Loading story…
Microsoft released its largest Patch Tuesday update on record, fixing roughly 570 to 622 Microsoft CVEs across Windows, Office, SharePoint Server, Exchange Server, SQL Server, Edge, Azure, Defender, and developer tools. The release included three zero-days, with CVE-2026-56155 in Active Directory Federation Services (AD FS) and CVE-2026-56164 in on-premises Microsoft SharePoint Server confirmed as exploited in the wild, while CVE-2026-50661 patched a publicly disclosed BitLocker security feature bypass requiring physical access. Microsoft and multiple security outlets said the surge in findings was partly driven by AI-assisted vulnerability discovery, while the broader update also addressed dozens of critical remote code execution flaws in services such as DHCP, Hyper-V, Office, Exchange, SQL Server, Copilot, and SharePoint.
U.S. agencies and industry groups elevated the urgency around SharePoint after CISA warned that attackers were actively exploiting CVE-2026-56164 alongside CVE-2026-32201 and CVE-2026-45659 against internet-exposed on-premises servers, enabling unauthorized access, remote code execution, theft of IIS machine keys, persistence, and malware deployment. CISA added the exploited AD FS and SharePoint flaws to its Known Exploited Vulnerabilities catalog and urged immediate remediation, while Microsoft recommended SharePoint hardening measures including AMSI integration with full request body scanning and stronger Defender protections; exposed identity systems, SharePoint farms, and other internet-facing Microsoft services were identified as the highest-priority patch targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
Microsoft released July 2026 security updates fixing five Important Windows Remote Desktop Protocol information disclosure vulnerabilities: CVE-2026-50445, CVE-2026-57982, CVE-2026-55003, CVE-2026-50497, and CVE-2026-57979. The flaws could expose sensitive process memory during remote sessions, and no public exploits or in-the-wild exploitation were reported at publication time.
The three exploited SharePoint vulnerabilities CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 were added to CISA's Known Exploited Vulnerabilities Catalog. Federal agencies were ordered under BOD 26-04 to secure systems affected by CVE-2026-56164 by July 17 or discontinue them if mitigations could not be applied.
CISA warned that attackers were actively exploiting three vulnerabilities in Internet-exposed on-premises Microsoft SharePoint Server instances: CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. The agency also highlighted CVE-2026-55040 and CVE-2026-58644 as attractive targets and urged immediate patching, AMSI and Defender protections, reduced Internet exposure, and reverse-proxy protections.
WaterISAC warned that multiple on-premises Microsoft SharePoint Server vulnerabilities were being actively exploited, citing CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164. The notice said attackers could steal IIS machine keys, gain persistence, and deploy malware, and it highlighted risks to utilities that use SharePoint for sensitive internal records.
Microsoft disclosed and fixed CVE-2026-50479, an elevation-of-privilege vulnerability in the Windows USB Hub Driver classified as CWE-822 with a CVSS score of 7.8. The Security Update Guide credited Adrian Denkiewicz of Doyensec, in collaboration with Claude and Anthropic Research, for reporting the issue.
Microsoft disclosed and patched CVE-2026-50661, a publicly known BitLocker security feature bypass vulnerability requiring physical access to a target device. Microsoft said it had not observed active exploitation in the wild and delivered fixes through the July 14 cumulative updates.
Microsoft disclosed CVE-2026-56164, a SharePoint Server elevation-of-privilege vulnerability caused by missing authentication for a critical function. Microsoft said the flaw had been exploited in the wild, released a fix, and recommended enabling AMSI with full request body scanning and IIS worker process memory scanning as mitigation.
Microsoft disclosed CVE-2026-56155, an Important elevation-of-privilege vulnerability in Active Directory Federation Services caused by insufficient granularity of access control. Microsoft said exploitation had been detected in the wild, functional exploit code was available, and a fix was available.
Microsoft released its July 2026 Patch Tuesday security updates, the largest Patch Tuesday on record, addressing roughly 570 to 622 Microsoft CVEs across Windows, Office, SharePoint, Exchange, SQL Server, Azure, and other products. The release included three zero-days, with CVE-2026-56155 in AD FS and CVE-2026-56164 in SharePoint confirmed as exploited in the wild, and CVE-2026-50661 in BitLocker publicly disclosed before patching.
