~/f4n6 $ grep -r "CVE-2026-56155 — Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability" ./investigations/ --include="*.md"

CVE-2026-56155 — Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Jeff Davies 14 Jul 2026 8 min read

1. Executive summary

CVE-2026-56155 is an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Active Directory Federation Services (AD FS) that allows an authorized, authenticated attacker to elevate privileges locally and gain administrator privileges. The vulnerability carries a CVSS 7.8 (HIGH) rating and was confirmed by CISA to be under active exploitation in the wild, with the flaw added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14. The vulnerability was discovered and reported by researchers with the Microsoft Detection and Response Team (DART). EMEA financial services organizations running affected Windows Server versions hosting AD FS roles face immediate risk of privilege escalation by threat actors who have already established local access.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 17: ICT-related incident management process Confirmed active exploitation of a locally exploitable privilege escalation flaw in AD FS, a critical identity infrastructure component. Financial entities must ensure their ICT-related incident management process can detect and respond to exploitation of this vulnerability on AD FS servers.
DORA Art. 18: classification of ICT-related incidents and cyber threats Active exploitation confirmed by CISA KEV; CVSS 7.8 HIGH; potential for full administrative compromise of federation services. Incidents involving this CVE must be classified according to the entity's ICT incident classification taxonomy, accounting for the HIGH severity and identity-infrastructure impact.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities Active exploitation of AD FS could compromise federated identity services, potentially impacting authentication across multiple relying-party applications and business functions. If exploitation is confirmed in a client environment, assess whether the incident meets the major-incident threshold for reporting to competent financial authorities.
DORA Art. 24: digital operational resilience testing — general requirements AD FS is internet-exposed identity infrastructure; the vulnerability is under active exploitation. Prioritise patching and vulnerability testing of AD FS deployments as part of the entity's digital operational resilience testing programme.
NIS2 Art. 21(2)(d): supply chain security measures Microsoft is a critical ICT supplier; the vulnerability affects core Windows Server operating systems and AD FS identity infrastructure. Ensure supply-chain security measures account for rapid patching of vendor-supplied identity infrastructure components under active exploitation.
NIS2 Art. 23: incident reporting obligations Active exploitation confirmed; potential for significant impact on essential services relying on federated authentication. NIS2 in-scope organisations must evaluate whether exploitation triggers early warning and incident notification obligations within prescribed timelines.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDP duties Active exploitation of identity infrastructure vulnerabilities could impact the availability and integrity of operator/RDSP services. UK OES and RDSPs should assess AD FS exposure and ensure patching aligns with their NIS regulatory duties for securing network and information systems.

3. Technical analysis & attack chain

Vulnerability mechanism

CVE-2026-56155 is an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Active Directory Federation Services (AD FS). The flaw exists in the access control model governing AD FS administrative operations, where the granularity of permissions is insufficient to properly restrict an authenticated, authorised user from performing administrative actions beyond their intended scope. The CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, confirming that exploitation requires local access, low attack complexity, and low privileges, but yields full impact across confidentiality, integrity, and availability.

Affected products and versions

Based on NVD CPE data, affected configurations include:

  • Windows Server 2012 (x64-based Systems) — versions from 6.2.9200.0 up to (excluding) 6.2.9200.26226
  • Windows Server 2012 R2 — all versions
  • Windows Server 2016 — versions up to (excluding) 10.0.14393.9339
  • Windows Server 2019 — versions up to (excluding) 10.0.17763.9020
  • Windows Server 2022 — versions up to (excluding) 10.0.20348.5386
  • Windows Server 2025 — versions up to (excluding) 10.0.26100.33158
  • Windows 10 Version 1607 (32-bit and x64-based) — versions up to (excluding) 10.0.14393.9339
  • Windows 10 Version 1809 (32-bit and x64-based) — versions up to (excluding) 10.0.17763.9020

Attack chain (confirmed steps)

