CVE-2026-56164 and CVE-2026-56155: Two Exploited Microsoft Zero-Days Put SharePoint and AD FS at Risk
ID: 1d7e0183-bb83-5c0e-a3cb-dc609f0022bd
STIX ID: report--1d7e0183-bb83-5c0e-a3cb-dc609f0022bd
Feed Name: SOC Prime Blog
Microsoft's July 2026 updates close two actively exploited zero-days: CVE-2026-56164 in on‑premises SharePoint (a remotely exploitable, low-complexity elevation-of-privilege) and CVE-2026-56155 in AD FS (a local low‑privilege escalation that threatens federation/identity infrastructure). The report stresses urgent patching, enabling AMSI Full Mode for SharePoint, validating AD FS updates and ACL hardening, inventorying internet-facing SharePoint and federation servers, and conducting post-compromise reviews due to high operational risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.