CVE-2026-56155

Think of ADFS like the “passport officer” that helps authenticate users for your business apps. This flaw lets someone who already has limited access on the machine use weak permission checks to become much more powerful than they should be. Since it’s been observed being exploited in the wild, a successful attacker could take over the server and disrupt your sign-in environment.

This matters if your business runs Active Directory Federation Services (ADFS) on the specified Windows versions (Windows 10 and several Windows Server releases). If an attacker can get a local foothold with low-level permissions on that machine, the weakness can be used to raise privileges. Treat it as a real risk when ADFS is in use and the attacker can reach the target host locally with sufficient access; remote reachability in a default configuration is not yet known from the provided findings.

RED: attackers are already exploiting this flaw in the wild, and it is listed in CISA’s KEV with a near-term remediation deadline. Because the weakness is about local privilege escalation and has confirmed real-world activity, delays directly increase the odds of compromise on systems running ADFS.

1. Identify exposure

   • Confirm whether any device in your environment is running Active Directory Federation Services (ADFS).
   • Limit the search to the affected operating systems: Windows 10; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.

2. Confirm whether each system is vulnerable

   • On each identified ADFS host, check the OS build/version and installed update level.
   • Determine whether the host is below the “fixed in” build for its specific OS line (below).

3. Upgrade to the fixed version (target states)

   • Windows 10: fixed in 10.0.14393.9339 (and 10.0.17763.9020 for the relevant servicing branch)
   • Windows Server 2012: fixed in 6.2.9200.26226
   • Windows Server 2012 R2: fixed in 6.3.9600.23291
   • Windows Server 2016: fixed in 10.0.14393.9339
   • Windows Server 2019: fixed in 10.0.17763.9020
   • Windows Server 2022: fixed in 10.0.20348.5386
   • Windows Server 2025: fixed in 10.0.26100.33158

4. Temporary workaround if patching is delayed

   • Use the Microsoft update guide for CVE-2026-56155 to apply the vendor-provided mitigations in the order recommended.
   • If mitigations are not available for your situation, CISA’s KEV guidance indicates stakeholders should evaluate whether to discontinue use of the product until mitigations/patches are in place.
   • As part of your incident response hardening, reduce the chance of a local attacker getting initial access by tightening accounts/permissions and restricting access to the ADFS host per your standard baseline (the exact steps should follow Microsoft’s mitigation instructions for this CVE).

5. Timing and compliance

   • CISA KEV due date: 2026-07-28.
   • Ensure follow-through aligns with CISA BOD 26-04 guidance referenced in the KEV entry and Microsoft’s instructions.

6. After patching: what to monitor

   • Review logs on ADFS hosts for signs consistent with privilege escalation attempts around the time of any suspicious activity.
   • Confirm ADFS service functionality after updates (to ensure authentication flows remain working) and verify the patched build is actually installed.

Severity and posture: CVE-2026-56155 is a High (CVSS 7.8) elevation of privilege issue impacting Active Directory Federation Services (ADFS) on multiple Windows versions. The weakness is categorized as CWE-1220 (insufficient access control), meaning authorization checks don’t sufficiently restrict what low-level local actors can do.

Mechanism (from findings summary): A local attacker with low-level permissions can exploit insufficient access controls in ADFS to elevate privileges. There is no user interaction required, and authentication requirements are described as low.

Exploitation status: This CVE is confirmed as being exploited in the wild (reported as actively exploited by Microsoft incident responders) and is included in CISA’s KEV list (added 2026-07-14) with a remediation due date of 2026-07-28.

Exploit availability: No public exploit code is reported in the provided findings, but exploitation is still confirmed in real incidents.

Impact profile: Because this is privilege escalation, a successful attacker can typically move from limited local access to higher-privilege execution on the host, increasing the likelihood of system compromise, credential access, and broader disruption of authentication services.