CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Microsoft · Active Directory Federation Services · NVD published 2026-07-14 · posted 2026-07-14 · last modified 2026-07-15
What it is
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
| Weakness | CWE-1220 |
|---|---|
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source: [email protected]) |
| CISA due date | 2026-07-28 (for US federal agencies under BOD; a good deadline for everyone) |
| ATT&CK tactics | n/a |
Exploitation evidence
First exploit evidence seen: 2026-07-14 (earliest date across the sources below).
Exploited in the wild
- CISA KEV: listed since 2026-07-14. Source
Sources: CISA KEV.
No ATT&CK techniques could be mapped or inferred for this CVE yet.
How to fix it
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (source: CISA KEV)
Fixed versions
- microsoft windows 10 1607: upgrade to 10.0.14393.9339 or later
- microsoft windows 10 1809: upgrade to 10.0.17763.9020 or later
- microsoft windows server 2016: upgrade to 10.0.14393.9339 or later
- microsoft windows server 2019: upgrade to 10.0.17763.9020 or later
- microsoft windows server 2022: upgrade to 10.0.20348.5386 or later
- microsoft windows server 2025: upgrade to 10.0.26100.33158 or later
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 (CISA KEV notes)
- https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide (CISA KEV notes)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155 (Vendor Advisory)
Detection Generic guidance
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.