CVE-2026-56155
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Description
CVE-2026-56155 is a high-severity privilege escalation vulnerability in Microsoft Active Directory Federation Services (AD FS) caused by insufficient granularity of access control. An authorized attacker with low privileges on an affected Windows system can exploit the flaw locally to elevate their privileges, gaining high impact on confidentiality, integrity, and availability. The vulnerability affects a broad range of Windows versions, from Windows 10 and Windows Server 2012 through Windows Server 2025. CVE-2026-56155 matters because AD FS sits at the heart of enterprise identity infrastructure and because CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are actively exploiting it in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.9339 |
| microsoft | windows 10 1809 | < 10.0.17763.9020 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.9339 |
| microsoft | windows server 2019 | < 10.0.17763.9020 |
| microsoft | windows server 2022 | < 10.0.20348.5386 |
| microsoft | windows server 2025 | < 10.0.26100.33158 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155(US Government Resource)
Weakness Type
CWE-1220: Insufficient Granularity of Access Control
Insufficient granularity of access control occurs when a protection mechanism does not enforce permissions at a fine-grained enough level, allowing attackers to bypass the intended restrictions. In Active Directory Federation Services, this coarse-grained access control means an authorized low-privileged user can reach operations or resources that should be restricted, enabling local privilege escalation on the AD FS host.
Learn more: CWE-1220 — Insufficient Granularity of Access Control
Impact Analysis
CVE-2026-56155 is rated High with a CVSS 3.1 score of 7.8. Exploitation requires local access with low privileges, but is easy to exploit once that foothold exists — attack complexity is low and no user interaction is required, so an attacker who has compromised any low-privileged account on an affected server can escalate without waiting for an administrator to act. All three impact metrics are rated High: a successful exploit gives the attacker access to sensitive data on the system (confidentiality), the ability to modify system state and configuration (integrity), and the ability to disrupt services (availability). Because AD FS is a central component of enterprise authentication and federation, compromise of an AD FS server can have consequences far beyond the single host, potentially undermining trust in the organization's identity infrastructure. The confirmed active exploitation via CISA's KEV listing elevates the urgency well beyond what the moderate EPSS score alone would suggest.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-56155 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation due date of 2026-07-28; use in ransomware campaigns is currently unknown. No public exploit code or proof-of-concept is referenced in the available sources, which consist of the Microsoft MSRC advisory and the CISA KEV entry. The EPSS score of about 0.4% (30th percentile) indicates a low predicted probability of broad exploitation, but the KEV listing shows that targeted real-world attacks are already occurring, so patching AD FS servers should be prioritized regardless of the low EPSS value.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with Microsoft's instructions, ensuring compliance with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and CISA's Forensics Triage Requirements; discontinue use if mitigations are unavailable. The KEV remediation due date is 2026-07-28.
- Install the Microsoft security update per the MSRC advisory for CVE-2026-56155, bringing affected systems to at least the fixed builds: Windows 10 1607 / Server 2016 to 10.0.14393.9339, Windows 10 1809 / Server 2019 to 10.0.17763.9020, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 to 10.0.26100.33158; Windows Server 2012 and 2012 R2 are also affected and must be updated per vendor guidance.
- Until patched, minimize the local attack surface on AD FS servers: restrict who can log on locally or via remote sessions, remove unnecessary local accounts, and treat AD FS hosts as Tier-0 identity infrastructure with tightly controlled administrative access.
- Monitor AD FS servers for signs of privilege escalation, such as unexpected privileged process creation, changes to AD FS configuration, or anomalous activity from low-privileged accounts, and perform forensic triage on any system suspected of compromise in line with CISA guidance.
- Longer term, apply the principle of least privilege consistent with CWE-1220 mitigation practice: define separate, fine-grained permissions for distinct operations and resources so that low-privileged accounts cannot reach security-sensitive functionality.
Technical Details
The root cause of CVE-2026-56155 is insufficient granularity of access control (CWE-1220) in Active Directory Federation Services: the protection mechanism does not restrict access finely enough, granting broader effective permissions than the principle of least privilege would require. An attacker who already holds low-privileged, authorized access to an affected Windows system can leverage this coarse-grained control to perform operations that should be reserved for higher-privileged contexts, elevating privileges locally. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the exploitation profile: local attack vector with low complexity, low privileges required, no user interaction, and unchanged scope, but full compromise of confidentiality, integrity, and availability on the affected host. Given the role of AD FS in federated authentication, an escalation on the AD FS server is a high-value step in a broader intrusion chain against Microsoft enterprise environments.
Frequently Asked Questions
Is CVE-2026-56155 being actively exploited?
Yes. CISA has added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, with a remediation due date of 2026-07-28. The EPSS score of roughly 0.4% suggests exploitation is not widespread, and ransomware usage is currently unknown, but the KEV listing makes timely patching mandatory for exposed organizations.
What products are affected by CVE-2026-56155?
The vulnerability affects Active Directory Federation Services on a wide range of Microsoft Windows versions. Affected systems include Windows 10 1607 (before 10.0.14393.9339), Windows 10 1809 (before 10.0.17763.9020), Windows Server 2012 and 2012 R2, Windows Server 2016 (before 10.0.14393.9339), Windows Server 2019 (before 10.0.17763.9020), Windows Server 2022 (before 10.0.20348.5386), and Windows Server 2025 (before 10.0.26100.33158).
How do I fix CVE-2026-56155?
Install the Microsoft security update referenced in the MSRC advisory for CVE-2026-56155 so that affected systems reach the fixed build numbers. Until then, restrict local and remote logon access to AD FS servers, treat them as Tier-0 identity infrastructure, and monitor for signs of local privilege escalation.
How severe is CVE-2026-56155?
CVE-2026-56155 is rated High with a CVSS 3.1 score of 7.8. A local attacker with low privileges can gain full control over confidentiality, integrity, and availability of the affected system without any user interaction. Its EPSS score sits around the 30th percentile, but confirmed active exploitation of a core identity component like AD FS makes it a high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.