When I pulled up the July 2026 Security Update Guide on the morning of July 15th, the number at the top stopped me: 622 CVEs. Not in a year. In one Patch Tuesday cycle. For context, the prior record was somewhere around 280 CVEs in a single month. Microsoft has now more than doubled that in a single release. For SOC teams and patch management teams trying to prioritize, this is the cycle that breaks most existing triage workflows.
Two of these vulnerabilities are actively exploited zero-days. One has a CVSS of 9.9. And the SharePoint cluster alone involves five separate CVEs, three of which are on CISA’s Known Exploited Vulnerabilities catalog. This post works through the prioritization logic I would apply — and the KQL queries I would run immediately after patching.
622 CVEs in One Cycle: Understanding the Scale
The July 2026 Patch Tuesday release spans 622 CVEs, with 95 remote code execution vulnerabilities and 48 classified as Critical severity. Microsoft products covered include Windows, SharePoint Server, SQL Server, Office, Exchange Server, Hyper-V, BitLocker, and the .NET runtime. The scale reflects in part a backlog from a lighter June cycle and in part an accumulation of issues discovered through expanded bug bounty and partnership disclosures.
Prioritizing 622 CVEs with the typical “CVSS above 9, patch within 7 days” rule fails immediately — there are enough 9.x CVEs to overwhelm any team. A more structured approach combines three signals: CISA KEV listing (confirmed exploitation in the wild), Microsoft’s own “Exploitation Detected” flag in the update guide, and EPSS score for non-KEV items where Exploitation is marked “More Likely.”
Applying that filter to July 2026 produces a prioritized list of roughly 12 CVEs that demand attention in the first 48 hours. This post covers the most critical of those.
Zero-Day 1: CVE-2026-56164 — SharePoint Server Unauthenticated Elevation of Privilege
CVE-2026-56164 is the more dangerous of the two confirmed zero-days. It is a missing authentication flaw in SharePoint Server that allows an unauthenticated attacker to perform privilege escalation over the network. The attack vector is AV:N/AC:L/PR:N/UI:N — network-accessible with no authentication required, no complexity, no user interaction.
This vulnerability was credited to Mandiant and Google FLARE, which suggests nation-state context in the original discovery. CISA added it to KEV on July 14, 2026, the day of the patch release, with a remediation deadline of July 21, 2026. Microsoft’s update guide marks it as “Exploitation Detected,” meaning it was being used in active attacks before the patch was available.
The most concerning aspect from a SOC perspective is the authentication bypass component. Most organizations have SharePoint exposed to their internal network, and many have Outlook Web Access or SharePoint-connected portals partially exposed externally. An unauthenticated EoP over the network on a system like SharePoint is a serious incident waiting to happen.
The hunting query for CVE-2026-56164 exploitation attempts:
// SharePoint unauthenticated EoP - hunt for privilege escalation events from anonymous sessions
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4648, 4624)
| where TargetServerName has_any ("sharepoint", "spserver", "_layouts", "/_api")
| where LogonType == 3
| where AuthenticationPackageName !has "Kerberos" and AuthenticationPackageName !has "NTLM"
| project TimeGenerated, IpAddress, TargetUserName, TargetDomainName,
AuthenticationPackageName, LogonType
| order by TimeGenerated desc// SharePoint IIS access log anomalies - look for unusual requests to admin endpoints
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/_api/", "/_layouts/", "/sharepoint/", "/_vti_bin/")
| where csUsername == "-" or isempty(csUsername)
| where scStatus !in ("401", "403")
| project TimeGenerated, cIP, csUriStem, csUsername, scStatus, csUserAgent
| order by TimeGenerated descZero-Day 2: CVE-2026-56155 — Active Directory Federation Services Elevation of Privilege
CVE-2026-56155 is an authenticated local privilege escalation in Active Directory Federation Services. An attacker with a standard user account on the AD FS server itself can exploit insufficient access control in the service to elevate privileges locally. Microsoft credits this discovery to its own Detection and Response Team (DART), which typically means internal discovery during an active incident response engagement.
The local requirement (PR:L, AV:L) makes this less immediately scary than CVE-2026-56164, but the target — AD FS — makes the impact catastrophic if reached. AD FS issues authentication tokens for cloud and hybrid workloads, including Microsoft 365, Azure, and federated third-party services. Local EoP on an AD FS server gives an attacker control over the token signing process itself, enabling the same “Golden SAML” attack class that was used in the SolarWinds compromise in 2020.
For environments running hybrid Azure AD, this needs to be patched within 24 hours of any AD FS server being considered potentially compromised.
// Hunt for unusual process activity on AD FS servers
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("adfs", "sts", "federation")
| where InitiatingProcessFileName !in~ (
"Microsoft.IdentityServer.ServiceHost.exe",
"w3wp.exe", "WerFault.exe", "conhost.exe", "svchost.exe"
)
| where FileName !in~ ("conhost.exe","WerFault.exe","wermgr.exe")
| project TimeGenerated, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descThe Most Dangerous Non-Zero-Day: CVE-2026-57092 VMSwitch RCE (CVSS 9.9)
CVE-2026-57092 is a use-after-free in the Windows Hyper-V Virtual Switch component that allows a guest VM to execute code on the host. CVSS 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The scope change (S:C) accounts for the guest-to-host escape component, which crosses a security boundary by design.
Microsoft does not mark this as exploited in the wild, but a CVSS 9.9 VM escape that does not require physical access or admin credentials inside the guest is exactly the class of vulnerability that sophisticated actors save for high-value targets. For cloud infrastructure and virtualization-heavy environments, this is the patch of the month regardless of the zero-day status of the other CVEs.
// Hunt for unusual activity from Hyper-V worker processes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("vmwp.exe","vmms.exe","vmcompute.exe")
| where FileName !in~ ("conhost.exe","WerFault.exe","wermgr.exe","vmwp.exe","vmcompute.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descThe SharePoint Cluster Problem
July 2026 contains a cluster of SharePoint vulnerabilities that interact in concerning ways:
CVE-2026-58644 (CVSS 9.8, Actively Exploited)
A deserialization remote code execution flaw requiring Site Owner or higher authentication to trigger. Despite the authentication requirement, CISA added it to KEV as of July 2026, and Storm-2603 (a threat actor deploying Warlock ransomware) is confirmed to have used this in attacks against enterprise SharePoint deployments. The Storm-2603 campaign chains this with the other SharePoint CVEs to move from external access to full SharePoint farm compromise and lateral movement.
CVE-2026-45659 (CVSS 8.8, KEV Listed)
Another deserialization RCE in SharePoint, also actively exploited and KEV-listed. Requires lower privilege than CVE-2026-58644 (Contributor-level access is sufficient). Added to CISA KEV on July 1, 2026, suggesting exploitation predates the patch by two weeks.
CVE-2026-55040 (JWT Authentication Bypass)
A JSON Web Token authentication bypass in SharePoint Server that, when chained with either CVE-2026-45659 or CVE-2026-58644, creates a path to unauthenticated remote code execution. Microsoft is delaying the patch for CVE-2026-55040 to the August 2026 cycle, meaning this bypass will remain open for an additional month. Any mitigation strategy for the SharePoint cluster must account for this.
Microsoft’s recommended interim mitigation for CVE-2026-55040 is enabling AMSI (Antimalware Scan Interface) Full Mode on SharePoint. This does not patch the underlying flaw but adds an inspection layer that catches known exploitation payloads:
// Enable AMSI Full Mode on SharePoint (run on each SharePoint server)
Add-PSSnapin Microsoft.SharePoint.PowerShell
$contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService
$contentService.EnableAMSI = $true
$contentService.Update()Storm-2603 and Warlock Ransomware Context
The SharePoint cluster CVEs are not just theoretical. Storm-2603 is an active threat actor confirmed to be exploiting CVE-2026-58644, CVE-2026-45659, and CVE-2026-32201 in a chain to deploy Warlock ransomware. The attack pattern involves initial SharePoint exploitation, followed by IIS machine key theft (enabling persistent token forgery), and then lateral movement via the harvested keys.
The IIS machine key theft step is worth flagging specifically. If an attacker obtains the IIS machine key used by a SharePoint server, they can forge authentication tokens for any SharePoint user including farm administrators — and this persists even after patching unless the machine key is rotated. If your SOC detects any indicators of SharePoint exploitation, machine key rotation must be part of incident response even if the attack appears contained.
// Detect potential IIS machine key access or modification
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any (@"C:inetpubwwwroot", @"C:WindowsMicrosoft.NET")
| where FileName has_any ("web.config", "machine.config")
| where ActionType in ("FileModified", "FileRead")
| where InitiatingProcessFileName !in~ ("w3wp.exe","svchost.exe","TrustedInstaller.exe")
| project TimeGenerated, DeviceName, AccountName, FolderPath, FileName,
ActionType, InitiatingProcessFileName
| order by TimeGenerated descTriage Methodology for 622 CVEs
The practical approach I apply to a release this large:
Tier 1 (patch within 24 hours): Any CVE on CISA KEV with Microsoft’s “Exploitation Detected” flag. July 2026 Tier 1 list: CVE-2026-56164, CVE-2026-56155, CVE-2026-58644, CVE-2026-45659. These are confirmed in-the-wild exploitation.
Tier 2 (patch within 72 hours): CVEs not yet exploited but with CVSS 9.0+ and Microsoft’s “Exploitation More Likely” rating. July 2026 Tier 2 includes CVE-2026-57092 (VMSwitch, 9.9) and the SQL Server pair CVE-2026-54117 and CVE-2026-54118 (both 8.8 deserialization RCE).
Tier 3 (standard patch cycle, within 30 days): Everything else, sorted by EPSS score and exposure surface area.
The CVE-2026-58608 Windows Print Spooler vulnerability covered in our CVE-2026-58608 analysis is Tier 2 for most environments and Tier 1 for any environment with Print Spooler on domain controllers. For organizations managing Ivanti infrastructure alongside this patch cycle, the comparison to CVE-2025-0282 Ivanti Connect Secure exploitation timelines is instructive — these types of vulnerabilities move from patch release to weaponized exploit within days.
External resources: Microsoft July 2026 Security Update Release Notes | CISA KEV Catalog | EPSS Scoring (FIRST.org)