# AD FS elevation of privilege exploited as a zero-day

Source: https://startwithidentity.com/cves/cve-2026-56155/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

Microsoft's July 14, 2026 security update fixed an elevation of privilege flaw in Active Directory Federation Services (AD FS). The [MSRC entry](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155) describes insufficient granularity of access control (CWE-1220) that lets an authorized attacker elevate privileges locally, and says a successful attacker "could gain administrator privileges." The CVSS 3.1 vector is local, low complexity, low privileges required, no user interaction (7.8). MSRC marked it "Exploitation Detected" on release day, and CISA added it to KEV the same day, July 14, 2026. Microsoft has not published the vulnerable component or exploitation details, so the attack chain before local access is unknown.

## Why it matters

An AD FS server is an identity provider, not just another Windows host. Microsoft's [AD FS hardening guidance](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs) notes that, by default, "the keys AD FS uses to sign tokens never leave the federation servers." Administrator on that server puts an attacker next to those keys. Anyone who can sign tokens with them can mint SAML or WS-Federation assertions for any user, accepted by every relying party that trusts the farm. That is the [Golden SAML pattern](https://startwithidentity.com/techniques/federation-trust-abuse-saml-forgery/). A foothold as a low-privileged service or user on the federation server is enough to start.

CISA's KEV entry links Microsoft's [AD FS decommission guide](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide). Moving authentication to Microsoft Entra ID and retiring the farm removes the target.

## What to do

- Install the July 2026 or later Windows update on every AD FS server.
- Follow Microsoft's hardening list: only AD and AD FS admins hold admin rights, reduce local Administrators membership, keep AD FS servers in their own OU with dedicated GPOs, and use a group managed service account.
- Protect token-signing and decryption keys in an HSM, as Microsoft recommends, so local admin does not mean key export.
- Send AD FS and Security logs to a SIEM at the highest logging level.

## After you patch

- If you find signs of local escalation on an AD FS server, replace the token-signing and token-decryption certificates, update every relying party, and review sign-ins that federated tenants accepted from the farm.
- Plan the migration off AD FS using the decommission guide.

## Sources

- [NVD: CVE-2026-56155](https://nvd.nist.gov/vuln/detail/cve-2026-56155)
- [MSRC: Active Directory Federation Services Elevation of Privilege Vulnerability, CVE-2026-56155](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155)
- [Microsoft Learn: Best practices for securing AD FS and Web Application Proxy](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs)
- [Microsoft Learn: AD FS decommission guide](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/decommission/adfs-decommission-guide)
- [CISA Known Exploited Vulnerabilities catalog, added July 14, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155)