# CVE-2026-56155: Microsoft AD FS Elevation-of-Privilege Vulnerability Actively Exploited

> An elevation-of-privilege vulnerability in Microsoft Active Directory Federation Services (AD FS), caused by insufficient granularity of access control (CWE-1220), lets an authenticated local low-privileged attacker escalate to administrator-level access. Microsoft confirmed in-the-wild zero-day exploitation, credited discovery to its own Detection and Response Team (DART), and shipped fixes on July 14, 2026 as part of a record 569/570/622-CVE July 2026 Patch Tuesday.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1349
- **ID:** TL-2026-1349
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-56155, CVE-2026-50695, CVE-2026-54983

## Description

CVE-2026-56155 is an important-severity (CVSS 3.1 base score 7.8) elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS), the on-premises identity federation role that underpins SAML/WS-Federation single sign-on and hybrid trust between on-prem Active Directory and Microsoft Entra ID (Azure AD). The root cause is insufficient granularity of access control (CWE-1220): AD FS fails to sufficiently restrict a class of local operations available to authenticated, low-privileged accounts, allowing those operations to be abused to obtain administrator-level privileges on the AD FS server itself.

The attack vector is local (AV:L) with low attack complexity (AC:L), requiring low privileges (PR:L) and no user interaction (UI:N) from an attacker who already holds an authenticated, low-privileged foothold on the AD FS host -- for example via stolen credentials, a compromised service account, or a low-privilege session obtained through an earlier intrusion stage. Successful exploitation yields high confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with full local administrator compromise of the federation server.

Microsoft confirmed active exploitation in the wild prior to patch release and credited discovery to Jeremy Kingston and Scott Clark of Microsoft's own Detection and Response Team (DART) -- an incident-response unit that investigates live intrusions -- strongly suggesting the flaw was identified during real-world breach investigations rather than through proactive research. Microsoft has not published indicators of compromise, the initial access vector used by attackers, or the scope of observed exploitation, leaving defenders without forensic breadcrumbs to hunt on directly; detection must instead focus on anomalous local privilege transitions and post-elevation AD FS administrative activity.

Zero Day Initiative's July 2026 review assigned this bug its highest deployment priority (Priority 1), noting it is "one of several AD FS [bugs] being patched this month, but it's the only one being actively exploited," and explicitly warned that this class of local AD FS EoP "can also be paired with an RCE as we often see in ransomware" -- describing a realistic chain where a remote-code-execution bug (e.g., against SharePoint, Exchange, or another exposed service) delivers initial code execution and low-privilege local access, and CVE-2026-56155 is then used as the second-stage privilege-escalation primitive to reach AD FS server administrator.

AD FS is a high-value target for privilege escalation because a local administrator on an AD FS server can access the federation service's token-signing certificate and configuration database, enabling forgery of SAML tokens ("Golden SAML") that are trusted across every relying party federated with that AD FS instance -- including hybrid Entra ID/Azure AD trust relationships. A Golden SAML forgery lets an adversary impersonate any user, including global administrators, to any relying party without further authentication, and can persist across password resets and even survive removal of the original foothold unless the token-signing certificate itself is rotated.

The same July 2026 AD FS patch batch also fixed a distinct, unauthenticated, network-reachable denial-of-service vulnerability, CVE-2026-50695, which lets a remote attacker without any credentials crash AD FS and disrupt organization-wide sign-in, plus at least six further AD FS denial-of-service bugs rooted in similar buffer-overflow and infinite-loop conditions, including CVE-2026-54983, a stack-based buffer overflow (CVSS 7.5, no user interaction required). While CVE-2026-56155 is the only actively-exploited AD FS bug in the batch, the concentration of DoS and EoP fixes in the same component in a single release underscores AD FS as a current focus of both attacker interest and internal Microsoft/DART hardening work.

The fix shipped as part of Microsoft's July 2026 Patch Tuesday (variously reported as 569, 570, or 622 CVEs across vendors due to differing counting methodologies -- vendor breakdowns cite roughly 254 elevation-of-privilege, 145 remote-code-execution, 102 information-disclosure, 35 denial-of-service, 17 security-feature-bypass, and 16 spoofing vulnerabilities), alongside a second actively-exploited zero-day, CVE-2026-56164 (SharePoint Server, missing authentication for a critical function, CVSS 5.3, unauthenticated and network-reachable), and other high-severity identity-infrastructure fixes including CVE-2026-49164 (Windows Active Directory Domain Services RCE, Critical) and CVE-2026-54121 (Active Directory Certificate Services EoP, Critical). The same release also disclosed a publicly-known BitLocker bypass issue, underscoring a broader theme of identity- and disk-encryption-adjacent hardening in this patch cycle. CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026 with a remediation due date of July 28, 2026 under Binding Operational Directive BOD 26-04.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1098 Account Manipulation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1098 Account Manipulation
- T1649 Steal or Forge Authentication Certificates
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1550 Use Alternate Authentication Material
- T1499 Endpoint Denial of Service

## Sources

- [Microsoft Security Update Guide - CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-56155](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155)
- [NVD - CVE-2026-56155 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-56155)
- [Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)](https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164)
- [Zero Day Initiative — The July 2026 Security Update Review](https://www.zerodayinitiative.com/blog/2026/7/14/the-july-2026-security-update-review)
- [Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days](https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days/)
- [Microsoft Patch Tuesday for July 2026 — Snort rules and prominent vulnerabilities](https://blog.talosintelligence.com/microsoft-patch-tuesday-july-2026/)
- [Record-Breaking Microsoft Patch Tuesday Update: 570 Vulnerabilities Fixed, Including 3 Zero-Days](https://cybersecuritynews.com/microsoft-patch-tuesday-update-july-2026/)
- [Active Directory Services 0-Day Exploited](https://cybersecuritynews.com/active-directory-services-0-day-exploited/)
- [Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/)
- [Microsoft's July 14 Patch Blocks a Network Attack That Can Crash AD FS Without Authentication](https://windowsnews.ai/article/microsofts-july-14-patch-blocks-a-network-attack-that-can-crash-ad-fs-without-authentication.438187)
- [July 2026 Patch Tuesday: Fix 2 Exploited AD FS and SharePoint Zero-Days](https://windowsforum.com/threads/july-2026-patch-tuesday-fix-2-exploited-ad-fs-and-sharepoint-zero-days.438209/post-1000456)
- [Microsoft Fixes Zero-Day Attacks Hitting SharePoint, AD FS in Massive July Patch Tuesday](https://windowsnews.ai/article/microsoft-fixes-zero-day-attacks-hitting-sharepoint-ad-fs-in-massive-july-patch-tuesday.438203)
- [Microsoft's 570-Fix Patch Tuesday: Two Zero-Days Exploited, BitLocker Bypass Disclosed](https://windowsnews.ai/article/microsofts-570-fix-patch-tuesday-two-zero-days-exploited-bitlocker-bypass-disclosed.438195)
- [Microsoft's July Patches Stop Unauthenticated AD FS Crashes — Patch Your Identity Servers Now](https://windowsnews.ai/article/microsofts-july-patches-stop-unauthenticated-ad-fs-crashes-patch-your-identity-servers-now.438188)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1349