CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
CSIRTS triage
- What
- Insufficient granularity of access control in Active Directory Federation Services allows local privilege elevation.
- Who is affected
- Users of Active Directory Federation Services.
- Urgency
- Remediation is urgent due to active exploitation of this critical vulnerability.
- Action
- Users should apply the latest patches provided by Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Active Directory Federation Services
Get an email when a new Active Directory Federation Services advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56155
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-56155Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 82% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-56155 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0231 [1.00] [M/H] Vulnerabilities fixed in Microsoft Windowsncsc-nl
- highexploitedCVE-2026-56155: Insufficient granularity of access control in Active Directory Federation Services (AD FS) all…nvd
- criticalexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- highexploitedCVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerabilitymsrc
Recent advisories for Microsoft Active Directory
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-54733: The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Activ…nvd · 2026-07-16
- criticalexploitedCVE-2022-26923: Microsoft Active Directory Domain Services Privilege Escalation Vulnerabilitycisa-kev · 2022-08-18
- criticalexploitedCVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerabilitycisa-kev · 2022-04-11
- criticalexploitedCVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerabilitycisa-kev · 2022-04-11
More from CISA Known Exploited Vulnerabilities
- criticalCVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability2026-07-29
- criticalCVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability2026-07-27
- criticalCVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability2026-07-27
- criticalCVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability2026-07-22
- criticalCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-07-22