Vulnerabilities of note<\/p>\n
CVE-2026-56155 is an EoP flaw affecting Active Directory Federation Services (ADFS), and has been spotted being exploited in the wild by Microsoft\u2019s incident responders. <\/p>\n
Fixes for it have been bundled<\/a> into Windows and Windows servers updates, and Microsoft also announced<\/a> it\u2019s started hardening the Access Control List (ACL) on the AD FS Distributed Key Manager container.<\/p>\n \u201c[This vulnerability] stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they\u2019re in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly,\u201d commented<\/a> Dustin Childs, head of threat awareness at TrendAI\u2019s Zero Day Initiative.<\/p>\n CVE-2026-56164 is an EoP flaw found in Microsoft SharePoint Server that has been reported by Google\u2019s incident responders and an anonymous researcher. It\u2019s remotely exploitable in low-complexity attacks, and attackers are already taking advantage of it.<\/p>\n While enabling the Antimalware Scan Interface (AMSI) feature on SharePoint servers is noted<\/a> as a possible mitigation, implementing security updates is the better option, especially because they fix additional SharePoint remote code execution vulnerabilities (CVE-2026-50522 and CVE-2026-58644) and a critical security feature bypass flaw (CVE-2026-55040). <\/p>\n \u201cDiscovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, and published (\u2026) in coordination with Microsoft, [CVE-2026-55040] is the first in a pair of exploits which, when chained together, can lead to unauthenticated remote code execution against a vulnerable SharePoint server,\u201d commented Adam Barnett, Principal Software Engineer at Rapid7.<\/p>\n The second vulnerability in the full RCE chain remains embargoed for now, and Microsoft is expected to publish patches for it in August 2026, he added<\/a>.<\/p>\n In other developments, the US Cybersecurity and Infrastructure Security Agency (CISA) has urged<\/a> organizations running SharePoint servers to apply additional hardening measures, in light of the fact that attackers are also exploiting two recently patched vulnerabilities (CVE-2026-32201 and CVE-2026-45659<\/a>).<\/p>\n CVE-2026-50661 is a Windows BitLocker security feature bypass vulnerability that has been disclosed but not (yet) actively exploited. <\/p>\n \u201cWhile not confirmed at this time, this CVE may be the patch for GreatXML, a BitLocker bypass exploit released by the Nightmare-Eclipse persona,\u201d Crowdstrike noted<\/a>.<\/p>\n Security patching in the age of AI-assisted vulnerability discovery<\/p>\n The flood of new vulnerabilities was expected and pre-announced<\/a>, as Microsoft recently confirmed it\u2019s been using AI to speed up internal discovery of software vulnerabilities. <\/p>\n The company also noted that other security researchers and attackers have been doing the same.<\/p>\n \u201cIf you\u2019re not delivering critical quality updates with security fixes until a couple of weeks after they\u2019ve been issued, that\u2019s ample time for attackers using AI to find and exploit known security gaps,\u201d Microsoft said. <\/p>\n \u201cTo address this, we\u2019ve updated our recommendations for deploying Windows updates to less than three days as the deferral period for quality updates, setting deadlines for those updates to zero or one day, and the update grace period to a maximum of two days.\u201d<\/p>\n Satnam Narang, senior staff research engineer at Tenable, also pointed out that the state of the Exploitability Index (how likely a vulnerability is to be exploited) must shift with the machine speed of discovery. <\/p>\n \u201cFor example, Microsoft originally tagged CVE-2026-45659, a SharePoint vulnerability, as exploitation less likely. However, the vulnerability was added to the CISA KEV on July 1,\u201d he noted. <\/p>\n \u201cAnthropic\u2019s Red Team\u2019s own findings for known vulnerabilities (n-days) revealed how fragile this system has become, with its Mythos Preview model being able to produce proof-of-concept exploits for 13 of 14 vulnerabilities that were rated \u2018Exploitation Less Likely\u2019 or \u2018Exploitation Unlikely.\u2019 What this means is that our way of looking at Patch Tuesday has changed, because the exploitability index is centered around humans, not AI tools, and as these tools continue to improve, defense needs to improve alongside it.\u201d<\/p>\n
![](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/devider.webp\"\/)
<\/p>\n