Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities

1. Executive summary

Microsoft's July 2026 Patch Tuesday addresses a record 622 vulnerabilities across its product ecosystem, including 57 rated critical. Two vulnerabilities — CVE-2026-56155 (Active Directory Federation Services, CVSS 7.8 HIGH) and CVE-2026-56164 (Microsoft SharePoint Server, CVSS 5.3 MEDIUM) — are confirmed as exploited in the wild and are listed in the CISA KEV catalogue (added 2026-07-14). The volume is driven by Microsoft's multi-model agentic scanning harness (MDASH), which is expected to continue producing large patch sets. EMEA financial services running on-premise AD FS, SharePoint, and Windows DHCP infrastructure face immediate risk from the two zero-days and should prioritise patching alongside network-level containment of critical RCE vulnerabilities in DHCP and MSMQ components.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed exploited vulnerabilities (CISA KEV)

CVE-2026-56155 — AD FS Elevation of Privilege (CVSS 7.8 HIGH, CWE-1220)

• Component: Active Directory Federation Services (AD FS)
• Mechanism: Insufficient granularity of access control. An authorised attacker (already authenticated) can exploit this locally to elevate privileges.
• Impact: Administrator-level privilege gain on the AD FS server. Credited to researchers with the Microsoft Detection and Response Team (DART).
• Attack chain: (1) Attacker obtains initial authenticated access to AD FS environment → (2) exploits insufficient access control granularity → (3) elevates to administrator privileges → (4) potential for federation trust manipulation, token forging, or lateral movement to downstream services trusting the AD FS instance.
• Note: The verified reference data classifies this as CWE-1220 (Insufficient Resource Granularity). Tenable refers to it as an EoP vulnerability without specifying a CWE. Both classifications are consistent.

CVE-2026-56164 — SharePoint Server Spoofing/EoP (CVSS 5.3 MEDIUM, CWE-306)

• Component: Microsoft SharePoint Server (affects SharePoint Server 2019, SharePoint Server Subscription Edition, SharePoint Server 2016, SharePoint Enterprise Server 2016)
• Mechanism: Missing authentication for a critical function (CWE-306). An unauthorised attacker can exploit this over a network to perform spoofing and elevate SharePoint permissions.
• Impact: Unauthorised privilege elevation within SharePoint.
• Mitigation note: Microsoft's Antimalware Scan Interface (AMSI) integration can provide partial mitigation by scanning for and detecting malicious POST requests.
• Attack chain: (1) Attacker identifies exposed SharePoint Server endpoint → (2) sends crafted request to the unauthenticated critical function → (3) performs spoofing to elevate permissions → (4) accesses or modifies content beyond authorised scope.
• Note: Talos describes this as spoofing; Tenable categorises it as EoP. The verified CWE-306 (Missing Authentication for Critical Function) is consistent with both descriptions — the missing authentication enables both spoofing and privilege escalation.

Critical RCE vulnerabilities rated "more likely" to be exploited

DHCP Server and Client (network-adjacent attack surface)

• CVE-2026-50518: Unauthenticated network-based RCE via heap-based buffer overflow in DHCP Server. Highest severity in the DHCP cluster.
• CVE-2026-50370: Requires adjacent network position. The verified data records both CWE-20 (Improper Input Validation) and CWE-122 (Heap-based Buffer Overflow), indicating the input validation failure leads to the heap overflow.
• CVE-2026-54128: Use-after-free in the DHCP client. SANS notes this requires the victim to connect to a network with a malicious DHCP server — relevant for public Wi-Fi attack scenarios. Local execution after trigger.

Other "more likely" critical RCE

• CVE-2026-54992 (MSMQ Queue Manager): Heap-based buffer overflow. MSMQ is often enabled on internal Windows servers. If the MSMQ service is exposed on TCP ports 1801, 2103, 2105, or 2107, this presents a network-based RCE vector. Disabling MSMQ where not required eliminates the attack surface.
• CVE-2026-56188 (Windows Server Network driver): Race condition (CWE-362) yielding CVSS 9.8. Race conditions in kernel-mode network drivers can be exploited without authentication if the network path is reachable.
• CVE-2026-55010 (Minecraft Bedrock Dedicated Server): Network-based unauthenticated RCE via heap-based buffer overflow. Relevant only to environments running Minecraft Bedrock Dedicated Server (unlikely in financial services production, but verify in development/testing environments).
• CVE-2026-55944 (Dynamics NAV / Business Central on-prem): Deserialization of untrusted data. Tenable reports CVSS 9.8, rated critical, "Exploitation More Likely." No user interaction or authentication required. Exploited by sending a crafted login request to an affected server. This is a high-priority target for any financial services running on-premises Dynamics NAV or Business Central.
• CVE-2026-50522 and CVE-2026-58644 (SharePoint deserialization RCE): Network-based unauthenticated RCE via deserialization. These are distinct from CVE-2026-56164 (the KEV-listed SharePoint vulnerability) and are rated critical.