  1. Initial access (precondition): The attacker must already possess an authorised, authenticated local session on a server hosting the AD FS role. The vulnerability is not remotely exploitable without prior access. The attack vector is local (AV:L).
  2. Privilege escalation via access control bypass: The attacker exploits the insufficient granularity of access control within AD FS to perform administrative operations that should be restricted to higher-privileged accounts. The low attack complexity (AC:L) and low privilege requirement (PR:L) indicate that a standard authenticated user on the AD FS server can execute the exploit.
  3. Administrator-level control: Successful exploitation grants the attacker administrator privileges on the AD FS server, providing full control over the federation service configuration, trust relationships, claim rules, and token-signing certificates.
  4. Post-exploitation impact: With administrator access to AD FS, an attacker could modify federation trust configurations, alter claim issuance rules to inject or modify claims in issued tokens, access or export token-signing and token-decrypting certificates, and potentially pivot to compromise federated applications and cloud services (e.g., Microsoft 365, Azure AD/Entra ID) that trust the AD FS instance.

Attribution and confidence

The vulnerability was credited to researchers with the Microsoft Detection and Response Team (DART). No threat actor attribution has been published by Microsoft, CISA, or any source in the provided material. The CISA KEV entry confirms active exploitation but does not name a responsible actor. No MITRE ATT&CK actor profile is available in the verified reference data for any named actor associated with this CVE. Attribution of exploitation to any specific threat actor is unconfirmed.

Confidence caveats

  • The active exploitation state is corroborated by multiple sources: CISA KEV catalog (added 2026-07-14), Tenable Research, SANS ISC, and The Register. High confidence on exploitation status.
  • Technical details of the exploit mechanism beyond the CWE classification and CVSS vector are single-sourced from the NVD entry and Microsoft advisory description. No public proof-of-concept or exploit code details are available in the source material.
  • The CISA ADP (Automated Vulnerability Exploitation) assessment records exploitation as "active," automatable as "no," and technical impact as "total" — consistent with the CVSS vector indicating full C/I/H impact.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory AD FS deployments: Identify all servers in the environment running the AD FS role, including AD FS proxy/Web Application Proxy (WAP) servers. Cross-reference against the affected CPE list above. Prioritise servers running Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
  2. Apply the July 2026 Patch Tuesday update: Install the security update referenced in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155. Target the following minimum build versions based on NVD CPE data: - Windows Server 2016 / Windows 10 1607: ≥ 10.0.14393.9339 - Windows Server 2019 / Windows 10 1809: ≥ 10.0.17763.9020 - Windows Server 2022: ≥ 10.0.20348.5386 - Windows Server 2025: ≥ 10.0.26100.33158 - Windows Server 2012: ≥ 6.2.9200.26226
  3. Restrict local access to AD FS servers: Review and revoke unnecessary local accounts and RDP/WinRM access to AD FS servers. Enforce jump-host / privileged access workstation (PAW) patterns for administrative access. This directly addresses the AV:L / PR:L preconditions.
  4. Audit for signs of prior exploitation: Review AD FS server event logs for anomalous administrative activity, unexpected changes to federation trust relationships, claim rules, or token-signing certificate operations. Check for unauthorised local account creation or privilege escalation events (Event IDs 4624, 4672, 4720, 4732, 4738).

P2 — Within 72 hours

  1. Hunt for post-exploitation artefacts: Examine AD FS configuration for unauthorised modifications: - Verify token-signing and token-decrypting certificates have not been exported or replaced. - Review all relying-party trusts and claims provider trusts for unauthorised additions or modifications. - Check AD FS claim rules for injected rules that could issue elevated claims (e.g., unrestricted http://schemas.microsoft.com/ws/2008/06/identity/claims/role issuance).
  2. Monitor federated application sign-ins: Review sign-in logs in Microsoft 365 / Entra ID and other federated applications for anomalous authentication patterns, token reuse, or unexpected claims in issued tokens following AD FS token issuance.
  3. EDR coverage: Ensure endpoint detection and response agents are deployed and active on all AD FS servers with up-to-date detection signatures. Configure alerting for privilege escalation behaviour on these hosts.