The CVE record for CVE-2026-56164 was published, describing a SharePoint Server elevation-of-privilege flaw caused by missing authentication for a critical function and affecting SharePoint Server 2016, 2019, and Subscription Edition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecyberveille.ch
Open sourcecysecurity.news
Open sourcesocprime.com
Open sourcecwe.mitre.org
Open sourcerapid7.com
Open sourcelearn.microsoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released fixes for **163 vulnerabilities** in its April Patch Tuesday update, marking one of its largest security releases on record. The bundle includes **8 Critical** flaws, **154 Important** issues, and **1 Moderate** bug, with seven of the Critical vulnerabilities enabling remote code execution across products and components including **Windows TCP/IP**, **Windows IKE Service Extensions**, **Active Directory**, **Remote Desktop Client**, **Microsoft Office**, and **Microsoft Word**. Belgian authorities urged organizations to apply the updates immediately. The most urgent issues include **`CVE-2026-32201`**, an actively exploited **Microsoft SharePoint Server** vulnerability that was added to CISA’s Known Exploited Vulnerabilities catalog, and **`CVE-2026-33825`** in **Microsoft Defender**, a publicly disclosed zero-day tied to proof-of-concept code associated with the **BlueHammer** exploit. Microsoft also shipped Windows 11 cumulative updates with security hardening changes, including safer handling of **`.rdp`** files and improved visibility into **Secure Boot** certificates, while the broader patch set addressed numerous elevation-of-privilege and security feature bypass flaws that could support post-compromise escalation.
Jun 29, 2026
Microsoft released fixes for **165 vulnerabilities** across Windows, Office, SharePoint, Defender, SQL Server, Azure, .NET, and other products in one of its largest Patch Tuesday updates on record. The most urgent issue was **CVE-2026-32201**, an **actively exploited** improper input validation flaw in **SharePoint Server** that enables unauthenticated network-based spoofing and was immediately added to **CISA's Known Exploited Vulnerabilities** catalog. Microsoft also patched **CVE-2026-33825**, a publicly known **Microsoft Defender** privilege-escalation bug with proof-of-concept code, and **CVE-2026-33824**, a critical **remote code execution** flaw in **Windows IKE Service Extensions** affecting IPsec/VPN infrastructure. Researchers flagged **CVE-2026-33827** in **Windows TCP/IP** as potentially **wormable** under certain IPv6 and IPSec configurations. Other high-impact fixes include **CVE-2026-33120**, a **SQL Server remote code execution** flaw that paired with a separate privilege escalation bug (**CVE-2026-32176**) could enable full server compromise, and **CVE-2026-32220**, a **UEFI Secure Boot bypass** that could allow untrusted code to load during the boot process. The release also addressed elevation of privilege flaws across Desktop Window Manager, WinSock, TDI Translation Driver, Windows Push Notifications, Function Discovery Service, WSUS, Remote Desktop Licensing, Azure Monitor Agent, and Windows kernel components; security feature bypasses in Windows Hello, PowerShell, BitLocker, and Windows Shell; information disclosure bugs in Windows GDI, Print Spooler, Web Account Manager, UPnP Device Host, and the Windows kernel; and denial-of-service issues in .NET/Visual Studio and Windows RDBSS. Cumulative updates for Windows Server 2022 and 23H2 bundled security hardening for Kerberos, RDP, Secure Boot, and WDS, with Microsoft warning that Secure Boot certificates begin expiring in June 2026.
Jun 29, 2026
Microsoft released fixes for **163 CVEs** across 17 product families, including **8 Critical** vulnerabilities, **1 publicly disclosed** flaw, and **1 vulnerability under active exploitation**. The exploited issue, `CVE-2026-32201`, is a **Microsoft SharePoint Server spoofing vulnerability** that can let an unauthenticated attacker impersonate a user and read or modify certain data. Microsoft also patched `CVE-2026-33825`, a **publicly disclosed Microsoft Defender elevation-of-privilege flaw** that affects systems only when Defender is enabled; the company said customers using Defender automatic updates are remediated automatically. Among the most severe issues, Microsoft highlighted `CVE-2026-33824`, a **Critical Windows Internet Key Exchange (IKE) Service Extensions remote code execution vulnerability** with a **CVSS 9.8**, and advised defenders to restrict **UDP ports 500 and 4500** until patching is complete. Elevation-of-privilege bugs made up the largest share of the release with **94 CVEs**, while **Windows** accounted for **131** of the patched vulnerabilities. Microsoft said **24 flaws** were more likely to be exploited within 30 days, **18** carried CVSS scores of **8.0 or higher**, and the release also included **80 Edge-related advisories**, most inherited from Chrome.
Jun 29, 2026