Microsoft’s July 2026 Patch Tuesday fixed a record 570 vulnerabilities, including three zero-days, two of them already exploited in the wild. The exploited pair sits in enterprise identity infrastructure: CVE-2026-56155 in Active Directory Federation Services and CVE-2026-56164 in SharePoint Server. Days earlier CISA warned that multiple SharePoint flaws are under active exploitation with no patch expected until August, urging emergency hardening. For ransomware crews that live on lateral movement, exploited bugs in identity systems are the most valuable kind.
What did July Patch Tuesday fix?
Microsoft addressed 570 flaws, its largest single release on record, with 59 rated critical and 145 enabling remote code execution. Three were zero-days. Two were under active attack before a patch existed: an elevation-of-privilege flaw in AD FS (CVE-2026-56155) and a missing-authentication flaw in SharePoint Server (CVE-2026-56164). A third, a BitLocker security-feature bypass requiring physical access (CVE-2026-50661), was publicly disclosed but not seen exploited.
Why identity zero-days matter to ransomware
AD FS and SharePoint are not ordinary applications. AD FS brokers authentication across an organization; compromise it and an attacker can forge access to federated services. SharePoint is a document hub that often sits at the center of a network with broad permissions. Both are prime lateral-movement and privilege-escalation targets, exactly the phase where ransomware operators turn a single foothold into domain-wide control. An exploited EoP bug in AD FS is a shortcut past the hardening most defenders spend years building. For that work, see our guide to Active Directory hardening.
The SharePoint problem CISA flagged
Separately from Patch Tuesday, CISA warned mid-week that on-premises SharePoint Server flaws are under active exploitation, with attackers stealing IIS machine keys and chaining bugs for persistent access. Crucially, CISA said a fix is not expected until August, so it urged organizations to mitigate rather than wait: enable AMSI, rotate IIS machine keys, hunt for artifacts, and pull SharePoint off the public internet. This echoes the 2025 ToolShell wave that fed ransomware deployment, and researchers note attackers now weaponize disclosed flaws within 24 to 72 hours.
What defenders should do now
Patch the exploited AD FS and SharePoint zero-days first, ahead of the 570-flaw backlog. Where an internet-facing SharePoint server cannot be patched until August, apply CISA’s hardening steps immediately and treat any exposed instance as a hunt priority. Rotate machine keys after mitigating, because attackers who already grabbed them will keep their access through a patch. Prioritization is the whole game in a record-size release: not every one of 570 flaws is being exploited, but the two that are sit in your identity plane.
Frequently asked questions
How many vulnerabilities did July 2026 Patch Tuesday fix?
Microsoft fixed 570 flaws in its core July 2026 release, the largest on record, including 59 critical and 145 remote-code-execution vulnerabilities.
Which July 2026 zero-days are being exploited?
Two are under active attack: CVE-2026-56155, an elevation-of-privilege flaw in AD FS, and CVE-2026-56164, a missing-authentication flaw in SharePoint Server.
Is there a patch for the exploited SharePoint flaws?
CISA warned that fixes for some actively exploited on-premises SharePoint flaws were not expected until August 2026, so it urged hardening and mitigation in the meantime.
Why are AD FS and SharePoint flaws so dangerous?
Both sit at the center of enterprise identity and collaboration. Exploiting them enables privilege escalation and lateral movement, the phase where ransomware operators expand from one host to the whole domain.
What should I patch first?
Prioritize the two exploited identity zero-days and any internet-facing SharePoint server, then work through critical remote-code-execution flaws before the rest of the backlog.