P3 — Within 7 days

  1. Validate patch deployment completeness: Confirm all AD FS servers, including secondary/proxy nodes in the farm, are patched to the minimum required build versions. Verify AD FS farm health post-patch using the AD FS Diagnostics tool.
  2. Review AD FS administrative model: Audit which accounts and groups hold administrative privileges over the AD FS service. Implement least-privilege by separating AD FS service administration from local server administration where possible.
  3. CISA KEV remediation deadline: CISA's BOD 26-04 sets a remediation due date of 2026-07-28 for federal agencies. While BOD 26-04 is a US federal directive, EMEA financial services organisations should treat this as a benchmark and aim to complete remediation by this date or sooner given active exploitation.

5. Indicators of compromise

No indicators of compromise (IOCs) — file hashes, IP addresses, domains, or command-line artefacts — are available in the source material. The vulnerability is a local privilege escalation flaw, and no specific exploit artefacts have been publicly disclosed.

6. Detection

No specific exploit artefacts, command-line strings, file paths, registry keys, or mutex names associated with exploitation of CVE-2026-56155 are present in the source material. However, the following Sigma rule targets the behavioural pattern consistent with the vulnerability's local privilege escalation on AD FS servers:

title: Privilege Escalation on AD FS Server — CVE-2026-56155 Pattern
id: 7a1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: >
  Detects local privilege escalation events on servers hosting the Active Directory
  Federation Services role, consistent with exploitation of CVE-2026-56155
  (insufficient granularity of access control in AD FS). Triggers on administrative
  privilege assignment or local group membership changes on AD FS servers.
references:

  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
  - https://nvd.nist.gov/vuln/detail/CVE-2026-56155
author: Adverse Trace
date: 2026-07-14
tags:

  - attack.privilege-escalation
  - attack.t1068
logsource:
  product: windows
  service: security
detection:
  adfs_host_process:
    Image|endswith:

      - '\Microsoft.IdentityServer.ServiceHost.exe'
      - '\Microsoft.Tri.Sensor.exe'
  priv_esc_events:
    EventID:

      - 4672  # Special privileges assigned to new logon
      - 4732  # Member added to security-enabled local group
      - 4738  # User account changed
  filter legitimate_admin:
    SubjectUserName|contains:

      - 'MSOL_'
      - 'ADFSSVC'
  condition: priv_esc_events and not filter_legitimate_admin
falsepositives:

  - Legitimate administrative activity on AD FS servers by authorised administrators
  - AD FS service account operations
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

CVE CVSS Exploited EPSS Summary
CVE-2026-56155 7.8 High ⚠ KEV 2026-07-14 — Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to ele…

7. Sources

  • NVD, CVE-2026-56155 — Insufficient granularity of access control in Active Directory Federation Services, https://nvd.nist.gov/vuln/detail/CVE-2026-56155, published 2026-07-13
  • CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-56155, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155, added 2026-07-14
  • Microsoft, Security Update Guide — CVE-2026-56155, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
  • Tenable Research, Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs, https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164, published 2026-07-14
  • SANS Internet Storm Center, Microsoft Patch Tuesday July 2026 — The AI Acopolypse is Here, https://isc.sans.edu/diary/rss/33154, published 2026-07-14
  • The Register, Patchpocalypse Now: Microsoft tops last month's record with 622 Patch Tuesday CVEs, https://www.theregister.com/security/2026/07/14/patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves/5271434, published 2026-07-14

8. Adverse Trace position

Severity: HIGH (CVSS 7.8) — actively exploited. CVE-2026-56155 presents a direct and immediate risk to EMEA financial services organisations running AD FS on affected Windows Server versions. The vulnerability requires local authenticated access, which limits the initial attack surface, but in environments where AD FS servers are accessible to broader IT operational teams or where attackers have already established footholds through other means, the path to full administrative control of federation services is trivial (low complexity, low privileges). The CISA KEV listing and confirmed in-the-wild exploitation elevate this above routine patching — clients should treat remediation as urgent and complete patching before the 2026-07-28 CISA deadline. No specific threat actor attribution is available; exploitation attribution is unconfirmed. No IOCs or exploit code are publicly available, making post-exploitation detection dependent on behavioural monitoring of AD FS servers. Adverse Trace will continue to monitor for emerging IOCs, proof-of-concept code, or threat actor attribution and will issue an updated advisory if significant new information emerges. Clients should prioritise patching AD FS infrastructure, restrict local access to these servers, and audit for signs of prior compromise.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies