Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-07-17. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Microsoft’s July 2026 Patch Tuesday delivers fixes for approximately 570 vulnerabilities across its product ecosystem, following June’s record-breaking release of 206 flaws that also included three publicly disclosed zero-days.
📌 CVE-2026-56164
📌 CVE-2026-56155
📌 CVE-2026-50661
This month’s rollout includes two Critical-rated Remote Code Execution bugs in SharePoint and Print Spooler, alongside dozens of Important-severity Elevation of Privilege and RCE issues affecting core Windows components.
#cybersecuritynews#microsoft#patchtuesday
Post summary
The tweet announces Microsoft’s July 2026 Patch Tuesday, detailing fixes for over 570 vulnerabilities, including two critical RCE bugs in SharePoint and Print Spooler, without providing PoC or exploit information.
Daniel's Daily Threat Intel & CVE Briefing (from claude)
Tue 15 Jul 2026
Top of the stack: Microsoft's July Patch Tuesday (14 Jul) is the day's priority — a record ~570 Microsoft CVEs with two actively-exploited zero-days, both privilege-escalation bugs in identity infrastructure (AD FS and SharePoint). Patch those two first. In parallel, CISA added a decades-old Cisco IOS CSRF flaw (CVE-2008-4128) to KEV on 13 Jul after confirmed exploitation — audit legacy IOS management planes. Three items are flagged actively-exploited today.
1. CISA KEV / Actively Exploited (lead)
CVE-2008-4128 — Cisco IOS CSRF → arbitrary command execution. Added to KEV 13 Jul 2026; confirmed in-the-wild exploitation of an 18-year-old flaw in the IOS web management interface. So what: internet-exposed or poorly-segmented IOS device web UIs are being abused for command execution — disable the HTTP(S) server or lock it behind ACLs. (SecurityAffairs, SC Media)
CVE-2026-56155 — Microsoft AD FS EoP (CVSS 7.8), actively exploited. Local privilege escalation via insufficient access-control granularity in AD FS (see MS section). (ZDI)
CVE-2026-56164 — Microsoft SharePoint EoP (CVSS 5.3), actively exploited. Missing authentication for a critical function, network-reachable, no user interaction. (BleepingComputer)
Same-week KEV wave (7–10 Jul), all exploited — worth confirming remediation if in scope: Adobe ColdFusion path traversal → RCE (CVE-2026-48282); Langflow auth-bypass/IDOR (CVE-2026-55255) — noted as the first AI-agent platform added to KEV; and Joomla-ecosystem file-upload/access-control bugs (JoomShaper SP Page Builder CVE-2026-48908, Joomlack CVE-2026-56290, Balbooa CVE-2026-56291, iCagenda CVE-2026-48939). (The Hacker News, SecurityWeek)
2. Edge / Network Gear
Quiet in the strict 24–48h window aside from the Cisco IOS KEV item above (CVE-2008-4128) — treat that as the actionable edge item today. No newly-corroborated critical Fortinet/Palo Alto/Citrix/Ivanti/SonicWall advisories published in the last day; the recent SecurityWeek Fortinet/Ivanti critical set (FortiSandbox CVE-2026-25089 CVSS 9.8, Ivanti Sentry CVE-2026-10520 CVSS 10.0) dates to mid-June and should already be in your patch cycle.
3. Microsoft / Windows / Active Directory
Patch Tuesday, 14 Jul 2026 — largest on record. ~570 Microsoft-issued CVEs (≈621 counting all republished/third-party CVEs addressed); 59–63 rated Critical, ~48 of them RCE. (Tenable, ZDI)
CVE-2026-56155 — AD FS EoP (7.8), exploited. Local EoP; high value in federated-identity environments. Patch AD FS servers first.
CVE-2026-56164 — SharePoint EoP (5.3), exploited. Unauthenticated, network-based privilege escalation via missing auth — SharePoint remains under sustained attack (distinct from the CVE-2026-45659 RCE added to KEV on 1 Jul). Patch on-prem SharePoint immediately.
