Act nowKnown exploited

Advisory · CVE-2026-56155

AD FS access-control gap lets local users become admins

Insufficient access control granularity in AD FS allows an authorized local attacker to elevate to administrator; Microsoft reports functional exploit code and detected exploitation.

Advisory published July 14, 2026Independent summary
Vendor
Microsoft
Product
Active Directory Federation Services
Identifier / CWE
CVE-2026-56155
CWE-1220
Action timing
Aug 4, 2026
ELI5

Explain it like I’m five

AD FS is the office that prints employee badges. A flaw in its filing rules lets a regular employee refile themselves as the building manager and print a manager badge.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Local foothold

    The attacker already has low-privilege authorized access on the AD FS server.

  2. 02Access control gap

    Insufficient granularity of access control in AD FS fails to contain the low-privilege account.

  3. 03Elevation

    The attacker elevates privileges locally, and Microsoft confirms administrator privileges can be gained.

  4. 04Identity at risk

    Administrative control of AD FS threatens the tokens it issues across federated applications.

What happened

CISA added CVE-2026-56155 to the Known Exploited Vulnerabilities catalog on July 14, 2026, the same day Microsoft published the fix. Insufficient granularity of access control in Active Directory Federation Services allows an authorized attacker to elevate privileges locally. Microsoft’s Security Update Guide rates it Important at CVSS 7.8, states that functional exploit code is available, marks exploitation as detected, and confirms in its FAQ that a successful attacker “could gain administrator privileges.”

NVD data shows the flaw affects a wide range of Windows builds, from Windows Server 2012 through Windows Server 2025 and Windows 10 1607/1809, with the July 2026 security updates carrying the fix. The attack requires local, low-privilege access and no user interaction.

What to do

  1. Apply the July 2026 Windows security updates to all AD FS servers without delay.
  2. Audit local administrator and privileged accounts on every AD FS host for anything unexpected.
  3. Review AD FS and Windows security logs for local privilege escalation activity and anomalous use of AD FS service accounts or certificates.
  4. If elevation is suspected, treat AD FS signing certificates and service account credentials as potentially compromised and rotate them under your incident response process.
  5. Keep AD FS servers hardened and isolated: they should not be general-purpose hosts where low-privilege users routinely get accounts.

Management note

AD FS is identity infrastructure, not just another server: it vouches for who your users are to every federated application. Administrator compromise of an AD FS host is one step from forging trusted authentication tokens. The local-access requirement is real but thin comfort, since attackers who reach this stage almost always already have a foothold somewhere. Patch it like the keys to the building, because that is what it is.