Microsoft July 2026 fixes two exploited flaws
Microsoft's July 2026 security update fixes two flaws attackers were already exploiting: one in Active Directory Federation Services (AD FS) and one in SharePoint Server. Together they let attackers take over the systems that handle employee sign-on and store company documents.
- Severity
- Not scoredNo CVSS score recorded
- Fix
- Update available
- Affects
- Active Directory Federation Services+2 more
- Exploited
- Yes, in the wildListed by CISA
How it works
- On AD FS, an attacker who already has some network login can exploit weak permission checks to grab administrator rights on the federation server itself.
- On SharePoint, a critical server function skips checking for a login entirely, so anyone who can reach it over the network can gain elevated access with no credentials at all.
What to do
Check whether your organization runs on-premises AD FS or SharePoint Server and note which security update was last applied to those servers. Microsoft 365 and SharePoint Online in the cloud are not affected by these two flaws.
Install Microsoft's July 14, 2026 Patch Tuesday updates on affected AD FS and SharePoint Server machines right away, and if patching SharePoint must wait, enable AMSI with Request Body Scan mode set to Full as an interim mitigation.
Technical details
Affected software: Active Directory Federation Services, SharePoint Server, Windows BitLocker
CVE-2026-56155 is an elevation-of-privilege bug in AD FS caused by insufficient granularity of access control. An authenticated attacker can abuse it to gain administrator rights on the federation server and potentially tamper with authentication flows across the connected environment. CVE-2026-56164 is a missing-authentication flaw in SharePoint Server that lets an unauthenticated attacker elevate privileges over the network.
Both are in CISA's Known Exploited Vulnerabilities catalog. A third issue, CVE-2026-50661, a BitLocker bypass requiring physical access to read the system drive, was publicly disclosed but not confirmed exploited.