Microsoft Patch Tuesday July 2026: Two Zero-Days, and the CVSS 5.3 Is More Dangerous Than the 7.8

On July 14, 2026, Microsoft released its heaviest Patch Tuesday of the year, addressing 570 total CVEs. Among them, two actively exploited zero-days: CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in Active Directory Federation Services. Both are elevation-of-privilege vulnerabilities, both were discovered during real-world incident response, and neither has a risk profile that its CVSS score alone explains.

The Unexpected CVSS 5.3: SharePoint Without Authentication

According to the official CVE.org record, CVE-2026-56164 has a CVSS 3.1 score of 5.3 (Medium). The formula rates it this way because impact is limited to partial integrity (I:L), with no confidentiality or availability impact. But the attack vector is AV:N/AC:L/PR:N/UI:N: network, low complexity, no privileges required, no user interaction. In other words, anyone who can reach the server over the network can trigger the vulnerability.

The associated CWE is 306: Missing Authentication for Critical Function. The CVE record explicitly describes an attack allowing an unauthenticated attacker to elevate privileges via the network. The low formal severity masks an attack surface exposed to the internet, typical of on-premises installations of SharePoint Server 2019, Subscription Edition, and 2016/Enterprise 2016 versions.

According to Tech Insider, the gap between score and real-world risk is "the most important story buried in this release." SOC Prime confirms no public PoCs or detailed IOCs exist, which does not lessen the threat: active exploitation is documented by CISA and ZDI without the need for an accessible proof-of-concept.

AD FS: The Hardest Bone in Identity Infrastructure

CVE-2026-56155 carries CVSS 7.8 (High) and is classified as CWE-1220: Insufficient Granularity of Access Control. The vector is AV:L/PR:L/UI:N: local access, low privileges required, no user interaction. The difference from the first CVE is the foothold: here the attacker must already have a foothold on the AD FS machine.

The target is the Distributed Key Manager container, the component that manages cryptographic material for identity federation. According to Tech Insider, "a privilege escalation bug there isn't a secondary problem. It's a skeleton key." The NVD's SSVC classification rates exploitation as "active" and technical impact as "total": automation is not possible, but once the attacker is inside, control is total.

Microsoft credited its own DART (Detection and Response Team) with Jeremy Kingston and Scott Clark. Tech Insider emphasizes that "DART researchers find vulnerabilities while responding to active breaches, not while hunting for bugs in a lab." The full quote is unequivocal: "That strongly suggests real customers were already compromised before Microsoft understood what hit them."

"DART is an incident-response unit. Its researchers typically find vulnerabilities while responding to active breaches, not while hunting for bugs in a lab. That strongly suggests real customers were already compromised before Microsoft understood what hit them."

Score-Risk Misalignment: Why the Medium Is More Urgent

CVSS 3.1 measures technical severity of impact, not exploitation likelihood or asset criticality. CVE-2026-56164 has "Medium" impact because the formula rewards the lack of confidentiality and availability impact: only partial integrity. But the combination of remote access, no credentials required, and no user interaction makes it operationally more dangerous than the local 7.8.

For organizations with exposed SharePoint Server, the 5.3 means automated priority filters might deprioritize the patch. That is a costly mistake: CISA has mandated U.S. federal agencies to patch by July 28, 2026, just 14 days after release. The window is short because exploitation has already occurred in-the-wild, even if the precise start date is undocumented.

For CVE-2026-56155, the 7.8 helps prevent underestimating the patch, but the local access requirement makes it less urgent for the first line of defense. It becomes critical the moment an attacker has already compromised an endpoint: from there, AD FS escalation opens SSO, federated trust, and access to hybrid cloud resources.

What to Do Now

Microsoft released patches on July 14, 2026. For both CVEs, the priority is timely remediation, but with different nuances:

• Patch on-premises SharePoint Server immediately, regardless of the CVSS 5.3 score: the remote, unauthenticated attack surface admits no delay.
• Apply the AD FS fix, which includes hardening ACLs on the Distributed Key Manager container, in addition to the binary patch.
• Verify that SharePoint systems are not directly exposed to the internet without perimeter access controls, even though the vulnerability affects the application itself.
• Enable AMSI Full Mode on SharePoint as an additional complementary control to patching, per SOC Prime's recommendation.

For U.S. federal agencies, the CISA deadline of July 28, 2026 is binding. For the private sector, supply chain pressure and documentation of active exploitation make the timeline equally stringent.

When Risk Isn't in the Number

The July 2026 Patch Tuesday highlights a systemic problem in vulnerability management: CVSS as an automatic priority filter. CVE-2026-56164 demonstrates that a medium score can hide the most dangerous entry path, one that requires no credentials or interaction. CVE-2026-56155 demonstrates that a high score becomes explosive when it sits in the wrong component: identity infrastructure.

Discovery by incident response teams, not proactive research, is the most relevant signal. It means attackers had already mapped these vulnerabilities and were exploiting them before Microsoft recognized them. The delay between exploitation and patch is unknown; the fact that remains is that defenses had already been breached.

The dossier does not specify whether the two CVEs were used in a chain by the same actor or in separate campaigns. The relationship is hypothetical: the logical combination of remote entry via SharePoint and escalation via AD FS is plausible, but not documented in available sources. Until new evidence emerges, they remain two parallel stories with a common denominator: discovery during the fire, not before.

Frequently Asked Questions

Sources

• https://socprime.com/it/blog/cve-2026-56164-e-cve-2026-56155-analisi/
• https://socprime.com/blog/cve-2026-56164-and-cve-2026-56155-analysis/
• https://www.cve.org/CVERecord?id=CVE-2026-56164
• https://nvd.nist.gov/vuln/detail/CVE-2026-56155
• https://www.cve.org/CVERecord?id=CVE-2026-56155
• https://tech-insider.org/microsoft-patch-tuesday-july-2026-zero-days/
• https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review
• https://www.cve.org/CVERecord/UserGuide
• https://nvd.nist.gov/vuln
• https://nvd.nist.gov/vuln/categories
• https://nvd.nist.gov/vuln/data-feeds