Microsoft published manual repair instructions on July 21 for the update server software that had kept two actively exploited security holes from reaching corporate networks for more than a week. The guidance, catalogued as KB5121986, tells administrators how to strip years of accumulated metadata out of Windows Server Update Services (WSUS) databases so patching can resume. A federal deadline to fix one of those two holes had already expired four days earlier.
Federal civilian agencies are legally bound to patch both flaws on a compliance clock run by the Cybersecurity and Infrastructure Security Agency (CISA). That clock kept running through an outage those agencies did not cause and could not repair themselves, because the failure sat entirely inside Microsoft’s own publishing infrastructure.
What Broke, and the Fix Microsoft Shipped This Week
WSUS normally syncs once a day with Microsoft Update, pulling metadata that covers product categories, update classifications, applicability rules, supersedence relationships and detectoid logic. That metadata piles up in a SQL database called SUSDB. On affected servers, the pile grew past what the IIS hosted WsusPool application pool could process in a single sync request, so operations timed out or failed outright.
The practical effect: administrators could not discover, approve or distribute new patches through WSUS, and Microsoft Configuration Manager broke with it, since it uses WSUS as its upstream catalog. In multi-tier WSUS hierarchies, the failure cascaded from parent servers down to every replica.
This was not a client bug or a bad cumulative update. It was Microsoft’s own publishing pipeline. The company’s release health dashboard showed heightened impact beginning July 13, one day before that month’s Patch Tuesday releases started flowing.
KB5121986 lays out three operations administrators must run in sequence:
- Back up every SUSDB database in the WSUS hierarchy, including replica servers, before touching anything.
- Run a targeted SQL cleanup query from SQL Server Management Studio against each SUSDB instance to strip out the mis-published detectoid metadata.
- Reset the MaxXMLPerRequest registry value back to its default once sync stabilizes.
Microsoft’s own guidance for the cleanup query also directs admins to reindex SUSDB, run the WSUS Server Cleanup Wizard, then run IISReset or recycle the WsusPool application pool. The first client scan after cleanup runs slower as it catches up; later scans return to normal. The client side DataStore.edb file will not shrink right away either. Microsoft says that is expected and does not hurt scan performance.
How an Eight Day Outage Collided With a Record Patch Tuesday
The timing stacked one crisis on top of another. Here is how the eight days broke down:
- July 13, 2026: Microsoft’s release health dashboard shows WSUS sync impact intensifying across affected servers.
- July 14, 2026: Microsoft ships 622 CVEs, its largest Patch Tuesday on record, including three zero days. Two are added to CISA’s Known Exploited Vulnerabilities (KEV) catalog the same day.
- July 17, 2026: The federal remediation deadline for the SharePoint flaw passes while WSUS sync remains broken for production servers.
- July 18, 2026: Microsoft ships a service side mitigation that restores sync for new and rebuilt WSUS servers only.
- July 21, 2026: Microsoft publishes KB5121986, the manual cleanup path for existing production servers.
A third zero day, CVE-2026-50661 in BitLocker, was publicly disclosed the same day but has not been listed as actively exploited. It got folded into the same record release without the same urgency attached.
Federal Agencies Faced a Deadline They Could Not Control
CISA’s KEV catalog exists to force fast patching of flaws already being used in attacks. Federal Civilian Executive Branch (FCEB) agencies are required to remediate cataloged vulnerabilities inside set windows, regardless of what caused the delay.
The rulebook behind that clock just changed. The original mandate, a 2021 directive that set fixed remediation deadlines, has been revoked. It was replaced by a newer directive tying remediation windows to exposure risk, weighing factors like whether an asset faces the public internet. The KEV catalog itself carries on underneath either version.
Private companies are not legally bound by that directive. Many follow the same catalog anyway, especially government contractors and organizations trying to demonstrate a mature security posture, because the deadlines have become a de facto industry benchmark well beyond the federal agencies the rule technically covers.
None of that mattered for the outage itself. Agencies bound by the clock had no path to compliance, because WSUS, the very tool many of them use to physically push the patch, was the broken part. There was no workaround until Microsoft repaired its own infrastructure.
Two Zero-Days, Two Discovery Stories
The two exploited flaws hit different corners of enterprise identity and collaboration infrastructure, and they surfaced through different channels entirely.
| Flaw | Affected System | Attacker Capability | Discovered By | CISA Deadline |
|---|---|---|---|---|
| CVE-2026-56164 | SharePoint Server 2016, 2019, Subscription Edition | Unauthenticated privilege escalation, no user interaction | Mandiant and Google’s FLARE team | July 17, 2026 (passed) |
| CVE-2026-56155 | Active Directory Federation Services (AD FS) | Local admin control, forged authentication tokens | Microsoft’s own DART unit | July 28, 2026 (open) |
CVE-2026-56164 was not caught by Microsoft’s own telemetry. Multiple security researchers tracking the bug credit its discovery to Mandiant and Google’s FLARE incident response team, found during active attack investigations rather than routine research. CVE-2026-56155, by contrast, is credited to Microsoft’s own Detection and Response Team (DART), its internal incident response unit, a detail that points to Microsoft catching that one inside its own customers’ breaches.