Other notable vulnerabilities

CVE-2026-50661 — Windows BitLocker Security Feature Bypass (CVSS 6.1, Important)

• Publicly disclosed prior to patch. Requires physical access to the target device. Tenable notes possible connection to "GreatXML," a zero-day BitLocker bypass disclosed by researcher "Chaotic Eclipse (Nightmare Eclipse)" on June 10, 2026. Attribution is to "Anonymous" per Microsoft. The GreatXML connection is single-sourced (Tenable); verify before enforcement.

CVE-2026-55008 — Microsoft Exchange Server Spoofing (Critical)

• Cross-site scripting vulnerability. An unauthorised attacker can perform spoofing over a network by sending a maliciously crafted email to a target, enabling arbitrary JavaScript execution. Rated "more likely" to be exploited.

CVE-2026-48561 — Microsoft Copilot RCE (Critical)

• Improper input neutralisation. The Register reports CVSS 9.6. Exploitable with low-privileged Hyper-V guest access without user awareness — e.g., a malicious website could trigger embedded Copilot features to process a prompt. Note: CVSS 9.6 is single-sourced (The Register); the verified reference data does not include this CVE.

Critical EoP vulnerabilities

• CVE-2026-42982, CVE-2026-50392: Windows Secure Kernel Mode
• CVE-2026-50444: Windows Server Update Service (WSUS) — critical for patch management infrastructure
• CVE-2026-50680, CVE-2026-54127: Windows Hyper-V
• CVE-2026-54121: Active Directory Certificate Services (AD CS) — potential for golden certificate / domain escalation
• CVE-2026-57092: Microsoft Windows VMSwitch

Critical security feature bypass

• CVE-2026-55040: Microsoft SharePoint Server, weak authentication. Rated "more likely" to be exploited.

Volume context

Microsoft attributes the record volume (622 CVEs, up from 206 in June) to its MDASH (multi-model agentic scanning harness). Tenable reports 569 CVEs (56 critical, 510 important, 3 moderate); Talos reports 622 (57 critical). The discrepancy likely reflects different counting methodologies (e.g., inclusion/exclusion of Chromium CVEs). The verified reference data does not adjudicate this count. SANS notes 427 additional Chromium CVEs affecting Edge are excluded from the 622 count.

Snort coverage

Talos has released Snort rules covering multiple July 2026 vulnerabilities:

• Snort 2: 1:66733 – 1:66743, 1:66745 – 1:66785, 1:66791 – 1:66793, 1:66800 – 1:66807
• Snort 3: 1:301555 – 1:301579, 1:301581 – 1:301583

Cisco Security Firewall customers should update their SRU. Open-source Snort Subscriber Ruleset customers should download the latest rule pack from Snort.org. Additional rules may follow.

4. Mitigation & containment

P1 — Within 24 hours

1. Patch CVE-2026-56155 (AD FS EoP) and CVE-2026-56164 (SharePoint) — both are in CISA KEV and confirmed exploited in the wild. Apply the July 2026 security update to all AD FS servers and all SharePoint Server instances (2016, 2019, Subscription Edition).
2. Enable AMSI integration on SharePoint Server as an interim mitigation for CVE-2026-56164 if patching cannot be completed within 24 hours. AMSI will scan for and detect malicious POST requests targeting the unauthenticated function.
3. Restrict network access to SharePoint Server endpoints — limit exposure of SharePoint web endpoints to only authenticated internal networks. Block external access to SharePoint Central Administration and any unauthenticated endpoints.
4. Audit AD FS for signs of exploitation — review for unauthorised privilege changes, new federation trust relationships, or anomalous token issuance activity. Look for accounts that were recently elevated to administrator-level privileges on AD FS servers.
5. Audit SharePoint for exploitation indicators — review IIS logs for unauthenticated POST requests to SharePoint endpoints, particularly from untrusted IP ranges. Check for unauthorised permission changes in SharePoint site collections.