CVE-2026-50661 — BitLocker security-feature bypass, publicly disclosed (not yet exploited). Requires physical access to reach encrypted data — relevant to lost/stolen-device and evil-maid threat models.
So what: two of the three zero-days are identity/domain-compromise primitives — sequence AD FS and SharePoint ahead of the broader 570-CVE backlog.
4. Web / Cloud / DevOps
Adobe ColdFusion CVE-2026-48282 (path traversal → RCE) and Langflow CVE-2026-55255 (auth-bypass IDOR — authenticated users can execute other users' flows) are both actively exploited and in KEV as of this week. If you run ColdFusion or Langflow (LLM/agent app builder), patch now. (http://Threat-Modeling.com)
Adobe's July batch also included a ColdFusion CVSS 9.9 issue (not yet exploited) — standard-priority patch. (ZDI)
No fresh corroborated Kubernetes/critical supply-chain 0-day in the 24h window; ongoing npm/PyPI credential-stealer campaigns continue as background noise.
Watch / developing
Langflow's KEV entry signals attackers are now hunting AI-agent/LLM orchestration platforms as an access vector — inventory any internet-exposed Langflow/agent tooling. Also watch the sheer triage load from the 570-CVE Patch Tuesday: with 48 critical RCEs, expect rapid PoC development over the coming days beyond the three flagged zero-days.
Sign-off: 3 items flagged as actively exploited today (CVE-2026-56155, CVE-2026-56164, CVE-2008-4128), with a cluster of 4–6 additional exploited KEV entries from earlier this week still worth confirming as patched.
Sources:
CISA — CVE-2008-4128 Cisco IOS added to KEV (SecurityAffairs)
ZDI — July 2026 Security Update Review
BleepingComputer — July 2026 Patch Tuesday, 3 zero-days
Tenable — July 2026 Patch Tuesday analysis
The Hacker News — Adobe/Joomla/Langflow KEV additions
SecurityWeek — CISA urges patching ColdFusion, Langflow, Joomla
http://Threat-Modeling.com — CVE-2026-55255 Langflow IDOR
SC Media — CISA adds Cisco IOS flaw to KEV
Post summary
The briefing highlights several CVEs that are actively exploited—particularly Microsoft AD FS and SharePoint privilege‑escalation bugs and a long‑standing Cisco IOS CSRF flaw—and urges immediate patching.
Running SharePoint?
There are at least 4 vulns you want to pay attention to:
CVE-2026-55040, CVE-2026-52522, CVE-2026-58644, CVE-2026-56164
unauthenticated RCE, exploits available etc.
https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review
Post summary
The post alerts SharePoint users to four new CVEs that enable unauthenticated remote code execution, noting that exploits exist but providing no specifics or patch information.
The text provides a link to an FAQ covering three SharePoint CVEs, but offers no additional information on PoC, exploits, active usage, patches, or technical details.
Still seeing substantial amounts of Microsoft SharePoint unpatched instances that have been added to @CISACyber Known Exploited Vulnerability catalog last few weeks. This includes CVE-2026-50522, CVE-2026-56164, CVE-2026-58644 with 878 IPs (1585 FQDNs) unpatched on 2026-07-23 https://t.co/SOfpB5bi3v
Post summary
The tweet reports that several Microsoft SharePoint instances remain unpatched and that CVE‑2026‑50522, 2026‑56164, and 2026‑58644 are listed in CISA’s Known Exploited Vulnerabilities catalog, indicating active exploitation.
🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗝𝘂𝗹𝘆 𝟮𝟬𝟮𝟲 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆
This month brings 𝟯 𝗻𝗲𝘄 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀 and an unusually high number of critical vulnerabilities - 𝟭𝟱 vulnerabilities scored 9.0 or higher.
𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀
🔸 CVE-2026-50661 – Windows BitLocker Security Feature Bypass
🔸 CVE-2026-56164 – Microsoft SharePoint Server Elevation of Privilege
🔸 CVE-2026-56155 – Active Directory Federation Services Elevation of Privilege
In 1-2 days subscribers also get intel whether the patches are safe to deploy or not. You can subscribe here:
https://horizon-secured.com/newsletter/
#PatchTuesday#CyberSecurity#ZeroDay#Vulnerability#Microsoft
Post summary
Three zero‑day vulnerabilities have been disclosed—CVE-2026-50661, CVE-2026-56164, and CVE-2026-56155—with brief technical details, and subscribers will receive patch deployment guidance shortly.
The post announces that four CVEs have been confirmed as exploited in the wild by CISA, provides detailed technical and impact information, and lists available vendor patches and hardening guidance.
SharePoint's JWT token validation pipeline just became the latest example of a pattern we keep seeing: authentication bypass through chained weaknesses that no single check catches.
CVE-2026-55040 combines four distinct flaws: disabled signature requirements, x5t resolution without verification, issuer validation that accepts unregistered certificates, and non-cryptographic signature checks. The result allows an unauthenticated attacker to forge a valid JWT and impersonate any SharePoint site user or administrator.
Rapid7 released a PoC on August 10. Exploitation attempts spiked from July 19 to August 13, with eight of 12 recorded attempts occurring on August 12 and 13. The public PoC is now being used in the wild.
This is the fifth SharePoint vulnerability exploited this year, following CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.
Authentication bypass vulnerabilities don't usually start with a single catastrophic bug. They start with multiple small flaws that, when chained together, create a path that bypasses every control in the stack. The engineering assumption that each layer will catch what the previous layer missed is what fails. When you disable signature verification and then build custom validation logic that doesn't verify signatures, you've just moved the failure point.
How are you validating that your authentication logic actually verifies what it claims to verify and not just accepting tokens that look like they should work?
Post summary
The CVE-2026-55040 SharePoint vulnerability is actively exploited via a publicly released PoC, with increased attack activity and JWT forging to impersonate users.
CVE-2026-56164 and other: EoP and another exploitable vulnerabilities in Microsoft SharePoint Server, 5.3 rating 🔥
A new Elevation of Privilege vulnerability in Microsoft SharePoint Server has been added to the CISA KEV, along with two previously disclosed vulnerabilities (CVE-2026-45659 & CVE-2026-32201). Attackers can chain them to gain access to SharePoint Server instances, steal IIS machine keys, and deploy malware.
🔥 All three are being actively exploited in the wild!
👉 https://nt.ls/oGZ1j
Post summary
Three Microsoft SharePoint Server CVEs, including a new EoP issue, are cataloged by CISA KEV and reportedly being actively exploited in the wild, with no patch or PoC details supplied.
⚠️Microsoft SharePoint – Unauthenticated Privilege Escalation (CVSS 9.8, CISA KEV, Actively Exploited)
CISA has added CVE-2026-56164 to its KEV catalogue following evidence of active exploitation, grouping it with two other actively exploited SharePoint vulnerabilities, CVE-2026-32201 and CVE-2026-45659, all used against internet-exposed on-premises servers. CVE-2026-56164 is a missing-authentication-for-critical-function flaw in on-premises Microsoft SharePoint Server that allows an unauthenticated attacker to elevate privileges over the network, with no credentials and no user interaction required. In observed attacks, it is chained with the other two flaws to achieve remote code execution and post-exploitation activity, including theft of IIS machine keys and the use of deserialization techniques to gain persistence and deploy malware.
Affected: SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition (all supported on-premises versions).
Mitigation: Apply Microsoft's July 2026 security updates immediately, enable AMSI integration for SharePoint web applications, and avoid direct internet exposure. Federal agencies must remediate by July 17, 2026, per BOD 26-04.
