CVE-2026-56155

What it actually does

CVE-2026-56155 is a local privilege escalation vulnerability in Microsoft Active Directory Federation Services caused by insufficiently granular access controls. An attacker who already has low-privileged, authorized local access to an affected Windows system hosting AD FS can abuse overly permissive AD FS-related permissions to gain elevated privileges on the system. Successful exploitation can allow high-impact compromise of confidentiality, integrity, and availability on the affected host, potentially including access to federation configuration, signing-related material, service configuration, or administrative execution paths depending on the vulnerable component and host configuration.

Why it matters to the business

Because AD FS is commonly used to broker authentication and single sign-on for business applications, compromise of an AD FS server can have consequences beyond one machine: attackers may be able to disrupt authentication, alter trust relationships, access sensitive identity infrastructure, or use the server as a stepping stone toward broader domain compromise. This vulnerability is listed in CISA KEV and is reported as actively exploited in the wild, so remediation should be treated as urgent; CISA’s remediation due date is 2026-07-28. Although the vulnerability requires local authenticated access and is not ransomware-designated in KEV, AD FS servers are high-value identity assets and should be prioritized ahead of ordinary workstations.

How an attack unfolds

An attacker first obtains a foothold on an affected Windows system where AD FS is installed or accessible locally, using valid low-privileged credentials, malware, stolen remote access, or another initial access technique. From that local position, the attacker identifies AD FS components, files, services, or configuration objects with access controls that grant more capability than intended. The attacker then abuses those permissions to modify or influence AD FS behavior, service execution, configuration, or protected resources in a way that causes code or actions to run with higher privileges. After privilege escalation, the attacker can dump sensitive configuration, tamper with identity federation settings, persist on the server, disable security controls, create additional privileged accounts, or move laterally into adjacent identity and Windows infrastructure. Public reporting indicates active exploitation, but no specific named threat actor beyond the vulnerability activity label is provided in the input.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-56155 to all affected systems, prioritizing AD FS servers and any Windows systems with the AD FS role installed. Affected product families include Windows 10 1607, Windows 10 1809, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build or KB list was provided in the input, so use Microsoft’s official advisory and servicing channels to identify the appropriate July 2026 or later cumulative/security update for each operating system. Where immediate patching is not possible, restrict interactive and remote logon rights to AD FS servers, remove unnecessary local users and administrators, tightly control AD FS service-account permissions, verify AD FS file and registry ACLs have not been loosened, enable enhanced logging, and isolate AD FS servers from general administrative access. Treat mitigation as temporary only; patching is the required remediation for KEV compliance.

How to confirm the fix worked

Confirm exposure by inventorying systems for the AD FS role and matching them against the affected Windows versions. Validate remediation by confirming the relevant Microsoft cumulative/security update is installed, the OS build is at or above Microsoft’s fixed level, and vulnerability scanners no longer report CVE-2026-56155. On AD FS servers, verify that non-administrative users cannot modify AD FS service configuration, AD FS program directories, federation configuration, AD FS-related registry paths, or service startup parameters. Review local group membership and service permissions after patching to ensure no attacker-created privilege remains. If using configuration management, compare AD FS server ACLs, services, and registry settings against a known-good hardened baseline.

Typical attack path

1. Gain authenticated low-privileged local access to an affected Windows host, such as Windows Server 2012, 2016, 2019, 2022, or 2025 running AD FS.
2. Enumerate the host for the AD FS role, AD FS services, service accounts, local permissions, file ACLs, registry ACLs, and federation configuration access.
3. Identify AD FS-related access-control boundaries that allow a non-administrative user to modify or influence privileged AD FS resources.
4. Abuse the overly permissive access control to trigger privileged execution, configuration tampering, or access to sensitive AD FS material.
5. Escalate to local administrative or equivalent privileged control on the affected system.
6. Use elevated access to collect identity-related secrets, alter authentication/federation configuration, establish persistence, or pivot to domain and identity infrastructure.

How to detect it

There are no universally reliable exploit-specific indicators provided, so detection should focus on behavioral evidence of local privilege escalation and AD FS tampering. Review Windows Security logs, System logs, PowerShell logs, Sysmon or EDR telemetry, AD FS Admin logs, AD FS Debug logs if enabled, service-control events, local group membership changes, and file/registry auditing on AD FS-related paths. Start hunting from 2026-07-14 or earlier if there are signs of prior foothold activity. Look for low-privileged users logging on locally or via RDP/WinRM to AD FS servers, followed by privileged token assignment, local administrator group changes, new services, service binary changes, AD FS service restarts, unexpected writes under AD FS directories, suspicious PowerShell AD FS cmdlets, federation configuration exports, and certificate or token-signing-related access. Correlate any privilege escalation indicators with outbound connections, credential dumping alerts, LSASS access, domain reconnaissance, or subsequent privileged authentication from the AD FS server.

• Microsoft-Windows-ADFS/Admin
• Microsoft-Windows-ADFS/Debug
• Active Directory Federation Services
• adfssrv
• Microsoft.IdentityServer.ServiceHost.exe
• C:\Windows\ADFS\
• C:\Program Files\Active Directory Federation Services\
• Get-AdfsProperties
• Set-AdfsProperties
• Get-AdfsRelyingPartyTrust
• Set-AdfsRelyingPartyTrust
• Add-AdfsRelyingPartyTrust
• Get-AdfsCertificate
• Update-AdfsCertificate
• Export-AdfsDeploymentSQLScript
• EventCode=4672
• EventCode=4688
• EventCode=4697
• EventCode=4732
• EventCode=4738
• EventCode=7040
• EventCode=7045
• sc.exe config adfssrv
• net localgroup administrators
• Add-LocalGroupMember
• Add-ADGroupMember
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wevtutil cl Microsoft-Windows-ADFS/Admin

What your security team should do

• Patch AD FS servers and other affected Windows systems immediately; for KEV-driven programs, complete remediation by 2026-07-28.
• Prioritize internet-adjacent or identity-critical AD FS servers before ordinary endpoints because compromise can affect authentication and federation trust.
• Inventory all hosts with the AD FS role installed and confirm whether they run Windows Server 2012, 2016, 2019, 2022, or 2025.
• Temporarily restrict local, RDP, WinRM, and administrative access to AD FS servers to a minimal set of trusted administrators until patching and validation are complete.
• Review AD FS server local Administrators membership, privileged domain group changes, service creation events, service configuration changes, and suspicious PowerShell activity since at least the publication date, 2026-07-14.
• Hunt for post-exploitation behavior on AD FS servers, including credential access, federation configuration export, token-signing-related access, new persistence mechanisms, and lateral movement.
• Rotate credentials or secrets associated with AD FS if evidence suggests local administrator compromise, AD FS configuration access, or service-account exposure.
• Increase monitoring on AD FS servers for anomalous administrative logons, unexpected service restarts, AD FS configuration changes, and changes to trust relationships or certificates.