P2 — Within 72 hours

1. Patch all "more likely" critical RCE vulnerabilities: - Windows DHCP Server (CVE-2026-50518, CVE-2026-50370) — patch all DHCP Server roles. - Windows DHCP Client (CVE-2026-54128) — patch all endpoints. Advise users against connecting to untrusted networks until patched. - Windows Media / Media Foundation (CVE-2026-50327, CVE-2026-50655). - MSMQ Queue Manager (CVE-2026-54992) — patch and, if MSMQ is not required, disable the service: Set-Service -Name MSMQ -StartupType Disabled; Stop-Service -Name MSMQ -Force. - Windows Server Network driver (CVE-2026-56188). - Microsoft SharePoint deserialization RCE (CVE-2026-50522, CVE-2026-58644). - Dynamics NAV / Business Central on-prem (CVE-2026-55944) — patch immediately. No authentication or user interaction required for exploitation. Restrict network access to Dynamics NAV/Business Central server ports until patched. - Minecraft Bedrock Dedicated Server (CVE-2026-55010) — patch or decommission from corporate environments.
2. Network containment for DHCP Server RCE: - Ensure DHCP Server services are not exposed to untrusted or semi-trusted networks (e.g., guest Wi-Fi VLANs). Segment DHCP infrastructure. - Block DHCP server traffic (UDP 67/68) at internal firewall boundaries where DHCP relay is not required.
3. Patch CVE-2026-50444 (WSUS EoP) — WSUS is critical patch management infrastructure. A compromise of WSUS can enable supply-chain-style attacks by pushing malicious updates. Patch WSUS servers before any other Windows Server infrastructure.
4. Patch CVE-2026-54121 (AD CS EoP) — Active Directory Certificate Services is a high-value target for domain escalation. Patch all AD CS servers.
5. Patch CVE-2026-55008 (Exchange Server XSS spoofing) and CVE-2026-55040 (SharePoint weak authentication bypass) — both rated "more likely" to be exploited.
6. Deploy Snort rules — update Snort 2 (rules 1:66733 – 1:66807) or Snort 3 (rules 1:301555 – 1:301583) to detect exploitation attempts against covered vulnerabilities.

P3 — Within 7 days

1. Patch remaining critical RCE vulnerabilities — including Office/Word/PowerPoint RCE (CVE-2026-50314, CVE-2026-50467, CVE-2026-55018, CVE-2026-55022, CVE-2026-55045, CVE-2026-55049, CVE-2026-55056, CVE-2026-55129, CVE-2026-55140, CVE-2026-55033, CVE-2026-55127, CVE-2026-55132, CVE-2026-55043, CVE-2026-55120, CVE-2026-55123). These require opening a crafted document — enforce email attachment scanning and disable macro execution where possible.
2. Patch remaining critical EoP vulnerabilities — Windows Secure Kernel Mode (CVE-2026-42982, CVE-2026-50392), Hyper-V (CVE-2026-50680, CVE-2026-54127), VMSwitch (CVE-2026-57092).
3. Patch CVE-2026-50661 (BitLocker bypass) — apply to all BitLocker-enabled devices. Note: exploitation requires physical access, so prioritise laptops and remote-worker endpoints.
4. Patch all "important" EoP vulnerabilities rated "more likely" — particularly Win32k (CVE-2026-49805, CVE-2026-50297, CVE-2026-50325, CVE-2026-50489, CVE-2026-50688, CVE-2026-54114, CVE-2026-54986), Windows Kernel (CVE-2026-49795, CVE-2026-49798, CVE-2026-50332, CVE-2026-50390, CVE-2026-50423, CVE-2026-50436), and CVE-2026-58638 (Windows Boot Loader Security Feature Bypass).
5. Patch CVE-2026-58631 (Windows Admin Center RCE) — WAC is a remote management tool; RCE here could enable lateral movement.
6. Complete full patch deployment across all Microsoft products in the July 2026 update.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources provide vulnerability details and Snort rule IDs but no file hashes, IP addresses, domains, or other artefacts suitable for IOC enforcement. The Snort rule IDs (1:66733 – 1:66807 for Snort 2; 1:301555 – 1:301583 for Snort 3) are detection signatures, not IOCs.

