CVE-2026-56155: Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CSIRTS triage
- What
- Insufficient granularity of access control in Active Directory Federation Services allows local privilege elevation.
- Who is affected
- Users of Active Directory Federation Services.
- Urgency
- Remediation is urgent due to active exploitation of this vulnerability.
- Action
- Users should apply the latest patches provided by Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Active Directory Federation Services
Get an email when a new Active Directory Federation Services advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-56155
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-56155Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 82% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-56155 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0231 [1.00] [M/H] Vulnerabilities fixed in Microsoft Windowsncsc-nl
- criticalexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- highexploitedCVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerabilitymsrc
- criticalexploitedCVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vuln…cisa-kev
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01