CVE-2026-56155: Microsoft AD FS Privilege Escalation Exploited in Wild — CISA KEV July 14

On July 14, 2026, CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog after Microsoft confirmed active exploitation in the wild. The vulnerability sits inside Microsoft Active Directory Federation Services — the authentication layer that many enterprise environments rely on to broker identity across on-premises and cloud systems — making it a high-priority remediation target for any organisation running AD FS on Windows Server.

CVE-2026-56155 is classified as an Insufficient Granularity of Access Control vulnerability with a CVSS base score of 7.8 (High). An authorised attacker with local access can exploit misconfigured Distributed Key Management (DKM) Access Control Lists within AD FS to escalate privileges — and from that foothold, the downstream blast radius extends to federated applications, service accounts, and potentially the entire identity plane.

What AD FS DKM Is and Why It Matters

Active Directory Federation Services uses Distributed Key Management to store the token-signing and token-decryption certificates that protect authentication flows. These certificates are stored as objects in Active Directory with ACLs controlling who can read them. When those ACLs are overly permissive — or when an attacker has already obtained a low-privilege account through phishing or credential stuffing — the DKM container becomes a path to reading private key material that should never leave the AD FS service account.

CVE-2026-56155 exploits precisely this gap. A sufficiently-privileged attacker who can access the DKM container can extract the token-signing certificate's private key. With that key, they can mint arbitrary SAML tokens, forge authentication claims for any user in any federated application, and move laterally without triggering typical authentication anomaly alerts — because from the application's perspective, the tokens are cryptographically valid.

This attack pattern is not new in theory. The SolarWinds intrusion in 2020 used a similar golden SAML technique. What is new is confirmed exploitation at scale in 2026, making this a known-weaponised vulnerability rather than a theoretical risk.

Affected Versions

CVE-2026-56155 affects Microsoft Active Directory Federation Services running on Windows Server. The vulnerability is present in AD FS deployments where the DKM container ACLs have been left in a permissive state — a condition that can exist across Windows Server 2016, 2019, and 2022. Microsoft's July 2026 Patch Tuesday cycle, which addressed 622 CVEs in total, includes the security update for this vulnerability. However, patching alone is not sufficient: the underlying DKM ACL configuration must also be reviewed and tightened.

Azure AD (now Microsoft Entra ID) and cloud-only Microsoft 365 tenants are not affected. This vulnerability is specific to on-premises AD FS deployments.

How Attackers Are Exploiting It

The realistic attack chain CISA and Microsoft have documented follows a three-step pattern. First, an attacker obtains local or low-privilege authenticated access — typically through phishing, an infostealer infection, or by exploiting another vulnerability in the perimeter. Second, they enumerate the AD FS configuration and locate the DKM container within Active Directory. Third, if the ACLs are permissive enough for the compromised account to read the container, they extract the token-signing private key and use it to forge SAML assertions.

The reason this is dangerous beyond simple privilege escalation is persistence. Once an attacker has the token-signing key, they do not need to maintain a foothold in Active Directory to continue accessing federated applications. Even after the initial intrusion is remediated, forged tokens continue to work until the certificate is rotated — and organisations that don't know the key was extracted won't rotate it.

The July 14 CISA addition signals that at least one threat actor group has operationalised this chain. Given the timing — coinciding with CISA's broader advisory urging SharePoint hardening and flagging multiple SharePoint RCE flaws — it is reasonable to assess that coordinated campaigns are targeting Microsoft on-premises infrastructure as organisations remain on extended patch cycles.

Immediate Remediation Steps

The remediation for CVE-2026-56155 requires two parallel actions.

Apply the July 2026 security update. Microsoft released the patch as part of its July Patch Tuesday cycle. For any Windows Server running AD FS, this update should be applied immediately. Federal agencies were given a deadline of July 21, 2026 under CISA's Binding Operational Directive. Non-federal organisations should treat the same window as their target.

Review and tighten DKM container ACLs. The patch closes the specific code-level vulnerability, but a misconfigured DKM container remains a structural risk that future vulnerabilities can exploit. Use the AD FS DKM ACL review procedure documented in Microsoft's guidance to ensure only the AD FS service account has read access to the DKM container. Remove any broader group memberships — Domain Users, Authenticated Users, or custom groups — that may have been granted access inadvertently.

Audit and rotate token-signing certificates. If you cannot confirm that no unauthorised party has accessed the DKM container, treat the token-signing and token-decryption certificates as potentially compromised. Rotating these certificates invalidates any forged tokens in circulation and closes the persistence gap.

Enable enhanced logging on AD FS. After patching, enable verbose AD FS audit logging and forward events to your SIEM. Specifically, watch for SAML assertions being issued for unusual accounts, at unusual times, or for applications the account would not normally access.

Why Identity Plane Testing Is Now Mandatory

CVE-2026-56155 illustrates a broader pattern: the identity layer is now as much a target as the network perimeter, and many organisations test it far less rigorously. External VAPT engagements frequently cover web applications and APIs. AD FS, ADCS, and Entra ID configurations are often left outside scope — which is exactly where attackers look.

Alastor Pulse includes identity plane testing in its continuous security coverage, specifically targeting AD FS misconfigurations, DKM ACL reviews, and golden SAML attack paths. Enforster AI performs automated credential exposure scanning and dark web monitoring to catch early indicators of the phishing and infostealer activity that typically precedes identity attacks.

If you are running on-premises AD FS and have not audited your DKM ACL configuration, contact the Alastor InfoSec team for an identity security assessment before threat actors do it for you.

CVE-2026-56155 is a reminder that patching closes the vulnerability but not the attack surface — AD FS identity architecture requires dedicated review to eliminate the structural conditions that make golden SAML attacks possible.