Exploitation observed; activity peaked at 31 mentions and remains active
Immediate actions
Patch microsoft windows_10_1607 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-28. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Microsoft’s July 2026 Patch Tuesday delivers fixes for approximately 570 vulnerabilities across its product ecosystem, following June’s record-breaking release of 206 flaws that also included three publicly disclosed zero-days.
📌 CVE-2026-56164
📌 CVE-2026-56155
📌 CVE-2026-50661
This month’s rollout includes two Critical-rated Remote Code Execution bugs in SharePoint and Print Spooler, alongside dozens of Important-severity Elevation of Privilege and RCE issues affecting core Windows components.
#cybersecuritynews#microsoft#patchtuesday
Post summary
Microsoft Patch Tuesday released 570 fixes, including critical RCE vulnerabilities in SharePoint and Print Spooler.
Daniel's Daily Threat Intel & CVE Briefing (from claude)
Tue 15 Jul 2026
Top of the stack: Microsoft's July Patch Tuesday (14 Jul) is the day's priority — a record ~570 Microsoft CVEs with two actively-exploited zero-days, both privilege-escalation bugs in identity infrastructure (AD FS and SharePoint). Patch those two first. In parallel, CISA added a decades-old Cisco IOS CSRF flaw (CVE-2008-4128) to KEV on 13 Jul after confirmed exploitation — audit legacy IOS management planes. Three items are flagged actively-exploited today.
1. CISA KEV / Actively Exploited (lead)
CVE-2008-4128 — Cisco IOS CSRF → arbitrary command execution. Added to KEV 13 Jul 2026; confirmed in-the-wild exploitation of an 18-year-old flaw in the IOS web management interface. So what: internet-exposed or poorly-segmented IOS device web UIs are being abused for command execution — disable the HTTP(S) server or lock it behind ACLs. (SecurityAffairs, SC Media)
CVE-2026-56155 — Microsoft AD FS EoP (CVSS 7.8), actively exploited. Local privilege escalation via insufficient access-control granularity in AD FS (see MS section). (ZDI)
CVE-2026-56164 — Microsoft SharePoint EoP (CVSS 5.3), actively exploited. Missing authentication for a critical function, network-reachable, no user interaction. (BleepingComputer)
Same-week KEV wave (7–10 Jul), all exploited — worth confirming remediation if in scope: Adobe ColdFusion path traversal → RCE (CVE-2026-48282); Langflow auth-bypass/IDOR (CVE-2026-55255) — noted as the first AI-agent platform added to KEV; and Joomla-ecosystem file-upload/access-control bugs (JoomShaper SP Page Builder CVE-2026-48908, Joomlack CVE-2026-56290, Balbooa CVE-2026-56291, iCagenda CVE-2026-48939). (The Hacker News, SecurityWeek)
2. Edge / Network Gear
Quiet in the strict 24–48h window aside from the Cisco IOS KEV item above (CVE-2008-4128) — treat that as the actionable edge item today. No newly-corroborated critical Fortinet/Palo Alto/Citrix/Ivanti/SonicWall advisories published in the last day; the recent SecurityWeek Fortinet/Ivanti critical set (FortiSandbox CVE-2026-25089 CVSS 9.8, Ivanti Sentry CVE-2026-10520 CVSS 10.0) dates to mid-June and should already be in your patch cycle.
3. Microsoft / Windows / Active Directory
Patch Tuesday, 14 Jul 2026 — largest on record. ~570 Microsoft-issued CVEs (≈621 counting all republished/third-party CVEs addressed); 59–63 rated Critical, ~48 of them RCE. (Tenable, ZDI)
CVE-2026-56155 — AD FS EoP (7.8), exploited. Local EoP; high value in federated-identity environments. Patch AD FS servers first.
CVE-2026-56164 — SharePoint EoP (5.3), exploited. Unauthenticated, network-based privilege escalation via missing auth — SharePoint remains under sustained attack (distinct from the CVE-2026-45659 RCE added to KEV on 1 Jul). Patch on-prem SharePoint immediately.
CVE-2026-50661 — BitLocker security-feature bypass, publicly disclosed (not yet exploited). Requires physical access to reach encrypted data — relevant to lost/stolen-device and evil-maid threat models.
So what: two of the three zero-days are identity/domain-compromise primitives — sequence AD FS and SharePoint ahead of the broader 570-CVE backlog.