Modat Magnify Query: technology="Microsoft SharePoint"
The platform: https://magnify.modat.io/
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56164
#Modat#ModatMagnify#threatintel#vulnerability#CVE202656164#Microsoft#SharePoint#PrivEsc#infosec#KEV
Post summary
The post reports that CVE-2026-56164 is actively exploited in the wild, with observed attacks chaining to remote code execution, and includes specific mitigation steps and a vendor patch timeline.
Canadian Centre for Cyber Security@cybercentre_ca·
Patch
#CyberAlert | Critical vulnerabilities impacting Microsoft SharePoint Server
We recommend that organizations update or upgrade affected Microsoft SharePoint Server instances without delay.
Learn more:
https://www.cyber.gc.ca/en/alerts-advisories/al26-017-critical-vulnerabilities-impacting-microsoft-sharepoint-server-cve-2026-56164-cve-2026-55040-cve-2026-58644 https://t.co/rST8qAZDJe
Post summary
The advisory highlights three critical CVEs affecting Microsoft SharePoint Server and urges immediate updates or upgrades, but does not provide exploit code, technical details, or evidence of active exploitation.
July 2026 Patch Tuesday drops 622 CVEs with three zero-days: SharePoint (CVE-2026-56164) and AD FS (CVE-2026-56155) are actively exploited and CISA KEV-listed.
#DFIR_Radar https://t.co/pLY8VaBF7d
Post summary
The post informs that two zero‑day CVEs for SharePoint and AD FS are currently being exploited in the wild and are listed as CISA KEV, as part of the July 2026 Patch Tuesday.
Microsoft has patched two vulnerabilities exploited in the wild in July’s Patch Tuesday release:
• CVE-2026-56164
• CVE-2026-56155
Both are now tracked in the KEVIntel feed.
Post summary
Microsoft released patches for CVE‑2026‑56164 and CVE‑2026‑56155, which were actively exploited in the wild, and the CVEs are now tracked in the KEVIntel feed.
Microsoft's July 2026 Patch Tuesday fixes 570 flaws. Zero-days CVE-2026-56155 and CVE-2026-56164 are exploited in the wild. Patch now.
#PatchTuesday#Microsoft#ZeroDay#CVE#CyberSecurity
http://securityonline.info/july-2026-patch-tuesday/
Post summary
Microsoft patched two zero-day CVEs that were reported to be actively exploited in the wild.
A ransomware group is actively exploiting a SharePoint vulnerability right now. CVE-2026-56164. Manufacturing. Healthcare. Education. Financial services. If you're running on-prem SharePoint and haven't patched this week, you're exposed.
Post summary
The note warns that a ransomware group is currently exploiting CVE-2026-56164 on on-prem SharePoint servers, urging immediate patching for organizations in manufacturing, healthcare, education, and financial services.
Six CVEs hit on-prem SharePoint in July 2026, four now in CISA KEV with active exploitation confirmed. Unauthenticated RCE and auth bypass can chain from a single web request to full domain compromise.
- CVE-2026-56164 (CVSS 9.8, unauthenticated auth bypass, KEV due July 17) and CVE-2026-58644 (CVSS 9.8, unauthenticated deserialization RCE, KEV due July 19) are the sharpest edge: no credentials required to reach code execution on SharePoint Server 2016, 2019, and Subscription Edition. CVE-2026-45659 (CVSS 8.8, authenticated deserialization RCE) and CVE-2026-32201 (CVSS 6.5, input validation spoofing) round out the confirmed-exploited set. CVE-2026-55040 (CVSS 9.1, JWT bypass) and CVE-2026-50522 (CVSS 9.8, unauthenticated deserialization) are not yet in KEV but must be patched now. Rapid7 flagged CVE-2026-55040 as part of a two-bug unauthenticated RCE chain; the companion bug lands in August 2026 patches.