6. Detection

Snort rules

Talos has released Snort detection rules for the July 2026 Patch Tuesday vulnerabilities. Deploy the following rule ranges:

Snort 2: 1:66733 – 1:66743, 1:66745 – 1:66785, 1:66791 – 1:66793, 1:66800 – 1:66807

Snort 3: 1:301555 – 1:301579, 1:301581 – 1:301583

Update via SRU (Cisco Security Firewall) or Snort.org Subscriber Ruleset download.

Sigma rule — AD FS privilege elevation detection

The following Sigma rule detects potential exploitation of CVE-2026-56155 by monitoring for anomalous privilege changes on AD FS servers:

title: CVE-2026-56155 AD FS Privilege Elevation Anomaly
id: 7a1c2b3d-4e5f-6789-abcd-ef0123456789
status: experimental
description: >
  Detects potential exploitation of CVE-2026-56155 (AD FS EoP) by monitoring
  for local privilege elevation events on AD FS servers. CVE-2026-56155 allows
  an authorised attacker to elevate privileges locally via insufficient access
  control granularity in Active Directory Federation Services.
references:

  - https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/
  - https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164
author: Adverse Trace
date: 2026/07/14
tags:

  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: windows
  service: security
detection:
  selection_eventid:
    EventID:

      - 4673  # Sensitive Privilege Use
      - 4674  # Sensitive Privilege Use
      - 4688  # Process Creation
      - 4720  # User Account Created
      - 4732  # Member Added to Local Group
      - 4738  # User Account Changed
  filter_admin_process:
    SubjectUserName|contains:

      - 'Microsoft.IdentityServer'  # AD FS service account
      - 'adfssvc'
  condition: selection_eventid and not filter_admin_process
falsepositives:

  - Legitimate administrative changes on AD FS servers
  - AD FS service account performing expected operations
level: high

Sigma rule — SharePoint unauthenticated access detection

The following Sigma rule detects potential exploitation of CVE-2026-56164 by monitoring IIS logs for unauthenticated POST requests to SharePoint endpoints:

title: CVE-2026-56164 SharePoint Unauthenticated POST Request
id: 8b2d3c4e-5f67-8901-bcde-f12345678901
status: experimental
description: >
  Detects potential exploitation of CVE-2026-56164 (SharePoint Missing
  Authentication for Critical Function) by monitoring for POST requests
  to SharePoint endpoints from unauthenticated sessions. AMSI integration
  may also detect malicious POST requests.
references:

  - https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/
  - https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164
author: Adverse Trace
date: 2026/07/14
tags:

  - attack.initial_access
  - attack.t1190
logsource:
  product: windows
  service: iis
detection:
  selection_method:
    cs-method: POST
  selection_uri:
    cs-uri-stem|contains:

      - '/_layouts/'
      - '/_api/'
      - '/_vti_bin/'
  filter_authenticated:
    cs-username|ne: '-'
  condition: selection_method and selection_uri and filter_authenticated
falsepositives:

  - Legitimate unauthenticated POST requests to SharePoint endpoints (verify)
  - SharePoint health analyser requests
level: medium

Sigma rule — DHCP Server exploitation detection

title: CVE-2026-50518 DHCP Server Heap Overflow Exploitation Attempt
id: 9c3e4d5f-6789-0123-cdef-234567890123
status: experimental
description: >
  Detects potential exploitation of CVE-2026-50518 (Windows DHCP Server
  heap-based buffer overflow, CVSS 9.8) and CVE-2026-50370 (DHCP Server
  Service heap-based buffer overflow, CVSS 8.8) by monitoring for
  anomalous DHCP server service behaviour or crashes.
references:

  - https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/
  - https://isc.sans.edu/diary/rss/33154
author: Adverse Trace
date: 2026/07/14
tags:

  - attack.execution
  - attack.t1203
logsource:
  product: windows
  service: system
detection:
  selection_service_crash:
    EventID: 7031
    param1: 'DHCP Server'
  selection_service_error:
    EventID:

      - 1000
      - 1001
    Image|endswith:

      - 'tcpsvcs.exe'
      - 'dhcpssvc.dll'
  condition: selection_service_crash or selection_service_error
falsepositives:

  - Legitimate DHCP Server service restarts
  - DHCP Server configuration changes
level: high

