The Top CVEs of July 2026: Four SharePoint Zero-Days and a Record 569-CVE Patch Tuesday
July belonged to SharePoint — four separate flaws exploited in the wild — while Microsoft shipped the largest Patch Tuesday in its history at 569 CVEs. Here's what to fix first.
July belonged to SharePoint — four separate flaws exploited in the wild — while Microsoft shipped the largest Patch Tuesday in its history at 569 CVEs. Here's what to fix first, and why the raw severity score is the wrong place to start.
How we rank (the CyberSignal method)
We don't rank by CVSS. We rank by the risk a vulnerability actually poses to a defender this week, using four signals in order. First, confirmed active exploitation — a CISA KEV listing or credible in-the-wild evidence outranks any theoretical severity. Second, exposure and attacker value — internet-facing, unauthenticated, and widely deployed beats deep-internal or hard-to-reach. Third, patch availability — an unpatched or PoC-outpacing-the-fix bug is more urgent than one you can simply update away. Fourth, blast radius — identity providers, collaboration servers, edge devices, and CI/CD pipelines carry far more downstream than a single endpoint. A quietly exploited 5.3 will always sit above a critical-rated 9.8 that no one is touching.
The July 2026 ranked list
CVSS per NVD/CISA; rank reflects exploitation and exposure, not the raw score.
Tier 1 — Actively exploited (fix these first)
SharePoint was under siege from four directions at once. Two on-prem SharePoint zero-days — the missing-authentication flaw CVE-2026-56164 and the unauthenticated RCE CVE-2026-58644 — were exploited before or alongside their July fixes, and CISA gave the RCE a compressed remediation deadline. We covered the moment CISA added CVE-2026-58644 to the KEV catalog with a July 19 patch deadline, and Rapid7's subsequent deep-dive on the exploited chain is worth reading before you close out the incident. CISA's broader alert urged immediate patching for three exploited SharePoint vulnerabilities, two of them zero-days — the third being the JWT authentication bypass CVE-2026-55040 that lets an attacker impersonate any user or admin.
Then the pattern repeated with public exploit code. Barely a week later, proof-of-concept code turned CVE-2026-50522 into a mass-exploitation event within hours of release. Our report on this fourth actively exploited SharePoint vulnerability is the clearest signal of the month: if you run on-prem SharePoint, treat every farm as a target and assume the window between disclosure and exploitation is measured in hours, not weeks.
Identity was the other prize. CVE-2026-56155 in Active Directory Federation Services was exploited in the wild as a zero-day before its patch and grants an authorized attacker broader domain-level access — a modest 7.8 with an outsized blast radius, because AD FS sits at the center of single sign-on and federated trust.
Security and edge appliances stayed in the crosshairs. Check Point's SmartConsole authentication bypass (CVE-2026-16232) hands an unauthenticated attacker a full-admin token to the console that manages your security policy. Cisco's Secure Firewall Management Center flaw (CVE-2026-20316) is a hard-coded password that no configuration change can remove — only the vendor fix does. SonicWall's SMA1000 pair (CVE-2026-15409, a perfect-10.0 unauthenticated SSRF, and CVE-2026-15410) were exploited as zero-days against internet-facing VPN gateways, and Fortinet's FortiOS bug (CVE-2025-68686) is a patch-bypass that quietly re-enables malicious symlinks on devices you thought you'd cleaned. None of these is optional.
Tier 2 — Patch-now criticals (no confirmed attacks yet)
July's Patch Tuesday was the largest in Microsoft's history: 569 CVEs, of which 56 were rated critical and three were zero-days. Two of those zero-days (the SharePoint and AD FS flaws above) were already being exploited; the third, CVE-2026-50661, is a BitLocker security-feature bypass that was publicly disclosed but not yet exploited — it requires physical access to read encrypted data, so it belongs on the patch queue but below anything internet-facing. Microsoft has attributed part of this record volume to an AI-assisted discovery pipeline scanning its own codebase, which means defenders should expect large, dense Patch Tuesdays to become the norm rather than the exception. Prioritize the handful of critical, network-reachable RCEs in your specific product footprint first, then work down; the raw count is a triage problem, not a reason to panic.
Tier 3 — Self-hosted / infrastructure
AI tooling is now part of the attack surface. Langflow — a visual builder for AI agents — earned two KEV entries in a single month: the IDOR authorization bypass CVE-2026-55255 (9.9) and the unauthenticated code-execution flaw CVE-2026-0770 (9.8). The lesson security teams keep relearning is that a self-hosted AI framework deserves the same inventory, patching, and network-segmentation discipline as any other server. The same goes for the web tier: two WordPress Core flaws hit KEV together, led by the “wp2shell” pre-auth RCE (CVE-2026-63030) that chains REST-API route confusion with SQL injection across WordPress 6.8 through 7.0. And the reappearance of a 2021 DD-WRT buffer overflow (CVE-2021-27137) is a reminder that router and appliance firmware, often invisible to vulnerability-management programs, gives attackers durable footholds. If it's self-hosted and it faces the network, it needs the same rigor as your crown-jewel servers.
The CyberSignal Analysis
Signal 01 — The disclosure-to-exploitation window has collapsed
The through-line of July is speed. CVE-2026-50522 went from public PoC to honeypot hits in hours; CVE-2026-58644 arrived with a compressed CISA deadline because attackers were already moving. For a defender, patch cadence measured in weeks is no longer a coherent strategy for internet-facing, widely deployed software like SharePoint. The practical response is to pre-stage: know your on-prem SharePoint and AD FS inventory now, subscribe to the KEV feed as an operational trigger, and rehearse the emergency-patch path before you need it.
Signal 02 — CVSS keeps failing as a priority signal
The two most instructive entries this month scored 5.3. Cisco's FMC hard-coded password and Fortinet's FortiOS patch-bypass were both actively exploited while carrying “medium” base scores, and Langflow's most-exploited flaw wasn't its highest-scored one. Severity measures theoretical impact under ideal conditions; it says nothing about whether an exploit exists, whether the asset is reachable, or whether attackers care. A KEV listing is worth more than a CVSS of 9.8, and any patch-prioritization program that sorts purely by score will spend July fixing the wrong things.
Signal 03 — AI is now on both sides of the ledger
Microsoft credits an AI pipeline for surfacing much of a record 569-CVE release, while attackers added an AI-agent framework (Langflow) to their target list twice in one month. The defensive takeaway isn't to fear the volume — it's to industrialize triage. When the flow of disclosed vulnerabilities scales faster than any human queue, the teams that win are the ones automating the mapping from CVE to affected-asset to exploitation-status, so a human only ever looks at the short list that is both reachable and being hit.
Sources
The CyberSignal's CVE Watch is published monthly.
