CVE-2026-56155: Active Directory Federation Services Elevation of Privilege Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CSIRTS triage
- What
- Insufficient granularity of access control in Active Directory Federation Services allows local privilege elevation.
- Who is affected
- Users of Active Directory Federation Services.
- Urgency
- Remediation is urgent due to active exploitation of this vulnerability.
- Action
- Users should apply the latest patches provided by Microsoft.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Active Directory Federation Services
Get an email when a new Active Directory Federation Services advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-56155Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 82% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-56155 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: [Updated] Microsoft Releases July 2026 Security Updatesjpcert
- criticalexploitedMicrosoft security advisory – July 2026 monthly rollup (AV26-698) – Update 3cccs
- unknownMicrosoft Monthly Security Update (July 2026)hkcert
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (July 15, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0231 [1.00] [M/H] Vulnerabilities fixed in Microsoft Windowsncsc-nl
- highexploitedCVE-2026-56155: Insufficient granularity of access control in Active Directory Federation Services (AD FS) all…nvd
- criticalexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vuln…cisa-kev
Recent advisories for Active Directory Federation
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- highCVE-2026-58529: Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attack…nvd · 2026-07-14
- mediumCVE-2026-50684: Improper neutralization of input during web page generation ('cross-site scripting') in Active…nvd · 2026-07-14
- highCVE-2026-50647: Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services…nvd · 2026-07-14
- highCVE-2026-50411: Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthor…nvd · 2026-07-14
- highCVE-2026-50368: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized att…nvd · 2026-07-14
- highCVE-2026-50355: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized att…nvd · 2026-07-14
More from Microsoft Security Response Center
- highCVE-2026-57992: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability2026-07-14
- mediumCVE-2026-59926: Mistune: XSS via unescaped class option in Admonition directive2026-07-14
- mediumCVE-2026-55003: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability2026-07-14
- highCVE-2026-42900: Microsoft Windows App Store Elevation of Privilege Vulnerability2026-07-14
- unknownCVE-2026-13867: Chromium: CVE-2026-13867 Inappropriate implementation in Geolocation2026-07-14