4. Web / Cloud / DevOps
Adobe ColdFusion CVE-2026-48282 (path traversal → RCE) and Langflow CVE-2026-55255 (auth-bypass IDOR — authenticated users can execute other users' flows) are both actively exploited and in KEV as of this week. If you run ColdFusion or Langflow (LLM/agent app builder), patch now. (http://Threat-Modeling.com)
Adobe's July batch also included a ColdFusion CVSS 9.9 issue (not yet exploited) — standard-priority patch. (ZDI)
No fresh corroborated Kubernetes/critical supply-chain 0-day in the 24h window; ongoing npm/PyPI credential-stealer campaigns continue as background noise.
Watch / developing
Langflow's KEV entry signals attackers are now hunting AI-agent/LLM orchestration platforms as an access vector — inventory any internet-exposed Langflow/agent tooling. Also watch the sheer triage load from the 570-CVE Patch Tuesday: with 48 critical RCEs, expect rapid PoC development over the coming days beyond the three flagged zero-days.
Sign-off: 3 items flagged as actively exploited today (CVE-2026-56155, CVE-2026-56164, CVE-2008-4128), with a cluster of 4–6 additional exploited KEV entries from earlier this week still worth confirming as patched.
Sources:
CISA — CVE-2008-4128 Cisco IOS added to KEV (SecurityAffairs)
ZDI — July 2026 Security Update Review
BleepingComputer — July 2026 Patch Tuesday, 3 zero-days
Tenable — July 2026 Patch Tuesday analysis
The Hacker News — Adobe/Joomla/Langflow KEV additions
SecurityWeek — CISA urges patching ColdFusion, Langflow, Joomla
http://Threat-Modeling.com — CVE-2026-55255 Langflow IDOR
SC Media — CISA adds Cisco IOS flaw to KEV
Post summary
The briefing confirms that CVE-2008-4128, CVE-2026-56155, and CVE-2026-56164 are being actively exploited in the wild and urges immediate patching of affected systems, while noting additional vulnerabilities in the KEV list that also require remediation.
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗹𝘆 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆
This month brings 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and an unusually high number of critical vulnerabilities - 𝟭𝟱 vulnerabilities scored 9.0 or higher.
𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀
🔸 CVE-2026-50661 – Windows BitLocker Security Feature Bypass
🔸 CVE-2026-56164 – Microsoft SharePoint Server Elevation of Privilege
🔸 CVE-2026-56155 – Active Directory Federation Services Elevation of Privilege
In 1-2 days subscribers also get intel whether the patches are safe to deploy or not. You can subscribe here:
https://horizon-secured.com/newsletter/
#PatchTuesday#CyberSecurity#ZeroDay#Vulnerability#Microsoft
Post summary
The post lists three zero‑day CVEs with brief descriptions and promises forthcoming intelligence on patch safety, but provides no PoC, exploit code, or evidence of active attacks.
Four CVEs (CVE-2026-15409, CVE-2026-15410, CVE-2026-56155, CVE-2026-56164) were added to CISA’s known‑exploited vulnerabilities catalog; two are confirmed to be exploited in the wild, detailed technical data is provided, but no public PoC or exploit code exists. Patches or mitigations are referenced via vendor advisories.
Microsoftは、Active Directory Federation Services（AD FS）に存在し、実際に悪用が確認されている権限昇格の脆弱性「CVE-2026-56155」の修正プログラムを公開した。認証済みの低権限ユーザーが管理者権限を取得できる恐れがあり、企業環境での優先的な適用を呼びかけている。
CVE-2026-56155は、AD FSのアクセス制御の粒度が不十分であることに起因する権限昇格の脆弱性で、Microsoftは重要度を「Important」とし、実際に悪用が確認されていると説明した。攻撃には対象ホストへの認証済みアクセスが必要だが、悪用されると機密性、完全性、可用性に影響を及ぼす可能性がある。
AD FSはシングルサインオンやフェデレーション認証で利用されるため、管理者権限を取得した攻撃者は、フェデレーション設定の変更や認証情報へのアクセス、セキュリティ機能の無効化、侵害したサーバーを起点としたネットワーク内への侵入に悪用できるという。
Microsoftは2026年7月14日に、Windows Server 2012、2012 R2、2016、2019、2022、2025やServer Core、影響を受けるコンポーネントを共有する一部のWindows 10向けに修正を公開した。管理者には更新プログラムの適用とビルド番号の確認に加え、ローカル管理者グループの変更やAD FSサーバー上の異常なプロセス、フェデレーション設定や認証関連イベントの監視を推奨している。
https://cybersecuritynews.com/active-directory-services-0-day-exploited/
Post summary
Microsoft issued a patch for CVE-2026-56155, a privilege‑elevation flaw in AD FS that has been actively exploited, urging immediate update and vigilant monitoring.
