🟢 CVE-2026-56155

CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control on the Distributed Key Manager (DKM) container. Despite AD FS being an internet-facing authentication service, the CVSS vector is AV:L (Local) with PR:L, meaning exploitation requires an already-authorized local account and does not provide direct network-based initial access. This is therefore a local privilege escalation, not a T1190 public-facing exploitation.

← Back to Overview
LOW_RISK
Risk Level
7.8
CVSS Score
LOCAL
Attack Vector
Privilege Escalation
ATT&CK Tactic
T1068 — Exploitation for Privilege Escalation
ATT&CK Technique
MEDIUM
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-07-14

Added to CISA KEV: 2026-07-14 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-56155 is an elevation-of-privilege vulnerability affecting Active Directory Federation Services (AD FS) due to insufficient granularity in access control lists (ACLs) within the Distributed Key Manager (DKM) container [1][4]. This flaw is significant because it allows an authorized user with local access to manipulate symmetric keys stored within the DKM, potentially compromising the integrity of identity tokens and authentication processes managed by AD FS [1][2].

Exploitation

  • Active Exploitation: The vulnerability has been observed being actively exploited in the wild [5][6].
  • Threat Actors: While specific named campaigns may vary, its nature as a zero-day exploit indicates use by sophisticated threat actors focused on persistent, stealthy access within domain environments [5].
  • Availability: Technical analysis and conceptual attack workflows are available to security researchers and threat actors, increasing the likelihood of widespread exploitation [6].
  • Prerequisites: Exploitation is local rather than network-based and requires the attacker to already have an authorized, albeit low-privileged, account on the target machine [4][5]. No specific user interaction is required once the initial access is established.

Affected Products & Patches

  • Affected Versions: The vulnerability affects various Windows Server editions running Active Directory Federation Services (AD FS) and certain Windows client versions where these components are deployed [3].
  • Patch Availability: Microsoft released security updates, including KB5121391 (July 2026), which implements the first hardening phase of the DKM container ACLs to remediate the vulnerability [1].
  • Mitigations: Organizations should apply the latest security patches immediately. Additionally, it is recommended to strictly limit AD FS administrative roles and continuously monitor permissions on the DKM container to ensure they remain in a secure state [3].

Impact

  • Capability: Successful exploitation grants an attacker the ability to escalate privileges locally, potentially leading to full compromise of the AD FS identity provider capabilities [4].
  • Business Risk: For internet-facing deployments, this vulnerability is critical as it provides a pathway for an attacker who has gained a foothold on a server to escalate their access to the identity layer, which can then be used to forge tokens, impersonate users, or gain unauthorized access to cloud and on-premises applications, posing a severe risk to corporate identity security [2].

Sources

  1. CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening

    Summary The Access Control List (ACL) on the Distributed Key Manager (DKM) container enters its first hardening phase starting with the July 14, 2026 Windows security update. This hardening effort addresses an elevation of privilege (EOP) that can arise from the vulnerability documented in CVE-2026-…

  2. CVE-2026-56155 - High Vulnerability - TheHackerWire

    CVE-2026-56155 is a High severity vulnerability (CVSS 7.8). Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

  3. CVE-2026-56155 - Vulnerability Details - OpenCVE

    Apply Microsoft’s latest security update that addresses CVE-2026-56155 for Windows 10 and all Windows Server editions listed above. Restrict AD FS administrative roles to a minimal set of changes to these privileges continuously.

  4. NVD-CVE-2026-56155

    CVE-2026-56155 Detail Description Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

  5. CVE-2026-56164 & CVE-2026-56155 Zero-Days

    CVE-2026-56155 is an actively exploited elevation-of-privilege flaw in Active Directory Federation Services that begins from local low ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed