Microsoft's record-breaking July 2026 Patch Tuesday fixed 570 to 622 vulnerabilities across its ecosystem, but two flaws demand immediate attention: CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in Active Directory Federation Services (AD FS). Both were actively exploited as zero-days before patches landed on July 14, 2026. CISA added them to the Known Exploited Vulnerabilities catalog with a July 19 deadline for federal agencies, and Microsoft credited incident response teams from Mandiant, Google Cloud's FLARE OTF, and Microsoft's own DART for uncovering the attacks.

If you administer on-premises SharePoint or AD FS, these are not routine patches — they are emergency updates.

Vulnerability Details

CVE-2026-56164: SharePoint Server Elevation of Privilege

Attribute	Value
CVSS 3.1	9.8 (Critical)
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	None (PR:N)
User Interaction	None (UI:N)
Scope	Unchanged (S:U)
Impact	High Confidentiality, Integrity, Availability (C:H/I:H/A:H)
CWE	CWE-284: Improper Access Control

Affected versions:

• Microsoft SharePoint Server Subscription Edition
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Enterprise Server 2016

Root cause: Missing authentication for a critical function in SharePoint Server. An unauthenticated attacker can send specially crafted requests to elevate privileges over the network without any user interaction. Microsoft describes it as "Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network."

Exploitation in the wild: Credited to Jayson Frost (Mandiant Incident Response), Genwei Jiang (Google Cloud, FLARE OTF), and an anonymous researcher. The involvement of Mandiant and Google's FLARE team indicates sophisticated threat actor activity — likely espionage or targeted intrusion rather than opportunistic scanning.

CVE-2026-56155: Active Directory Federation Services Elevation of Privilege

Attribute	Value
CVSS 3.1	8.8 (High)
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	Low (PR:L)
User Interaction	None (UI:N)
Scope	Unchanged (S:U)
Impact	High Confidentiality, Integrity, Availability (C:H/I:H/A:H)
CWE	CWE-269: Improper Privilege Management

Affected versions:

• Windows Server 2025
• Windows Server 2022
• Windows Server 2019
• Windows Server 2016

Root cause: Insufficient granularity of access control in AD FS. An authenticated attacker with low privileges can elevate to administrative rights locally on the AD FS server. Microsoft warns: "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally."

Exploitation in the wild: Credited to Jeremy Kingston and Scott Clark of Microsoft Detection and Response Team (DART). DART is Microsoft's elite incident response unit — their involvement confirms this was discovered during active breach investigations.

Impact Assessment

What's at Risk

CVE-2026-56164 (SharePoint):

• Full compromise of on-premises SharePoint farms
• Theft of sensitive documents, intellectual property, PII
• Lateral movement via SharePoint's integration with Active Directory, SQL Server, and IIS
• Persistence through IIS machine key theft and deserialization chains (CISA notes attackers harvest IIS machine keys and use deserialization for persistence)
• Potential pivot to cloud via Microsoft 365 hybrid configurations

CVE-2026-56155 (AD FS):

• Administrative control of the federation service
• Ability to issue forged SAML/OIDC tokens for any relying party (Microsoft 365, Azure, third-party SaaS)
• Identity provider compromise = kingdom keys to every federated application
• Golden SAML-style attacks without needing domain controller access

The SharePoint 2016/2019 EOL Multiplier

SharePoint Server 2016 reached end of support on July 14, 2026 — the same day as this Patch Tuesday. SharePoint 2019 enters extended support but will not receive security updates beyond 2026. Organizations still on these versions face a brutal choice: emergency patch now, then migrate immediately, or accept unpatched critical exposure. Microsoft's July 2026 Security Update Review explicitly calls out this "end-of-support collision."

Affected Systems: Who Needs to Act

Immediate action required if you run:

• Any on-premises SharePoint Server (Subscription Edition, 2019, 2016)
• AD FS on Windows Server 2016, 2019, 2022, or 2025
• Hybrid identity configurations (AD FS federating Microsoft 365/Azure AD)

Lower priority (cloud-only):

• Microsoft 365 / SharePoint Online — patched by Microsoft
• Microsoft Entra ID (formerly Azure AD) — not affected
• Azure AD Connect — not affected unless AD FS is in the chain

Mitigation & Patching: Step-by-Step

1. Apply the July 2026 Security Updates Immediately

For SharePoint Server:

• Download the appropriate patch for your version from the Microsoft Update Catalog
• Subscription Edition: KB5002698 (or latest CU)
• SharePoint 2019: KB5002697
• SharePoint 2016: KB5002696 (final security update — migrate after applying)
• Run the SharePoint Products Configuration Wizard after installation (psconfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures)

For AD FS:

• Windows Server 2025/2022/2019: Install the July 2026 LCU (Latest Cumulative Update) via Windows Update or WSUS
• Windows Server 2016: Install KB5039997 (or latest LCU)
• Restart the AD FS service after patching: Restart-Service adfssrv

2. Enable AMSI Full Mode on SharePoint (Critical Mitigation)

CISA and Microsoft both emphasize this: Enable Antimalware Scan Interface (AMSI) integration and set Request Body Scan mode to Full.