YARA rule — detection of crafted Office documents

The sources note that 16 critical RCE vulnerabilities in Microsoft Office, Word, and PowerPoint are "typically triggered by opening a specially crafted document." No specific file artefacts, strings, or hashes are provided in the source material. The following YARA rule is a generic detection for exploitation attempts targeting the Office RCE vulnerabilities listed in this advisory. Note: this rule uses CVE identifiers as strings for correlation; no exploit-specific artefacts are available from the sources.

rule July_2026_Patch_Tuesday_Office_RCE_Correlation {
  meta:
    author = "Adverse Trace"
    date = "2026-07-14"
    reference = "https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/"
    description = "Correlation rule for July 2026 Office RCE CVEs - triggers on documents referencing exploit CVE identifiers. Source material does not provide exploit-specific strings; this rule supports incident correlation only."
    cve_list = "CVE-2026-50314, CVE-2026-50467, CVE-2026-55018, CVE-2026-55022, CVE-2026-55045, CVE-2026-55049, CVE-2026-55056, CVE-2026-55129, CVE-2026-55140, CVE-2026-55033, CVE-2026-55127, CVE-2026-55132, CVE-2026-55043, CVE-2026-55120, CVE-2026-55123"

  strings:
    $cve1 = "CVE-2026-50314" ascii nocase
    $cve2 = "CVE-2026-50467" ascii nocase
    $cve3 = "CVE-2026-55018" ascii nocase
    $cve4 = "CVE-2026-55022" ascii nocase
    $cve5 = "CVE-2026-55045" ascii nocase
    $cve6 = "CVE-2026-55049" ascii nocase
    $cve7 = "CVE-2026-55056" ascii nocase
    $cve8 = "CVE-2026-55129" ascii nocase
    $cve9 = "CVE-2026-55140" ascii nocase
    $cve10 = "CVE-2026-55033" ascii nocase
    $cve11 = "CVE-2026-55127" ascii nocase
    $cve12 = "CVE-2026-55132" ascii nocase
    $cve13 = "CVE-2026-55043" ascii nocase
    $cve14 = "CVE-2026-55120" ascii nocase
    $cve15 = "CVE-2026-55123" ascii nocase

  condition:
    1 of them
}

CVE assessment

10 referenced CVEs — 2 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• Cisco Talos — "Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities" — https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/ — 2026-07-14
• Tenable Research — "Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)" — https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164 — 2026-07-14
• SANS Internet Storm Center — "Microsoft Patch Tuesday July 2026 - The AI Acopolypse is Here" — https://isc.sans.edu/diary/rss/33154 — 2026-07-14
• The Register — "Patchpocalypse Now: Microsoft tops last month's record with 622 Patch Tuesday CVEs" — https://www.theregister.com/security/2026/07/14/patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves/5271434 — 2026-07-14

8. Adverse Trace position

Severity: HIGH. The July 2026 Patch Tuesday is the largest in Microsoft's history, driven by AI-assisted vulnerability discovery (MDASH). The two CISA KEV-listed vulnerabilities (CVE-2026-56155 in AD FS and CVE-2026-56164 in SharePoint) are confirmed exploited in the wild and demand immediate patching. While neither is rated critical by CVSS, active exploitation negates the severity rating as a prioritisation factor. The cluster of "more likely" critical RCE vulnerabilities in DHCP Server/Client, MSMQ, Dynamics NAV/Business Central, and SharePoint deserialization presents significant network-based attack surface for EMEA financial services running on-premises Microsoft infrastructure. The CVE-2026-55944 Dynamics NAV/Business Central deserialization RCE (CVSS 9.8, no authentication or user interaction required) is particularly concerning for any financial institution with on-premises Dynamics deployments. The CVE-2026-50444 WSUS EoP is a supply-chain risk: compromise of WSUS infrastructure could enable malicious update distribution. We assess that the volume will overwhelm standard patch cycles — clients should triage using the CISA KEV list, Microsoft's "more likely" exploitability rating, and asset criticality. We will monitor for additional Snort rule releases, emergence of public PoC code for the "more likely" CVEs, and any threat actor attribution. The Tenable-suggested connection between CVE-2026-50661 and the "GreatXML" BitLocker bypass (researcher "Chaotic Eclipse / Nightmare Eclipse") is single-sourced and unconfirmed; we will not treat it as verified attribution. No MITRE ATT&CK actor profiles are referenced in the verified data for any exploitation activity associated with these CVEs; attribution remains unconfirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.