period as a sustained high-alert window.
Why an AD FS “Local” Privilege Bug Deserves Immediate Treatment as a Remote Threat
CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services, rated CVSS 7.8. Microsoft’s official description — “an authorized attacker to elevate privileges locally” — carries a modifier that can mislead. AD FS is not a typical file server or endpoint. It is the service that issues and signs the authentication tokens trusted by every application that federates to it: cloud services, SaaS platforms, on-premises applications. An attacker who reaches administrator on an AD FS host gains the ability to forge tokens and impersonate any user across every connected service, with no further authentication step required.
Microsoft’s own Detection and Response Team, known as DART, gets credit for discovery — and that credit matters operationally. DART is the company’s incident-response unit, called in when real attacks are already underway. DART finding this bug means Microsoft’s responders encountered it during a live intrusion investigation. CISA added CVE-2026-56155 to the KEV catalog alongside the SharePoint bug on July 14, and set the federal remediation deadline at July 28.
The combination ZDI notes as dangerous: CVE-2026-56155 paired with a remote code execution vulnerability makes for a ransomware delivery chain. An attacker who achieves code execution on a networked system can then pivot to an AD FS host using the access control gap, escalate to administrator, and from that position forge tokens for the entire federated estate. The blast radius extends well beyond the AD FS box.
BitLocker Bypass (CVE-2026-50661): Real Risk, Lower Queue Position
The third zero-day, CVE-2026-50661, is a protection mechanism bypass in Windows BitLocker that allows an unauthorized person with physical access to reach encrypted data stored on the device. Microsoft has not confirmed active exploitation. Tenable senior staff research engineer Satnam Narang suggested the disclosure may connect to a researcher known as Nightmare Eclipse or Chaotic-Eclipse, though no official attribution has been made.
Physical access is the meaningful operational constraint here. This vulnerability does not queue ahead of the two identity-infrastructure bugs for enterprise deployment. It does warrant prompt attention on laptops, shared workstations, and devices in environments with elevated physical security risk, where BitLocker is the primary protection against data exposure from theft or loss.
What Else Warrants Elevated Attention in 622 CVEs
Beyond the three zero-days, several vulnerabilities in this release carry characteristics that place them above routine:
CVE-2026-55040 (SharePoint JWT Authentication Bypass): Rapid7 Labs disclosed this during a Pwn2Own Berlin research entry. Rapid7 chained it to a separate, as-yet-unpatched remote code execution flaw to achieve unauthenticated RCE against a vulnerable server. The RCE component is not fixed in this release; Microsoft has scheduled the fix for August. Patching the July JWT bypass now breaks the exploit chain before an attacker can use it.
CVE-2026-57092 (Windows VMSwitch, CVSS 9.9): The highest-scored vulnerability in the release. Two additional SharePoint CVEs — CVE-2026-50522 and CVE-2026-58644 — score 9.8, both reachable without authentication or user interaction via deserialization of untrusted data.
CVE-2026-50518 and CVE-2026-56159 (Windows DHCP Server, CVSS 9.8): Buffer overflow vulnerabilities exploitable through malicious DHCP packets. DHCP infrastructure is often overlooked during patch prioritization because it lacks the visibility of internet-facing services, but DHCP servers process traffic from every networked device.
CVE-2026-56188 (Windows Server Network Driver, CVSS 9.8): Unauthenticated remote code execution via network traffic.
CVE-2026-55008 (Exchange Server / OWA, CVSS 9.6): A cross-site scripting flaw in Outlook Web Access that ZDI recommends treating as a stored XSS despite the “spoofing” label, because the practical attack path allows persistent JavaScript execution inside authenticated OWA sessions.
CVE-2026-56190 (Remote Desktop Protocol): An RCE vulnerability in the RDP stack exploitable via specially crafted network traffic. RDP servers exposed to the internet are a perennial target and a common ransomware entry vector.
