Patch SharePoint first — exploited at 5.3, and the last fix ever for Server 2016 and 2019. Then the Windows cumulative, where an AD FS zero-day is under active attack.

Why now. CVE-2026-56164 is KEV-listed and Microsoft attests exploitation. It is unauthenticated, network-reachable and needs no user interaction — Microsoft's own advisory language is that an attacker does not require significant prior knowledge of the system and can achieve repeatable success. It scores 5.3 and is rated Moderate, which means an automated severity-ordered queue will bury it beneath dozens of Critical items you are not being attacked through. This is the severity inversion of the cycle, and it is the reason this unit ships first rather than tenth.

This unit cannot slip. Assessed to cut 2 of the identified chains — see the cut section, where this is labelled as a judgement rather than a finding.

Also inside: The same package carries CVE-2026-55040, the first half of an unauthenticated-RCE chain Rapid7 disclosed in coordination with Microsoft; the second half is embargoed and due for an August fix. It also carries the CVE-2026-50522 and CVE-2026-58644 pair, both scored 9.8 and both unauthenticated. CVE-2026-50522 was demonstrated at Pwn2Own Berlin, so a working exploit is in Microsoft's hands — but it is not public, so the PoC escalator does not fire and we have not treated it as one.

Patching is not remediation. CVE-2026-56164 was exploited before its fix existed, so deployment and compromise assessment are two obligations and this unit discharges only the first. CISA reports active exploitation of CVE-2026-56164 alongside two previously patched SharePoint flaws, with post-exploitation activity including theft of IIS machine keys and deserialization for persistence. That matters for scoping: a stolen machine key survives the patch. Review SharePoint and IIS logs for unexplained POST requests, new accounts and configuration changes predating install, and treat machine-key rotation as in scope rather than optional.

Then. Installing the Windows update does not patch a SharePoint farm. SharePoint servicing is its own path and needs its own change, its own validation, and a Configuration Wizard run. Where a farm cannot be patched immediately, Microsoft names AMSI integration with Request Body Scan set to Full as a mitigation for CVE-2026-56164 — treat that as a holding action, not the remediation. Farms at September 2025 CU level need a permissions correction first or the fixes fail to install.

Why now. CVE-2026-56155 is KEV-listed and Microsoft credits its own incident-response team with finding it, which means it was found inside live attacks. AD FS is the box that signs the tokens the rest of the estate trusts, so a flaw labelled local on that host is worth more than the label suggests. The package is also the only route to five DHCP fixes, an unauthenticated RDP server RCE, and a wormable server network driver RCE — all in services that everything else in the estate depends on and none of which have a separate installer.

Also inside: CVE-2026-57092, the VMSwitch use-after-free, carries the highest CVSS in the release at 9.9 and rides this package. It is a passenger, not a reason: as a non-Tier-0 elevation of privilege it fails the impact gate and would sit at Prioritise on its own. Because it ships inside a package that is already Act, the cost of that call is close to zero — which is the honest way to describe it rather than pretending the gate caught it.

Patching is not remediation. CVE-2026-56155 was exploited before the fix existed. Microsoft has not published how. Alongside the update Microsoft is staging a hardening change to the AD FS Distributed Key Manager container ACL under KB5121391: after the July update the service enters Audit mode, checks the ACL at startup and every 24 hours, and raises Event ID 1132 where permissions need attention without changing them. Automatic remediation is planned to begin on 13 October 2026 unless opted out. Two things follow. Hunt for token-signing and DKM access predating install rather than assuming the patch closed the story. And treat Event 1132 as a finding to work now, because the audit phase is a grace period, not a fix.

Then. Two changes in this package have nothing to do with security and will generate tickets. Microsoft is blocking the Windows 11 updates on some Dell devices that shut down or lose performance after installing. And a security hardening change now enforces TDI transport registration, so applications using sockets over unregistered third-party TDI transports may stop working — that is a class of legacy networking and endpoint agent software, and it will not announce itself in advance.

Why now. An attacker sends a mail. The victim opens it in OWA. JavaScript runs in their authenticated session — no attachment, no macro prompt, no click beyond reading the message. The scope-changed CVSS means it breaks out of the web app context. Under EXVORA S10.3 this is scored at the chained outcome, not at the first link's label, which is why a flaw Microsoft titles Spoofing outranks most of this month's Critical remote code execution. Microsoft rates it Exploitation More Likely and nothing yet says it is being used.

Also inside: The same update ships CVE-2026-55009 and further Exchange fixes. Exchange 2016 and 2019 are out of support: only organisations enrolled in Period 2 ESU, valid May to October 2026, receive them, and Microsoft distributes those privately rather than through a public download. If you run 2016 or 2019 without Period 2 ESU, this unit has no deployable artifact for you and the mitigation lane is the only lane you have.

Then. The July update is the build Microsoft blesses for removing the CVE-2026-42897 mitigations. Do not remove them early: the Exchange Emergency Mitigation service change that stops re-applying M2.1.0 was rolling out with a stated completion of 16 July, so until it lands the service re-applies what you removed. Block M2.1.0 then remove its IIS rules, or roll back via the EOMT script if you deployed it that way.

Why now. Same deserialization shape as the SharePoint pair, same 9.8, same unauthenticated and network-reachable profile — and it is easy to miss precisely because it is not SharePoint. The trigger is a crafted login request, so authentication is not a barrier: it is the attack surface. Microsoft rates it Exploitation More Likely. This unit reaches Act structurally, with no exploitation signal, which is the one call in this brief the evidence does not yet back.

Then. The package is not established here — resolve it against the Security Update Guide for your Business Central or NAV build before scheduling, and do not assume the Windows update reaches it. Where the on-premises server is published to the internet, the deployment order argument is over: it is a listed exposed technology with an unauthenticated 9.8.

Why now. It is not now. Office is the largest single block of Critical-rated items in this release and none of it is exposed technology or core infrastructure, so the tree never reaches the impact gate and the answer is Track on the normal cycle. ZDI flags a Preview Pane attack vector within the Office set, which is a real caveat and is called out in the caveats below as a place the model is thin.

Then. Patch Office and reboot on the normal cycle. Do not let the Critical label pull it ahead of the four Act units — it is Critical because a user opening a file can lose their session, not because anyone can reach it unbidden.