Both flaws landed in the government’s exploited vulnerabilities catalog entry logged the same day patches shipped, July 14.
Why Did Microsoft Score a Critical Flaw as Moderate?
Microsoft rated the SharePoint flaw 5.3 and Moderate because its own scoring vector recorded no confidentiality or availability impact and only low integrity impact. Independent analysts scored the identical bug 9.8 and Critical, because it lets an unauthenticated attacker take over a server remotely with zero credentials and zero user interaction required.
Security teams tracking the bug split sharply on how to read it:
- Microsoft’s own scoring rates the flaw 5.3, Moderate, based on its assessment of limited confidentiality and availability impact.
- The National Vulnerability Database independently scores the same flaw 9.8, Critical, weighing the unauthenticated, zero-click network access on its own.
- Security research firms including Rapid7, Tenable and Orca Security all published the 9.8 figure and warned that sorting the release by Microsoft’s number alone would bury the bug behind dozens of lower priority tickets.
Rapid7’s own tracking placed the flaw’s predicted exploitation likelihood in the 92nd percentile, a figure far higher than a 5.3 label would suggest to an automated patch queue. Tenable’s own vulnerability tracking lists the same 9.8 critical severity sourced to MITRE and the NVD.
A Deprecated Product’s Fourth Outage
This is the fourth WSUS synchronization failure in fourteen months, following incidents in May 2025, July 2025 and August 2025 that each required manual intervention and each delayed patch deployment windows.
Microsoft deprecated WSUS on September 20, 2024, meaning no new features and no further reliability engineering investment is planned for the product going forward. Its recommended path forward is cloud tools: Windows Autopatch and Microsoft Intune for client devices, Azure Update Manager for servers.
SharePoint adds a second layer of bad timing on top of that. SharePoint Server 2016 and 2019 reached end of extended support on July 14, 2026, the exact day Microsoft shipped the patch for the actively exploited flaw inside them. Organizations still running those builds were patching software that had gone out of support hours earlier.
Microsoft’s patch record carries other long tail cases beyond WSUS. Earlier this year the company closed a Secure Boot hole that sat open for thirteen years, a separate reminder that old debt sits inside its update mechanisms well beyond this one product.
The July 28 Deadline Is Still Open
Organizations with WSUS servers still stuck should follow KB5121986 in order: back up first, run the cleanup query against every SUSDB in the hierarchy, then reset MaxXMLPerRequest. Skipping the backup step or cleaning only the top level server will not resolve downstream replicas.
Once sync is restored, deployment of July’s cumulative updates becomes the immediate job. SharePoint patches need to reach every on premises instance, internet facing servers first. AD FS patches need to reach all federation infrastructure, since a compromised token signing host can impersonate any user across every connected application.
As of publication, six days remain before the AD FS deadline arrives. The SharePoint deadline is already gone.
Frequently Asked Questions
Does the KB5121986 cleanup work the same way on WSUS servers using Windows Internal Database instead of full SQL Server?
Largely yes, but the connection steps differ. Microsoft’s own troubleshooting documentation for SUSDB maintenance notes that administrators must first check the SQLServerName registry entry to confirm whether the database runs on a full SQL Server instance or Windows Internal Database, since the reindexing method and required tools differ between the two.
Is the SharePoint flaw’s low CVSS score a reason to deprioritize the patch?
No. Multiple research firms tracking CVE-2026-56164 have said explicitly that ranking it by Microsoft’s 5.3 score alone would be a mistake, given confirmed active exploitation, zero required credentials and zero user interaction. Administrators are advised to treat internet-facing SharePoint farms as an emergency patch regardless of where the number places it in an automated queue.
What changed when CISA replaced its original 2021 directive with the newer risk-based one?
The new directive ties remediation timelines to specific risk variables, including whether the vulnerable asset is exposed to the public internet, rather than applying one fixed countdown to every cataloged flaw. The underlying Known Exploited Vulnerabilities catalog that both directives draw from continues unchanged.
Does WSUS deprecation mean it will stop receiving security updates?
No. Microsoft has said security updates will keep arriving through the WSUS channel and that the product will keep functioning for the foreseeable future. Deprecation means no new features and no further architectural investment, not an end of support date.
Are private companies legally required to meet CISA’s KEV catalog deadlines?
No. The binding directive applies only to Federal Civilian Executive Branch agencies. Many private organizations, particularly government contractors and companies maturing their security programs, choose to follow the same deadlines voluntarily because the catalog has become a widely recognized benchmark outside the agencies it legally covers.
