CISA · Known Exploited Vulnerabilities Catalog
CVE-2026-56155 catalog entry, exploitation status, required action, and remediation deadline.
CVE-2026-56155 is a local privilege-escalation bug. The real danger is the server it affects — an identity provider holding the certificate that downstream applications trust to decide who everyone is.
On July 14, 2026, CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog after Microsoft confirmed exploitation in the wild. The vulnerability is an insufficient granularity of access control flaw in Active Directory Federation Services that allows an authorized attacker to elevate privileges locally.
Read only as a vulnerability record, it sounds limited. The attacker needs existing access. Exploitation is local. There is no unauthenticated path from the internet directly to administrative control.
But identity infrastructure should not be ranked only by CVSS score or attack vector. The better question is what full control of the affected system unlocks. On an AD FS server, the answer is the authority to create identities that every relying application already trusts.
Active Directory Federation Services sits between Active Directory and the applications that rely on it. After a user authenticates, AD FS issues a signed SAML, WS-Federation, or OAuth token. Microsoft 365, Salesforce, ServiceNow, custom applications, and other relying parties accept that token because they trust the AD FS signature.
The relying application does not independently verify the user’s password. It trusts the identity provider and the certificate used to sign the token.
That makes the token-signing certificate one of the most sensitive assets in a federated environment. Steal the private key, and an attacker no longer needs to defeat authentication one user at a time. The attacker can manufacture proof that authentication already happened.
“On an AD FS server, administrative access is one short step from authority over every identity the organization trusts — and the logins it forges leave no failed-login trail.“
CVE-2026-56155 is not an initial-access vulnerability. An attacker first needs a foothold on the AD FS host, potentially through stolen credentials, another vulnerability, exposed administration, or movement from a previously compromised system.
That does not make the flaw unimportant. Privilege escalation is often the bridge between limited access and control of the asset an attacker actually wants.
Once the attacker reaches Administrator or SYSTEM on an AD FS server, the security problem changes. The objective is no longer simply persistence on a Windows machine. It becomes theft of the signing material that downstream applications use as proof of identity.
This attack pattern is commonly called Golden SAML, classified by MITRE ATT&CK as T1606.002. With the signing certificate, an attacker can create tokens that appear cryptographically valid to relying parties. It is not theoretical: Golden SAML was used against several SolarWinds-era victims in 2020, in intrusions attributed to the actor Microsoft then tracked as NOBELIUM.
Microsoft has not said that every observed exploitation of CVE-2026-56155 resulted in signing-certificate theft or Golden SAML. The significance is that the vulnerability can supply the missing escalation step: a path from limited access on the federation server to the privileges required to reach its most valuable secret.
The most dangerous part of a forged-token attack is not only that the token works. It is that the normal authentication process never occurs.
The user does not enter a password. No MFA challenge is generated. AD FS does not authenticate the account and does not intentionally issue the token. The attacker presents the forged token directly to the relying application, which accepts it because the signature appears valid.
This creates a monitoring gap. The relying application may record a successful sign-in, while AD FS has no corresponding record of producing the token.
| Question | Patch-only view | Detection view |
|---|---|---|
| The flaw | Local EoP fixed by the July update | A path to control of the federation authority |
| The evidence | Update installed successfully | Was the signing certificate accessed before patching? |
| The sign-in | Look for failed logins or MFA anomalies | Look for application access without matching AD FS issuance |
| The scope | One server was vulnerable | Every relying party trusting the certificate may be affected |
Historically, AD FS event ID 1200 records successful token issuance to a relying party when the appropriate auditing is enabled. A successful application login without a corresponding issuance event can indicate that the presented token did not originate from AD FS.
The hunt is not as simple as searching for one event ID. Clock differences, logging configuration, retention, proxies, application behavior, and incomplete telemetry can all create noise. But the principle is strong: the relying party and identity provider should agree that the authentication occurred.
Microsoft credited its Detection and Response Team for discovering CVE-2026-56155. Microsoft has not disclosed the threat actor, affected organizations, or complete exploitation chain. DART involvement nevertheless makes the KEV listing more than a theoretical patching exercise: exploitation was observed during real-world security work.
If evidence cannot rule out administrative compromise of the federation server, defenders must consider whether the signing certificate remains trustworthy. Rebuilding or cleaning the host is not enough if the private key has already left the machine.
Certificate rotation is what restores the trust boundary. In AD FS environments, this may require careful coordination because relying parties must recognize the replacement certificate. Where exposure is suspected, defenders may need to perform two rotations to remove any certificate overlap that would otherwise preserve trust in the previous key.
The July release also corrected seven denial-of-service vulnerabilities in AD FS. Among them, CVE-2026-50695 is a stack-based buffer overflow that can allow an unauthenticated remote attacker to crash the service using crafted network traffic.
The DoS flaws do not provide the same identity-forgery path as CVE-2026-56155, but they expose a second weakness of federation infrastructure: availability. When AD FS is unavailable, applications depending on it may lose their authentication service at the same time.
No public exploitation or proof of concept was reported for CVE-2026-50695 at disclosure. That status should not be mistaken for permanence. Once patched and unpatched binaries are available, researchers and attackers can compare them and work backward toward the vulnerable code path.
Deploy Microsoft’s July cumulative update across every federation server. The release closes the actively exploited privilege escalation and the accompanying denial-of-service flaws.
Look for unexpected administrative activity, new services, suspicious processes, credential use, remote administration, and access to AD FS configuration or certificate material.
Search for relying-party access without a corresponding AD FS token-issuance event. Validate event IDs and auditing behavior against the organization’s own configuration.
If exposure cannot be ruled out, rotate the token-signing certificate, update relying parties, and verify that the old signing material is no longer accepted.
The larger lesson is not that every local privilege-escalation vulnerability should become a crisis. It is that vulnerability severity depends partly on the authority assigned to the affected system.
A local EoP on an ordinary workstation gives an attacker control of one endpoint. A local EoP on a federation server can become authority to impersonate users across the enterprise.
Sourcing: CVE-2026-56155 details, its July 14, 2026 KEV addition, CWE classification, local privilege-escalation description, and ransomware status are based on CISA’s Known Exploited Vulnerabilities catalog and Microsoft’s Security Update Guide. Microsoft confirmed exploitation in the wild and credited its Detection and Response Team but has not publicly disclosed the attacker, targets, or full exploitation chain. Golden SAML, the 2020 SolarWinds-era intrusions attributed to NOBELIUM, and AD FS certificate-extraction paths are based on MITRE ATT&CK and published Mandiant / Google Cloud threat research. Event ID 1200 should be validated against each organization’s AD FS auditing and log configuration before use in production detection logic.
If you find ByteVanguard useful, you can support the site and help keep the analysis independent.
Support the analysis