Microsoft's Patch for Two Active Zero-Days Leaves Room for Exploitation

Introduction: The Scale of Microsoft’s Vulnerabilities

Microsoft's latest security update marks a significant moment in the cybersecurity landscape, with the company addressing a staggering 622 vulnerabilities, among which are two critical zero-days that are reportedly under active attack. Specifically, CVE-2026-56164 affects on-premises SharePoint Server, while CVE-2026-56155 targets Active Directory Federation Services (AD FS). Both vulnerabilities emphasize a critical risk that defenders cannot afford to overlook—unauthenticated and authenticated attackers can exploit them, respectively. Although Microsoft rates these flaws as relatively low in severity, the attack paths they expose signal an urgent need for immediate remediation. As organizations race to patch, the potential for exploitation looms, urging defenders to adopt a proactive approach.

Exploitation Vectors: Understanding the Threat

CVE-2026-56164 allows unauthenticated attackers to escalate privileges over the network, presenting a straightforward yet devastating exploitation path. An attacker equipped with basic network access could take advantage of this vulnerability to gain unauthorized access to sensitive data, rendering perimeter defenses ineffective. The ease of this attack path raises serious concerns; an adversary only needs to infiltrate the network to begin their assault on privilege elevation. Furthermore, given that SharePoint is often interconnected with other enterprise systems, successful exploitation could lead to compounded risks across a wide array of critical services and data repositories. This illustrates a glaring gap in most organizations' security postures that attackers are likely targeting.

CVE-2026-56155, on the other hand, allows already-authenticated users to escalate their privileges locally on systems through weak access controls in AD FS. While this situation requires a higher threshold for exploitation than CVE-2026-56164, it does not diminish the gravity of the risk. An attacker leveraging stolen credentials for post-exploitation could easily navigate through AD FS, taking control over federation services crucial for Single Sign-On functionalities. Such a pivot could enable lateral movements across the network and increase the likelihood of achieving broader objectives, such as data theft or denial of service within integrated applications. The way these vulnerabilities scaffold potential attack paths cannot be overstated; they are elegant in their simplicity yet devastating in their potential impact.

Microsoft’s Response and Defender Actions

Microsoft has released urgent patches to rectify these vulnerabilities, highlighting the pressing need for organizations to promptly deploy these updates. However, the sheer volume of 622 addressed flaws raises questions about the overall health of Microsoft software security. While the company issues patches to mitigate risks, the fact that two zero-days are already being exploited underscores an ongoing challenge in vulnerability management. The paradox lies in the frequency of discoveries marking significant patches and the lurking adversaries who are all too eager to capitalize on these flaws before remediation occurs. Clearly, defenders need to maintain a strong posture, actively monitoring and applying mitigations rather than simply relying on vendor updates.

Despite the patch release, it’s concerning that neither of the two zero-day vulnerabilities is on CISA’s Known Exploited Vulnerabilities list. This lack of visibility adds an extra layer of uncertainty for defenders, who must remain vigilant without complete knowledge about exploitation mechanisms or ongoing campaigns. The absence of information on who is exploiting these vulnerabilities can leave defenders in a state of anxiety, trying to anticipate an adversary's next move without specific intelligence to act upon. Thus, the defenders must focus on comprehensive monitoring, proactive threat hunting, and refining incident response plans tailored to mitigate these unique risks.

The Importance of Proactive Vigilance

The release of these patches should serve as a wake-up call for organizations running Microsoft's on-premises solutions. The fleeting assurance of security provided by patches does not negate the necessity for continued vigilance. Security teams must conduct thorough assessments of their environments to identify additional attack vectors exacerbated by these flaws. As a part of incident response and threat hunting efforts, organizations should also institute a practice of regular penetration testing to uncover other hidden vulnerabilities and configurations that may also allow for privilege escalation or lateral movement within their networks. Many organizations are still relying on outdated security protocols without applying the necessary scrutiny and upgrade cycles to bolster overall resilience against these types of threats.

Closing Takeaway: No Room for Complacency

The emergence of CVE-2026-56164 and CVE-2026-56155 as live threats in the wild exemplifies the dynamic nature of the cybersecurity landscape. Ignoring these vulnerabilities can lead to dire consequences, including breaches and unauthorized access to sensitive data. As defenders, the focus must center on understanding these vulnerabilities, applying necessary patches without delay, and enhancing overall security resilience through proactive measures. Complacency is not an option; the fight against exploitation is ongoing, and the stakes can only rise as new attackers emerge. Vigilance, combined with effective remediation, is the only path forward in a landscape rife with risks.

Disclaimer: This article reflects the AI columnist's perspective on the current cybersecurity landscape.

Sources

https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html