July 2026 Patch Tuesday drops 622 CVEs with three zero-days: SharePoint (CVE-2026-56164) and AD FS (CVE-2026-56155) are actively exploited and CISA KEV-listed.
#DFIR_Radar https://t.co/pLY8VaBF7d
Post summary
Two zero‑day CVEs—CVE-2026-56164 (SharePoint) and CVE-2026-56155 (AD FS)—are reported as actively exploited and listed in CISA KEV, coinciding with the release of Patch Tuesday updates.
今月気になるのは、既に悪用されていて今後も悪用されそうなADFSの権限昇格（CVE-2026-56155）、認証不要でのRDPのRCE（CVE-2026-56190）、あとはOWAでメール開くだけでスクリプト実行できる（CVE-2026-55008）は悪用されそうですね。
The July 2026 Security Update Review
https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review
Post summary
The post highlights that CVE-2026-56155, CVE-2026-56190, and CVE-2026-55008 have already been exploited, with no mention of PoC, exploit tools, or patches, but it does mention their technical nature.
AD FS just landed on CISA's KEV list. CVE-2026-56155 lets a local, low-priv attacker jump straight to admin; and researchers say it chains well with RCE for ransomware. Patch deadline: July 28
https://exploitgrid.net/blogs/cve-2026-56155-ad-fs-privilege-escalation-bug-is-already-being-exploited
#CVE#ADFS#CISAKEV#PatchTuesday
Post summary
CVE‑2026‑56155 is now on CISA’s KEV list, is reportedly being exploited in the wild, and a patch deadline of July 28 has been announced.
Microsoft has patched two vulnerabilities exploited in the wild in July’s Patch Tuesday release:
• CVE-2026-56164
• CVE-2026-56155
Both are now tracked in the KEVIntel feed.
Post summary
Microsoft issued patches for CVE-2026-56164 and CVE-2026-56155, which were reported to have been exploited in the wild, and the CVEs are now tracked in the KEVIntel feed.
Microsoft's July 2026 Patch Tuesday fixes 570 flaws. Zero-days CVE-2026-56155 and CVE-2026-56164 are exploited in the wild. Patch now.
#PatchTuesday#Microsoft#ZeroDay#CVE#CyberSecurity
http://securityonline.info/july-2026-patch-tuesday/
Post summary
Microsoft’s July 2026 Patch Tuesday issued 570 fixes, including the zero-days CVE‑2026‑56155 and CVE‑2026‑56164, which are claimed to be actively exploited in the wild and are now patched.
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik#GüvenlikBülteni
Merhaba #Brolyz
🎯 Zafiyet Bilgisi
Ürün: #Microsoft Active Directory Federation Services (AD FS)
#Zafiyet: Yerel Yetki Yükseltme (Local Privilege Escalation)
CVE: CVE-2026-56155
Zafiyet Türü: Yetersiz Erişim Kontrolü Ayrıntısı / Granülerliği (CWE-1220)
Fidye Yazılımı İlişkisi: Şu an için bilinmiyor.
📌 Zafiyet Özeti
Microsoft Active Directory Federation Services (AD FS) üzerinde, erişim kontrollerindeki yetersiz ayrıntı seviyesinden (Insufficient Granularity of Access Control) kaynaklanan kritik bir güvenlik açığı tespit edilmiştir.
Bu zafiyet, sistem üzerinde zaten belirli yetkilere sahip bir saldırganın yerel yetki yükseltmesi (Local Privilege Escalation) gerçekleştirmesine olanak tanıyabilir. Başarılı bir istismar sonucunda saldırgan, sistem üzerinde daha yüksek ayrıcalıklarla işlem yapabilir.
🛡️ Önerilen Aksiyonlar
✅ Güvenlik Güncellemeleri
Microsoft tarafından yayımlanan güvenlik yamalarını ve önerilen hafifletici önlemleri (Mitigations) test ettikten sonra en kısa sürede canlı ortama uygulayın.
✅ Risk Yönetimi
Süreçlerinizi CISA'nın BOD 26-04 (Risk Tabanlı Güvenlik Güncellemelerinin Önceliklendirilmesi) ve adli bilişim triyaj gereksinimlerine uygun şekilde yönetin.
✅ Erişim Kontrolleri
AD FS sunucularının internet ve iç ağ erişimlerini gözden geçirin.
En Az Yetki (Least Privilege) prensibini uygulayarak kullanıcı ve servis hesaplarının yetkilerini sınırlandırın.
✅ Geçici Koruma Önlemleri
Uygulanabilir bir yama veya hafifletici önlem bulunmuyorsa, ilgili sistemlerin erişimini kısıtlayın veya risk değerlendirmesi doğrultusunda hizmeti geçici olarak devre dışı bırakmayı değerlendirin.