Kerberos RC4 Removal: The Change With No Security Alert and No Recovery Path
Separate from the CVE list, but shipped as part of the July cumulative update, is a behavioral change that can produce authentication failures across enterprise environments without generating a single security alert: the permanent removal of the Kerberos RC4 rollback registry key.
The underlying vulnerability driving this change is CVE-2026-20833 — an information disclosure flaw that makes Kerberos service tickets encrypted with RC4 susceptible to offline brute-force attacks through a technique called Kerberoasting. Any authenticated domain user can request a service ticket for any account with a Service Principal Name (SPN). If that ticket is encrypted with RC4, an attacker can capture it without triggering alerts, take it offline, and crack the service account’s password using commodity GPU hardware. AES-encrypted tickets do not crack like that.
Microsoft rolled out the RC4 hardening in three stages:
January 2026: Audit mode added event IDs 201–209 in the domain controller System log, flagging every RC4-dependent authentication.April 2026: KDC moved to AES-only defaults for accounts with unset encryption type attributes. Authentication began failing for service accounts without AES key material.July 14, 2026: The RC4DefaultDisablementPhase registry key is permanently removed. Domain controllers no longer read that key. There is no rollback.
Service accounts with RC4-only key material — those with a blank or null msDS-SupportedEncryptionTypes attribute, or explicitly set to value 4 (RC4 only) — will now fail authentication with event ID 4769 failure code 0x19 (KDC_ERR_ETYPE_NOSUPP). This will surface as: SQL Server linked-server failures, broken application pool authentication under Windows auth, WMI and PowerShell remoting errors, and Java applications with rc4-hmac specified in krb5.ini.
The remediation sequence matters: audit DC Security Event Log for event IDs 4768 and 4769 with Ticket Encryption Type 0x17 (RC4) first, then reset passwords on flagged service accounts — which triggers AES key generation automatically — then deploy the July update. Deploying before auditing and remediation is the path to a 2 a.m. authentication outage. The change is not reversible after the update installs.
This is not an attacker-accessible vulnerability in this release. But a missed audit step produces the same operational impact as a ransomware-induced outage — silent, widespread, and with no quick fix available.
Why the Record Volume Is Not Going Away: What AI-Assisted Discovery Has Already Changed
Five days before this release, Pavan Davuluri, Microsoft’s executive vice president for Windows and Devices, told customers directly: expect permanently elevated patch volumes. The system behind that statement is MDASH — the Microsoft Security multi-model agentic scanning harness — which Microsoft’s Autonomous Code Security team built and deployed in production.
MDASH operates as a three-stage pipeline: 100+ specialized AI agents first build attack-surface models of the codebase, then specialized auditor agents debate candidate findings for exploitability, then a proving pipeline constructs proof-of-concept triggers to filter false positives before any finding reaches the engineering team. The system scored 88.45% on the public CyberGym benchmark at launch in May 2026 and reached 96.55% by Build 2026 three weeks later — a gain that reflects continuous model-panel refinement, not a fixed capability snapshot. In May, the pipeline surfaced 16 previously unknown vulnerabilities in Windows networking and authentication components on its own, including four Critical RCEs.
Microsoft has not attributed a specific number of July’s 622 CVEs to MDASH’s pipeline. Analysts correctly note that expanded code review coverage, broader product scope, coordinated disclosure volume, and accumulated remediation backlog all contributed to the record count. But the structural implication is not softened by those other factors: MDASH is a production-grade scanner running continuously. It does not pause between patch cycles. Its discovery rate is a function of the scanning system’s capability, not of how many vulnerabilities are remaining to find. The July release is not a one-time clearing of technical debt that will be followed by a return to 150-CVE months. It is, as Davuluri’s statement implies, a preview of what the program looks like when AI-assisted discovery runs at scale.
