CVE-2026-56155

What is Microsoft Active Directory Federation Services?

Active Directory Federation Services (AD FS) is a Windows Server role that provides single sign-on and identity federation between on-premises Active Directory and external applications, including hybrid Azure AD/Entra ID environments. Because AD FS servers issue and validate authentication tokens for potentially every application an organization federates trust with, the AD FS server itself is one of the highest-value targets in a Windows identity infrastructure — compromising it can unlock trust relationships extending far beyond the local machine.

Overview

Microsoft AD FS contains a vulnerability where insufficient granularity of access control allows an authenticated, low-privileged local attacker to elevate to administrator-level access on the AD FS server. This was patched as part of Microsoft's July 2026 Patch Tuesday — one of the largest in the program's history — and confirmed by Microsoft to have been exploited in the wild as a zero-day prior to the fix.

Affected Versions

Technical Details

• Root cause: Insufficient granularity of access control within the AD FS role, allowing operations that should require higher privilege to be performed by a lower-privileged authenticated local user (CWE-1220: Insufficient Granularity of Access Control).
• Attack vector: Local, requiring low privileges and no user interaction (AV:L/AC:L/PR:L/UI:N). CVSS 3.1 base score: 7.8 (High).
• Attack characteristics: Requires local authenticated access to the AD FS server itself — this is a post-compromise or insider-style privilege escalation primitive rather than a remote initial-access vector, consistent with its use in attacks that have already achieved a foothold on the server.
• Impact: Full confidentiality, integrity, and availability impact at the local system level. Once exploited, an attacker with administrator-level access to an AD FS server could alter federation trust settings, access sensitive token-signing material, disable security controls, or pivot further into hybrid identity infrastructure.

Discovery

Credited by Microsoft to Jeremy Kingston and Scott Clark of Microsoft's own Detection and Response Team (DART) — Microsoft's internal incident-response unit. This attribution strongly suggests the vulnerability was identified while investigating an active intrusion rather than through proactive security research.

Exploitation Context

Confirmed exploited in the wild as a zero-day per Microsoft's advisory. This CVE was one of three zero-days addressed in Microsoft's July 2026 Patch Tuesday, which fixed a record-setting number of vulnerabilities overall (reported variously as 569–622 CVEs depending on source methodology). CISA KEV lists ransomware usage for this CVE as unknown, and no public technical writeup of the exploit chain has been published — unlike the companion SharePoint CVE-2026-56164 disclosed the same day, which has received more detailed post-exploitation reporting.

Remediation

1. Apply Microsoft's July 14, 2026 security update immediately to all Windows Server hosts running the AD FS role.
2. Audit AD FS server local accounts and group memberships for unauthorized additions, particularly any accounts recently elevated to administrator.
3. Review AD FS and Windows security event logs for signs of local privilege escalation activity or unusual administrative actions predating the patch.
4. Restrict local logon rights on AD FS servers to the minimum necessary set of administrators, and monitor for any unexpected interactive or RDP sessions.
5. Rotate AD FS token-signing certificates if compromise is suspected, given the potential for federation trust material to have been exposed.
6. Follow CISA BOD 26-04 guidance and the July 28, 2026 remediation deadline.