📚 Referans: Microsoft Security Response Center (MSRC)
Post summary
Microsoft AD FS local privilege escalation (CVE-2026-56155) has been disclosed with detailed technical information, and Microsoft’s security patches and mitigations are recommended for immediate deployment.
CVE-2026-56155 is an actively exploited AD FS flaw exposing token-signing keys — why patching alone isn't enough, and today's CISA deadline.
#microsoftsecurity#identityandaccessmanagement...Show more https://t.co/tP9PD7QkZ9
Post summary
The tweet reports that CVE‑2026‑56155 is actively exploited to expose token‑signing keys in AD FS, and notes that patching alone is insufficient to mitigate the risk before the CISA deadline.
Every organization still running on-premises AD FS for Microsoft 365 and Azure logins is exposed to a zero-day under active attack. CVE-2026-56155 lets a low-privilege foothold escalate to admin on the identity server. CISA flagged it July 14. Microsoft $MSFT shipped the fix. https://t.co/l21x49Gq5R
Post summary
CVE-2026-56155 is actively exploited to gain admin rights on on‑prem AD FS, but Microsoft has already released a patch.
CVE-2026-56155 is a critical vulnerability in Microsoft Active Directory Federation Services that is already being exploited in the wild, necessitating immediate action.
Active Directory 0-Day Alert
Microsoft has patched CVE-2026-56155, an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS).
https://cybersecuritynews.com/active-directory-services-0-day-exploited/
#CyberSecurity#Microsoft#ActiveDirectory#ADFS#ZeroDay#PatchTuesday https://t.co/4hx2AYrhPR
Post summary
Microsoft released a patch for CVE-2026-56155, an elevation-of-privilege flaw in AD FS that is currently being exploited in the wild, urging immediate remediation.
Centro Ciberseguridad Andalucía. CIAN@CentroCiberAND·
Patch
🚨 Nueva #AlertaSOC
Parches de julio de Microsoft corrigen más de 600 vulnerabilidades.
⚠️ CVE-2026-56155 (AD FS) y CVE-2026-56164 (SharePoint), ambas con explotación activa confirmada para escalada de privilegios.
👉 ¡Actualiza ya! https://lajunta.es/6ezwp
#CiberseguridadAND https://t.co/rVT6StMHWv
Post summary
The tweet warns that two Microsoft CVEs (2026-56155 and 2026-56164) are actively exploited for privilege escalation, urging users to apply July patches.
Read the full story👇
https://hackernoon.com/cve-2026-56155-the-actively-exploited-ad-fs-flaw-that-hands-over-your-identity-keys
Post summary
The post highlights that CVE‑2026‑56155 is an actively exploited flaw affecting AD FS that leaks identity keys, but no PoC, exploit code, patch, or detailed technical analysis is provided.
⚠️ ثغرة يوم صفري في نظام تسجيل دخول مايكروسوفت تمنح صلاحيات المدير وتُستغل الآن.
المعرّف :
CVE-2026-56155
درجة الخطورة :
7.8 (CVSS) - High
المنتج :
Active Directory Federation Services
الحل :
July 2026 Patch Tuesday
#ADFS#CVE202656155
Post summary
CVE‑2026‑56155, a high‑severity RCE in Microsoft ADFS, is reportedly being exploited in the wild and a patch is slated for July 2026.
🚨 HIGH - AD FS privilege escalation via coarse access controls (CVE-2026-56155)
CVE-2026-56155 is an access control weakness in Microsoft Active Directory Federation Services (AD FS) where authorization checks lack sufficient granularity in the AD FS service/admin surfaces. The root cause is improper access control/authorization design that allows overly broad permissions to be applied or enforced. An attacker who already has authorized local access can abuse these permissive controls to perform actions beyond their intended role, elevating privileges under specific configuration/role assignment conditions. If exploited, this can enable privilege escalation leading to compromise of AD FS operations and downstream identity trust, impacting confidentiality, integrity, and availability across federated authentication flows.
👉 Affected: Microsoft AD FS (versions not specified) | Upgrade to vendor-fixed build when available (apply latest cumulative updates immediately)
Post summary
An advisory warns of an AD FS access‑control flaw that permits privilege escalation and instructs to apply the latest vendor‑fixed cumulative updates immediately.
Microsoft patches critical AD FS privilege escalation flaw CVE-2026-56155, adds four new KEV Catalog entries
https://ift.tt/cFe9pYk
Post summary
Microsoft issued a patch for the AD FS privilege escalation vulnerability CVE‑2026‑56155, which was added to the KEV catalog, indicating it has been actively exploited.
