Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Microsoft security patch release for CVE-2026-56164

Security Patch Release
First reported
Last updated
Happening score
H score 11
2 unique sources, 4 articles

Summary

Hide ▲

Microsoft released a record 622-CVE Patch Tuesday that includes two exploited flaws in SharePoint Server and Active Directory Federation Services, raising urgency for identity and collaboration systems. The top-priority fixes are CVE-2026-56164 and CVE-2026-56155, both elevation-of-privilege bugs already being used in attacks. Microsoft also bundled additional updates across Windows, Office, Edge, Azure, Defender, and developer tools. The release matters because defenders must triage a much larger-than-usual update set while attackers can immediately focus on the flaws already in use.

Cases

Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response (5) Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response (5) Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response (5) Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response (5) Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response (5) Active SharePoint exploitation around CVE-2026-56164 drives patching and federal response (5)

Related Happenings

CISA Microsoft SharePoint hardening guidance for exploited zero-days

Advisory/Mitigation
H score56 First: 15.07.2026 17:07 Last: 15.07.2026 17:07 Sources 1

How related: The development comes as CISA warned of active exploitation of multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, that could enable threat actors to gain unauthorized access to on-premises instances.

About this happening: CISA’s Microsoft SharePoint servers hardening guidance responds to newly disclosed zero-day vulnerabilities that can be exploited remotely, creating immediate risk for sup...

Open Happening

Microsoft SharePoint Server actively exploited multi-CVE wave

Exploitation Wave
H score79 First: 15.07.2026 12:44 Last: 15.07.2026 12:44 Sources 1

How related: The development comes as CISA warned of active exploitation of multiple SharePoint Server vulnerabilities, including CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, and CVE-2026-58644, that could enable threat actors to gain unauthorized access to on-premises instances.

About this happening: SharePoint Server exploitation wave remains active across internet-exposed on-premises instances, with CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 used...

Open Happening

Microsoft Corp. security patch release for CVE-2026-56155

Security Patch Release
H score56 First: 14.07.2026 22:22 Last: 14.07.2026 22:22 Sources 1

How related: Patches for the flaw have been released as part of the Patch Tuesday updates released on July 14, 2026.

About this happening: Microsoft released July 2026 Patch Tuesday updates that close at least 570 security holes in Windows and other software, expanding the remediation burden for defen...

Open Happening

Microsoft Windows 10 KB5099539 extended security update

Security Patch Release
H score16 First: 14.07.2026 21:49 Last: 14.07.2026 21:49 Sources 1

About this happening: Microsoft released Windows 10 KB5099539, a security update bundle for Windows 10 ESU that rolls in July 2026 Patch Tuesday fixes for 570 vulnerabilities. The p...

Open Happening

Windows 11 KB5101650 and KB5099414 cumulative updates

Security Patch Release
H score27 First: 14.07.2026 20:41 Last: 14.07.2026 20:41 Sources 1

About this happening: Microsoft released Windows 11 KB5101650 and KB5099414 cumulative updates for 25H2/24H2 and 23H2, delivering the July 2026 Patch Tuesday fixes for 571 vul...

Open Happening

Timeline

  1. 14.07.2026 23:25 5 articles · 13d ago

    Microsoft ships record July Patch Tuesday with two exploited zero-days

    Initial Disclosure

    Microsoft released a record July Patch Tuesday covering 622 CVEs, including two already exploited elevation-of-privilege flaws in on-premises SharePoint Server and Active Directory Federation Services. The release pushes immediate remediation priority toward identity and collaboration infrastructure because the affected systems are core trust services.

    Show sources
    Open in new tab
  2. 14.07.2026 23:25 1 articles · 13d ago

    SharePoint Server and AD FS flaws expose privilege escalation paths

    Technical Analysis Update

    CVE-2026-56164 in on-premises SharePoint Server allows an unauthenticated attacker to escalate privileges over the network, while CVE-2026-56155 in Active Directory Federation Services allows an already-authenticated attacker to elevate privileges locally through weak access controls. Microsoft credits Mandiant incident responders, Google's FLARE team, and Microsoft's DART incident-response unit with the discoveries, pointing to active attack investigation around both flaws.

    Show sources
    Open in new tab
  3. 14.07.2026 23:25 1 articles · 13d ago

    Microsoft removes the Kerberos RC4 rollback switch

    Mitigation Patch Update

    Microsoft's July rollout removes the RC4DefaultDisablementPhase rollback switch, so RC4 works only for accounts explicitly configured to allow it. Administrators are told to audit RC4 usage, rotate passwords on flagged service accounts to generate AES keys, and patch before legacy services or clients lose authentication.

    Show sources
    Open in new tab