This mitigates deserialization-based post-exploitation (the "machine key theft -> deserialization -> persistence" chain CISA warns about).

3. Rotate IIS Machine Keys Immediately

If you suspect compromise, rotate machine keys on all SharePoint WFEs and application servers:

4. Block Internet Exposure of SharePoint Central Admin

CISA guidance: "Avoid exposing SharePoint Servers directly to the internet unless necessary. Block external access to SharePoint Central Administration."

5. Harden AD FS

• Restrict AD FS management endpoints to dedicated admin workstations
• Enable AD FS audit logging: Set-AdfsProperties -AuditLevel Verbose
• Review federation trust certificates — rotate if compromise suspected
• Consider migrating to Microsoft Entra ID (cloud auth) to eliminate on-prem AD FS attack surface

Detection: How to Tell If You're Compromised

SharePoint Indicators (CVE-2026-56164)

1. Unusual authentication patterns in ULS logs:

2. IIS machine key access anomalies:

3. Deserialization gadget chains (post-exploitation):

AD FS Indicators (CVE-2026-56155)

1. Privilege elevation in AD FS event logs:

2. Suspicious token issuance:

3. Golden SAML precursor activity:

Network-Level Detection (Suricata)

YARA Rules for Post-Exploitation Artifacts

Frequently Asked Questions

Q: Are SharePoint Online and Microsoft 365 affected?

A: No. Microsoft patched the cloud equivalents internally. These CVEs only affect on-premises SharePoint Server and AD FS running on Windows Server.

Q: My SharePoint 2016 is end-of-life. Should I still patch?

A: Yes. Microsoft released a final security update for SharePoint 2016 on July 14, 2026. Apply it immediately, then plan migration to Subscription Edition or Microsoft 365. Running unpatched SharePoint 2016 after July 2026 is negligent.

Q: Can I mitigate without patching?

A: Partially. For SharePoint, enabling AMSI Full Mode and blocking internet exposure reduces risk significantly. For AD FS, restricting management access helps. But patching is the only complete fix — both vulnerabilities allow bypass of these mitigations under certain conditions.

Q: How do I know if I was already compromised?

A: Check for the indicators above: anomalous ULS log entries, modified machine keys, unexpected AD FS configuration changes, tokens issued to unusual relying parties. Engage your IR team or Microsoft DART if you find evidence.

Q: Does this affect Azure AD Connect or Pass-Through Authentication?

A: No. These CVEs are specific to on-premises AD FS federation and SharePoint Server. Cloud authentication methods (PTA, Password Hash Sync, Entra ID) are not affected.

Q: What about the Rapid7 CVE-2026-55040 JWT bypass?

A: That's a separate vulnerability chain disclosed July 13, 2026 (Pwn2Own Berlin entry). The authentication bypass (CVE-2026-55040) is patched in July; the RCE component awaits August Patch Tuesday. If you patched July 14, the chain is broken — but apply August patches immediately.

Q: Why did Microsoft credit Mandiant, Google FLARE, and DART?

A: These are incident response teams. Their involvement means the vulnerabilities were discovered during active breach investigations, not through routine bug bounty reports. This signals real-world targeting by capable threat actors.

Key Takeaways

1. Patch now. These are not theoretical — they are weaponized zero-days with IR team attribution. The July 19 CISA deadline for federal agencies is your timeline too.
2. SharePoint 2016 is dead. July 14 was its last security update. Migrate or isolate immediately.
3. AMSI Full Mode is non-optional. It breaks the deserialization persistence chain CISA documented.
4. AD FS is a high-value target. Compromise = forged tokens for every federated app. Consider cloud migration (Entra ID) to eliminate this attack surface entirely.
5. Rotate machine keys and certificates after patching if you cannot rule out prior compromise.
6. Monitor for the detection patterns above — exploitation leaves traces in ULS logs, IIS logs, AD FS audit logs, and network traffic.

Conclusion

July 2026 Patch Tuesday will be remembered for the scale (570–622 CVEs) and the AI-assisted discovery pipeline Microsoft deployed. But for defenders, the story is two actively exploited zero-days in identity and collaboration infrastructure: CVE-2026-56164 (SharePoint, unauthenticated, CVSS 9.8) and CVE-2026-56155 (AD FS, authenticated local EoP, CVSS 8.8). Both were found by elite incident responders during live attacks.

The patches are available. The mitigations are documented. The detection rules are written. The only remaining variable is how fast you deploy them.

---

Sources:

• Microsoft Security Update Guide: CVE-2026-56164
• Microsoft Security Update Guide: CVE-2026-56155
• BleepingComputer: Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days
• The Hacker News: Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
• CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog
• CISA: CISA Urges SharePoint Hardening After New Exploitations
• Rapid7: CVE-2026-55040 Microsoft SharePoint JWT Token Authentication Bypass
• Cisco Talos: Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities