A record-breaking release, three zero-days — and one on-prem SharePoint chain quietly stealing IIS machine keys for patch-surviving access.
Executive Summary
On 14 July 2026, Microsoft shipped its largest Patch Tuesday on record — 570 CVEs (622 including bundled third-party fixes). The headline volume is noise. The signal is three zero-days, two already exploited in the wild.
The real threat is a chained on-prem SharePoint attack — dubbed "ToolShell v2" — combining an unauthenticated RCE (CVE-2026-58644) with a missing-authentication EoP (CVE-2026-56164) to steal IIS machine keys and plant persistent web shells. A parallel AD FS flaw (CVE-2026-56155) lets attackers forge identity across an entire federation. SharePoint Online is not affected — this is an on-premises problem.
The Release
Microsoft's 570 CVEs break down as 254 Elevation of Privilege · 145 Remote Code Execution · 102 Information Disclosure · 35 Denial of Service · 17 Security Feature Bypass · 16 Spoofing. 59 are rated Critical, 48 of them RCE. Counts of "622" seen elsewhere fold in bundled third-party fixes such as Chromium — 570 is Microsoft's own tally. Microsoft credits part of the record volume to a surge in AI-assisted bug hunting.
Timeline
| Date | Event |
|---|---|
| 14 May → early Jul | Pre-disclosure exploitation of the SharePoint chain observed by responders (Mandiant / Google FLARE, Microsoft DART) |
| 14 Jul | Patch Tuesday ships; CISA adds the exploited SharePoint bugs to KEV the same day |
| 14 Jul | CISA confirms active exploitation of 32201, 45659, 56164 |
| 17 Jul | CISA FCEB remediation deadline for CVE-2026-56164 |
| 28 Jul | CISA FCEB remediation deadline for CVE-2026-56155 |
The Zero-Days
CVE-2026-58644 — SharePoint · Unauthenticated RCE · CVSS 9.8
The payload of the chain: an unauthenticated deserialization RCE against on-prem SharePoint 2016 / 2019 / Subscription Edition. Initially reported as requiring Site Owner permissions; later confirmed unauthenticated. Treat it as pre-auth RCE.
CVE-2026-56164 — SharePoint · Missing-Auth EoP · CVSS 5.3 · Exploited
Missing authentication for a critical function — unauthenticated, network-based, no user interaction. The 5.3 badly understates it: this is the privilege link that turns the chain into full compromise. Found by Mandiant / Google FLARE during live attacks.
CVE-2026-56155 — AD FS · EoP · CVSS 7.8 · Exploited
Root cause: overly permissive ACLs on the Distributed Key Manager (DKM) container. An attacker with code execution on a networked host pivots to an AD FS server, escalates to administrator, and forges authentication tokens to impersonate any user across the entire federated estate — no further auth. Credited to Microsoft DART; caught in a live incident.
CVE-2026-50661 — BitLocker · Security Feature Bypass · Not Exploited
Publicly disclosed but not exploited. Requires physical access to read encrypted data. An endpoint/laptop-fleet priority — not part of the active-exploitation story.
The Chain — "ToolShell v2"
The SharePoint bugs are not used in isolation. The observed chain stacks a payload, a privilege bypass, and older ToolShell-era bugs into full unauthenticated compromise:
Stolen machine keys survive the patch. An attacker who already lifted your keys can forge valid __VIEWSTATE payloads long after you've updated. On exposed, unpatched SharePoint, rotating the keys — not just patching — is what evicts the actor.
The Actors
This carries the same mechanical fingerprint as the July 2025 ToolShell campaign: PRC-nexus Linen Typhoon and Violet Typhoon, plus ransomware operator Storm-2603. That campaign hit finance, healthcare, government and energy at scale. Assume the same affiliate playbook here — quiet key theft first, monetisation (ransomware / extortion) later.
TTPs (MITRE ATT&CK)
| Tactic | Technique |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application (SharePoint deserialization) · T1078 Valid Accounts (forged tokens post-key-theft) |
| Execution | T1059.001/.003 Command & Scripting Interpreter — web shell spawning powershell.exe / cmd.exe under w3wp.exe |
| Persistence | T1505.003 Web Shell · T1552.004 stolen IIS machine keys → forged __VIEWSTATE |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation (56164 missing-auth EoP; 56155 AD FS DKM) |
| Credential Access | T1606.002 Forge Web Credentials (SAML) — AD FS token forging across the federation |
| Defense Evasion | T1550.001 Application Access Token — valid, signed, forged tokens; minimal malware / IOC footprint |
| Impact | T1657 Financial Theft (extortion) · T1486 Data Encrypted for Impact (occasional, not standard) |
Exposed Surface
| Product | At risk from | Notes |
|---|---|---|
| On-prem SharePoint 2016 / 2019 / Subscription | 58644, 56164 (+ 32201, 45659) |
Internet-facing = priority; exposed + unpatched = assume-breach |
| SharePoint Online (M365) | — | Not affected |
| AD FS (Windows Server) | CVE-2026-56155 |
Any federated-identity estate |
| Windows endpoints w/ BitLocker | CVE-2026-50661 |
Physical-access risk only |
Detection & Hunting
With forged tokens and valid keys in play, hunt on behaviour, not signatures:
- SharePoint — web shells under the
_layoutspaths;w3wp.exespawningcmd.exe/powershell.exe; anomalous or replayed__VIEWSTATE; sustained egress from server segments. - Machine-key theft — the highest-value indicator. Forged
__VIEWSTATEdeserialization and unexplained auth continuity across a patch. - AD FS — audit ACLs on the DKM container; review token-issuance logs for impossible SAML assertions and off-hours issuance.
- Interim SharePoint mitigation — enable AMSI integration in Full Request Body Scan mode where patching isn't immediate.
Defensive Actions
- Patch the SharePoint chain first —
58644and56164— on every on-prem instance, internet-facing first. - Patch AD FS (
56155) on all federation servers; then audit the DKM container ACLs. - Assume-breach on exposed, unpatched SharePoint — rotate IIS machine keys, hunt web shells, verify persistence is cleared.
- Enable AMSI Full Request Body Scan as interim SharePoint cover.
- Don't wait for a maintenance window or KEV listing — Microsoft's "exploited" flag is sufficient. CISA deadlines: 17 Jul (
56164), 28 Jul (56155). - Then triage the backlog — the remaining ~567 CVEs by CVSS × internet exposure, not by count.
The record CVE number is a headline, not a threat. The threat is a live, unauthenticated SharePoint chain that steals your machine keys for patch-surviving persistence, alongside an AD FS flaw that forges identity across your whole federation. Run either on-premises? This is a this-week action — and for anything exposed and unpatched, patching is step two. Step one is assume-breach.
