AD FS elevation of privilege — insufficient access-control granularity
Active Directory Federation Services access-control granularity flaw lets an authorized attacker escalate privileges locally. Exploited in the wild; added to CISA KEV 2026-07-14.
- Vendor
- Microsoft
- Product
- Active Directory Federation Services (AD FS) — see MSRC advisory for affected builds
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.3%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-56155 being exploited?
Yes. CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-56155 is an elevation-of-privilege vulnerability in Microsoft Active Directory Federation Services caused by insufficient granularity of access control. Per Microsoft’s advisory, an authorized attacker can use it to elevate privileges locally on the AD FS host. NVD scores it 7.8 (high). Microsoft rates it Important. Credited to Microsoft’s DART team.
Microsoft shipped the fix in the July 2026 Patch Tuesday release on 2026-07-14 and confirmed active exploitation. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, bringing it under BOD 26-04 remediation timelines for federal civilian agencies.
Because AD FS typically fronts downstream authentication for Microsoft 365 and on-prem federated apps, a compromise here is a credentialed identity-plane compromise. Patch first; treat any pre-patch anomaly in AD FS logs as a lead worth chasing.
See the write-up: Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 1.5% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 3.6% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-62916 Authentication Bypass via Alternate Path in Microsoft Entra IDwrite-up | [ CRITICAL ] | 9.1 | 0.9% | — |
