CVE-2026-56164 and CVE-2026-56155: Two Exploited Microsoft Zero-Days Put SharePoint and AD FS at Risk

Microsoft's July 2026 Patch Tuesday fixes two actively exploited zero-day elevation-of-privilege vulnerabilities: CVE-2026-56164 in on‑premises SharePoint Server (remote, no credentials or user interaction required) and CVE-2026-56155 in Active Directory Federation Services (local low‑privilege escalation). The advisory emphasizes immediate patching, enabling AMSI Full Mode for SharePoint as an added control, inventorying and prioritizing internet-facing servers, and hardening identity infrastructure because exploitation of these flaws can enable broad post-compromise abuse.