Microsoft released patches for over 570 vulnerabilities on July 2026 Patch Tuesday, including two actively exploited flaws: CVE-2026-56155, an elevation of privilege (EoP) vulnerability in Active Directory Federation Services (ADFS) spotted being exploited in the wild by Microsoft’s incident responders, and CVE-2026-56164, an EoP flaw in Microsoft SharePoint Server reported by Google’s incident responders and an anonymous researcher that is remotely exploitable in low-complexity attacks. A previously disclosed vulnerability, CVE-2026-50661, a Windows BitLocker security feature bypass, was also patched but not actively exploited. The release was followed by Nightmare Eclipse publishing a proof-of-concept exploit for an unpatched Windows EoP vulnerability dubbed LegacyHive. Microsoft also fixed additional SharePoint remote code execution vulnerabilities (CVE-2026-50522 and CVE-2026-58644) and a critical security feature bypass flaw (CVE-2026-55040), which Rapid7 noted is the first in a pair of exploits that can lead to unauthenticated remote code execution; the second vulnerability remains embargoed, with patches expected in August 2026. The US Cybersecurity and Infrastructure Security Agency (CISA) urged organizations running SharePoint servers to apply additional hardening measures, citing attackers exploiting two recently patched vulnerabilities (CVE-2026-32201 and CVE-2026-45659).