Shane Barney, chief information security officer at Keeper Security, put the operational consequence bluntly: “Patch programs designed around a manageable monthly queue cannot process hundreds of fixes quickly without risk-based prioritization as the foundation.” Security teams whose patch SLAs were built on the assumption of 100–200 CVEs per month are now operating on a structurally wrong baseline. The recalibration needed is not tactical — it is programmatic.
What Organizations Need to Do Now
The immediate priority is short:
First: Patch CVE-2026-56164 on every on-premises SharePoint instance, prioritizing those with direct internet exposure. Enable AMSI in Full Mode on all SharePoint servers immediately, regardless of patch status.
Second: Patch CVE-2026-56155 on AD FS servers. Given DART’s discovery during an active intrusion and the token-forging blast radius, treat this as equivalent urgency to the SharePoint bug.
Third: For organizations on SharePoint Server 2016 or 2019 that cannot immediately migrate: take those servers off the internet, enforce firewall isolation, and initiate migration planning as an active remediation priority, not a roadmap item.
Fourth: Before deploying the July cumulative update in Active Directory environments, run the RC4 audit on domain controllers — review Security event IDs 4768 and 4769 for Ticket Encryption Type 0x17. Reset passwords on any flagged service account to generate AES keys. Only then deploy the update. Discovering the audit was needed after the update is installed means discovering it during an outage.
Fifth: Review CISA’s federal deadlines as an industry signal even if you are not a federal agency. CISA’s threshold for KEV catalog entry is confirmed real-world exploitation — not elevated risk, not theoretical concern. Both bugs meet that bar.
Frequently Asked QuestionsWhat makes CVE-2026-56164 dangerous if Microsoft scored it only a 5.3?
CVSS scores describe a vulnerability’s theoretical severity under standardized conditions, but they are assigned at a specific point in time and don’t automatically update when active exploitation is later confirmed. CVE-2026-56164 requires no credentials and no user interaction, allows remote network access, and is already being used in active attacks — a combination that defines operational urgency regardless of the score. The National Vulnerability Database independently assessed it at 9.8. The National Institute of Standards and Technology’s guidance is explicit: exploit code maturity and confirmed exploitation status should override base CVSS scores in patch prioritization.
What happens to organizations still running SharePoint Server 2016 or 2019 after July 14?
Both versions reached end of extended support on July 14, 2026 — the same day this patch released. The July security update is the last patch either version will receive. Future vulnerabilities discovered in those codebases will not be fixed by Microsoft. Organizations that remain on those versions without network isolation are running software with a growing, permanent gap between discovered vulnerabilities and available patches.
What is Kerberos RC4 removal and why could it cause outages?
Kerberos is the authentication protocol Active Directory uses to verify identities across a Windows domain. RC4 is an older, weaker encryption algorithm that has historically been used to encrypt Kerberos service tickets. Attackers can request these encrypted tickets without triggering alerts, take them offline, and crack the service account’s password using modern GPU hardware — an attack known as Kerberoasting. Microsoft’s July update permanently removes the registry key that allowed administrators to roll back to RC4 behavior. Service accounts that never had AES encryption key material generated — typically those whose passwords were never reset in a modern Active Directory domain — will now fail authentication without warning. The failure is not a security breach; it is a configuration gap that the July update makes visible in the worst possible way.
What does Microsoft’s AI vulnerability scanner mean for enterprise patch programs going forward?
MDASH, Microsoft’s multi-model agentic scanning harness, is a production system running continuously against the Windows codebase. It does not pause between monthly cycles. The July 2026 record of 622 CVEs is not a one-time surge that will be followed by a return to lower monthly counts — it reflects the output rate of a system that runs at speed humans cannot match. Security teams whose patch capacity was sized for 100–200 CVEs per month are now operating against a larger surface than their programs were designed to handle. Risk-based prioritization — leading with active exploitation status, internet exposure, and infrastructure criticality rather than CVE count — is no longer an operational upgrade. It is a prerequisite.