Answer Brief
GovCERT.HK has issued a High Threat Security Alert (A26-07-21) warning of multiple actively exploited vulnerabilities in Microsoft products, including two elevation-of-privilege flaws (CVE-2026-56155 and CVE-2026-56164) being used in the wild, affecting Windows, Office, SharePoint, SQL Server, .NET, Visual Studio, and related systems.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
GovCERT.HK publishes High Threat Security Alert A26-07-21 on Microsoft vulnerabilities
- 2
Microsoft releases July 2026 security updates addressing multiple vulnerabilities
- 3
Alert fetched and processed by Nogosee Intelligence at 02:16 UTC
Executive Summary: GovCERT.HK has issued a High Threat Security Alert (A26-07-21) warning of multiple actively exploited vulnerabilities in Microsoft products, including two elevation-of-privilege flaws (CVE-2026-56155 and CVE-2026-56164) being used in the wild, affecting Windows, Office, SharePoint, SQL Server, .NET, Visual Studio, and related systems.
Why It Matters
GovCERT.HK’s High Threat Security Alert (A26-07-21) underscores a significant and immediate risk posed by multiple vulnerabilities in widely deployed Microsoft products, with confirmed active exploitation of two elevation-of-privilege flaws—CVE-2026-56155 and CVE-2026-56164—in the wild. The alert, published on July 15, 2026, aligns with Microsoft’s July 2026 Patch Tuesday release and serves as a regionally sourced warning with relevance to organizations using the affected technologies globally. While issued by Hong Kong’s government computer emergency response team, the advisory does not indicate Hong Kong-specific targeting; instead, it reflects first-hand monitoring of global threat activity that carries operational value for security teams worldwide, particularly those managing hybrid Windows environments, enterprise Office suites, and cloud-connected developer toolchains.
The technical scope of the alert is broad, spanning client and server operating systems, productivity applications, collaboration platforms, database systems, development frameworks, and security tools. Affected components include Windows 10 and 11 (including the 26H1 release), Windows Server editions from 2012 to 2025, and a comprehensive list of Microsoft Office versions—both perpetual licenses (LTSC 2021, 2024) and subscription-based offerings like Microsoft 365 Apps for Enterprise and Office 365 for Mac. Notably, server-side products such as SharePoint Enterprise Server 2016, SharePoint Server 2019, SharePoint Subscription Edition, and SQL Server 2025 are included, raising concerns for potential exploitation in internal infrastructure and data-tier systems.
Technical Signal
Developer and operational toolchains are also heavily impacted, with vulnerabilities affecting Visual Studio 2022 and 2026, .NET 8.0, 9.0, and 10.0 across Linux, macOS, and Windows, as well as legacy .NET Framework versions still prevalent in enterprise environments. The inclusion of Visual Studio Code, Microsoft Copilot, and Microsoft Defender for Endpoint for Mac extends the risk surface to modern DevOps and AI-augmented workflows, where exploitation could lead to credential theft, lateral movement, or compromise of build pipelines. The alert notes that successful exploitation could result in remote code execution, denial of service, elevation of privilege, information disclosure, security restriction bypass, spoofing, or tampering—covering a full spectrum of impact from initial access to persistence and data exfiltration.
The explicit confirmation that CVE-2026-56155 and CVE-2026-56164 are being actively exploited elevates the urgency beyond typical patch guidance. Active exploitation indicates that threat actors have developed working exploits and are deploying them in real-world attacks, increasing the likelihood of compromise for unpatched systems. Elevation-of-privilege vulnerabilities are particularly dangerous in post-exploitation scenarios, allowing attackers who gain initial footholds (e.g., via phishing or malware) to escalate to SYSTEM or root-level access, thereby bypassing security controls and enabling deeper network penetration.
Operational Impact
For global security, AI security, cloud, identity, and operations teams, this alert serves as a critical signal to validate patch compliance across Windows and Microsoft ecosystems, especially in environments where legacy systems or delayed update cycles may leave gaps. Given the widespread use of Microsoft 365, Azure AD-integrated services, and hybrid Active Directory deployments, unpatched elevation-of-privilege flaws could undermine identity security and conditional access policies. Operations teams should prioritize patching domain controllers, file servers, and SharePoint/SQL infrastructure, while cloud teams must assess exposure in Azure Virtual Machines, Windows 365, and Windows Server workloads.
The alert also highlights the importance of third-party threat intelligence sources like GovCERT.HK in providing early, actionable warnings. Although the vulnerability details originate from Microsoft, the GovCERT.HK alert adds value by confirming active exploitation—a detail not always immediately emphasized in vendor advisories—and by contextualizing the risk for regional stakeholders. Security teams should monitor GovCERT.HK, HKCERT, and other national CERT feeds as part of a diversified intelligence strategy to catch early signals of exploit activity.
What To Watch
Looking ahead, defenders should watch for post-exploitation patterns linked to these CVEs, including attempts to abuse elevated privileges for credential dumping, lateral movement via SMB or WMI, or deployment of ransomware and espionage tools. There is no indication in the alert of specific threat actor attribution, malware families, or victim sectors, so claims about APT involvement or regional targeting should be avoided. Instead, focus should remain on rapid patch validation, exploit monitoring (e.g., via EDR or network telemetry), and reinforcing least-privilege access controls to limit the impact of any successful privilege escalation attempt.
Event Type: security
Importance: high
Affected Companies
- GovCERT.HK
- Microsoft
Affected Sectors
- Cybersecurity
- Enterprise Software
- Government
- Information Technology
Key Numbers
- Actively exploited CVEs cited: 2
- Microsoft product families affected: 10+
- Alert identifier: A26-07-21
Timeline
- GovCERT.HK publishes High Threat Security Alert A26-07-21 on Microsoft vulnerabilities
- Microsoft releases July 2026 security updates addressing multiple vulnerabilities
- Alert fetched and processed by Nogosee Intelligence at 02:16 UTC
Frequently Asked Questions
Which specific vulnerabilities are being actively exploited according to the GovCERT.HK alert?
The alert identifies two elevation-of-privilege vulnerabilities—CVE-2026-56155 and CVE-2026-56164—as being exploited in the wild. These flaws allow attackers to gain higher system privileges on compromised systems, potentially enabling full control if combined with other exploits.
Which Microsoft products and versions are affected by the vulnerabilities outlined in the alert?
Affected systems include Windows 10, 11, and 11 version 26H1; Windows Server 2012 through 2025; Microsoft Office 2016, 2019, LTSC 2021/2024 (Windows and Mac), Office 365 for Mac, Office Online Server; Microsoft Excel and Word 2016; Microsoft 365 Apps for Enterprise; SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition; SQL Server 2025; Visual Studio 2022 and 2026; .NET 8.0, 9.0, and 10.0 on Linux, macOS, and Windows; .NET Framework 3.5 through 4.8.1; Visual Studio Code; Microsoft Copilot; and Microsoft Defender for Endpoint for Mac.
What immediate actions should organizations take in response to this GovCERT.HK alert?
Organizations should immediately apply the available security updates via Windows Update or the Microsoft Update Catalog. Prioritize patching systems exposed to the internet or handling sensitive data. Monitor for signs of exploitation, especially around the two actively exploited CVEs, and follow vendor guidance to mitigate risks of remote code execution, privilege escalation, and data disclosure.