Microsoft July 2026 Patch Tuesday: 570 CVEs and the ToolShell v2 SharePoint Chain

A record-breaking release, three zero-days — and one on-prem SharePoint chain quietly stealing IIS machine keys for patch-surviving access.

The Release

Microsoft's 570 CVEs break down as 254 Elevation of Privilege · 145 Remote Code Execution · 102 Information Disclosure · 35 Denial of Service · 17 Security Feature Bypass · 16 Spoofing. 59 are rated Critical, 48 of them RCE. Counts of "622" seen elsewhere fold in bundled third-party fixes such as Chromium — 570 is Microsoft's own tally. Microsoft credits part of the record volume to a surge in AI-assisted bug hunting.

Timeline

The Zero-Days

CVE-2026-58644 — SharePoint · Unauthenticated RCE · CVSS 9.8

The payload of the chain: an unauthenticated deserialization RCE against on-prem SharePoint 2016 / 2019 / Subscription Edition. Initially reported as requiring Site Owner permissions; later confirmed unauthenticated. Treat it as pre-auth RCE.

CVE-2026-56164 — SharePoint · Missing-Auth EoP · CVSS 5.3 · Exploited

Missing authentication for a critical function — unauthenticated, network-based, no user interaction. The 5.3 badly understates it: this is the privilege link that turns the chain into full compromise. Found by Mandiant / Google FLARE during live attacks.

CVE-2026-56155 — AD FS · EoP · CVSS 7.8 · Exploited

Root cause: overly permissive ACLs on the Distributed Key Manager (DKM) container. An attacker with code execution on a networked host pivots to an AD FS server, escalates to administrator, and forges authentication tokens to impersonate any user across the entire federated estate — no further auth. Credited to Microsoft DART; caught in a live incident.

CVE-2026-50661 — BitLocker · Security Feature Bypass · Not Exploited

Publicly disclosed but not exploited. Requires physical access to read encrypted data. An endpoint/laptop-fleet priority — not part of the active-exploitation story.

The Chain — "ToolShell v2"

The SharePoint bugs are not used in isolation. The observed chain stacks a payload, a privilege bypass, and older ToolShell-era bugs into full unauthenticated compromise:

The Actors

This carries the same mechanical fingerprint as the July 2025 ToolShell campaign: PRC-nexus Linen Typhoon and Violet Typhoon, plus ransomware operator Storm-2603. That campaign hit finance, healthcare, government and energy at scale. Assume the same affiliate playbook here — quiet key theft first, monetisation (ransomware / extortion) later.

TTPs (MITRE ATT&CK)

Exposed Surface

Detection & Hunting

With forged tokens and valid keys in play, hunt on behaviour, not signatures:

• SharePoint — web shells under the _layouts paths; w3wp.exe spawning cmd.exe / powershell.exe; anomalous or replayed __VIEWSTATE; sustained egress from server segments.
• Machine-key theft — the highest-value indicator. Forged __VIEWSTATE deserialization and unexplained auth continuity across a patch.
• AD FS — audit ACLs on the DKM container; review token-issuance logs for impossible SAML assertions and off-hours issuance.
• Interim SharePoint mitigation — enable AMSI integration in Full Request Body Scan mode where patching isn't immediate.

Defensive Actions

• Patch the SharePoint chain first — 58644 and 56164 — on every on-prem instance, internet-facing first.
• Patch AD FS (56155) on all federation servers; then audit the DKM container ACLs.
• Assume-breach on exposed, unpatched SharePoint — rotate IIS machine keys, hunt web shells, verify persistence is cleared.
• Enable AMSI Full Request Body Scan as interim SharePoint cover.
• Don't wait for a maintenance window or KEV listing — Microsoft's "exploited" flag is sufficient. CISA deadlines: 17 Jul (56164), 28 Jul (56155).
• Then triage the backlog — the remaining ~567 CVEs by CVSS × internet exposure, not by count.