#DFIR_Radar
Post summary
The post reports six SharePoint CVEs, four of which are confirmed as actively exploited and in the CISA KEV; it details the vulnerabilities and advises immediate patching.
Four on-premises SharePoint Server CVEs are actively exploited: CVE-2026-32201 (CVSS 6.5), CVE-2026-45659 (CVSS 8.8), CVE-2026-56164 (CVSS 9.8), and CVE-2026-58644 (CVSS 9.8).
#DFIR_Radar https://t.co/ln2QdK28Q8
Post summary
The tweet warns that four SharePoint Server CVEs (CVE-2026-32201, CVE-2026-45659, CVE-2026-56164, CVE-2026-58644) are actively exploited in the wild, citing their CVSS scores.
Microsoft just shipped a record 622 patches on Patch Tuesday
Hours later: a researcher dropped LegacyHive, a new Windows zero-day PoC that still works, even on the patched build
Meanwhile, CISA already added 2 actively exploited SharePoint flaws (CVE-2026-56164, CVE-2026-55040) to its must-fix list, deadline July 17
Patch Tuesday had a rough Tuesday
Post summary
Microsoft released 622 patches this cycle, yet a new zero‑day PoC named LegacyHive still functions on patched builds, while CISA has flagged two SharePoint flaws as actively exploited with a July 17 deadline.
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik#GüvenlikBülteni
Merhaba #Brolyz
🎯 Zafiyet Bilgisi
Ürün: #Microsoft SharePoint Server
#Zafiyet: Kimlik Doğrulama Eksikliği (Missing Authentication for Critical Function)
CVE: CVE-2026-56164
Zafiyet Türü: Kritik Fonksiyon İçin Kimlik Doğrulama Eksikliği (CWE-306)
Fidye Yazılımı İlişkisi: Şu an için bilinmiyor.
📌 Zafiyet Özeti
Microsoft #SharePoint Server üzerinde, kritik bir işlev için kimlik doğrulama eksikliğinden (Missing Authentication for Critical Function) kaynaklanan kritik bir güvenlik açığı tespit edilmiştir.
Bu zafiyet, kimlik doğrulaması gerektirmeden ağ üzerinden erişim sağlayabilen bir saldırganın yetki yükseltmesine (Privilege Escalation) olanak tanıyabilir. Başarılı bir istismar sonucunda saldırgan, SharePoint #orta'mında daha yüksek ayrıcalıklarla işlem gerçekleştirebilir ve kurumsal verilere erişim sağlayabilir.
🛡️ Önerilen Aksiyonlar
✅ Güvenlik Güncellemeleri
Microsoft tarafından yayımlanan güvenlik güncellemelerini ve önerilen hafifletici önlemleri (Mitigations) test ettikten sonra en kısa sürede canlı ortama uygulayın.
✅ Risk Yönetimi
Süreçlerinizi CISA'nın BOD 26-04 (Risk Tabanlı Güvenlik Güncellemelerinin Önceliklendirilmesi) ve Forensics Triage Requirements rehberlerine uygun şekilde yönetin.
✅ Erişim Kontrolleri
İnternete açık SharePoint sunucularını öncelikli olarak değerlendirin.
Gereksiz dış erişimleri sınırlandırın, yönetim arayüzlerini yalnızca güvenilir ağlardan erişilebilir hale getirin ve erişim kayıtlarını yakından izleyin.
✅ Geçici Koruma Önlemleri
Uygulanabilir bir yama veya hafifletici önlem bulunmuyorsa, ilgili sistemlerin erişimini kısıtlayın veya risk değerlendirmesi doğrultusunda hizmeti geçici olarak devre dışı bırakmayı değerlendirin.
📚 Referans: Microsoft Security Response Center (MSRC) & CISA
Post summary
This Turkish bulletin discloses the critical missing-authentication vulnerability CVE-2026‑56164 in Microsoft SharePoint Server, details its exploitation vectors, and recommends applying available patches and mitigations.
