CVE-2026-56155: Microsoft AD FS Local Privilege Escalation (KEV, Exploited)

CVE-2026-56155 is an insufficient-granularity access-control flaw (CWE-1220) in Microsoft Active Directory Federation Services that lets an authenticated, already-authorized local attacker elevate their privileges on the AD FS server, and CISA added it to the Known Exploited Vulnerabilities catalog the same day it was publicly disclosed, indicating it was already being exploited.

CVE-2026-56155 is a CWE-1220 (Insufficient Granularity of Access Control) vulnerability in Microsoft Active Directory Federation Services (AD FS), the on-premises identity-federation role many enterprises still run alongside or instead of Microsoft Entra ID. NVD's description states: "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally" (NVD).

NVD lists the CVE as "Analyzed" but has not published its own independent (Primary) CVSS score; the only metric on record is Microsoft's own CNA Secondary score, CVSS v3.1 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, low complexity, requiring low privileges and no user interaction, with high impact to confidentiality, integrity and availability (NVD; Microsoft Security Update Guide: CVE-2026-56155).

CISA added CVE-2026-56155 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14 — the same date NVD lists as the CVE's publication date — with a required-action due date of 2026-07-28 under Binding Operational Directive 26-04. Same-day KEV addition on the disclosure date is itself a strong signal that Microsoft and CISA already had evidence of in-the-wild exploitation before the public advisory went out, consistent with CISA's internal SSVC assessment for this CVE recording exploitation status as "active" (CISA KEV; NVD).

Microsoft's own guidance beyond patching is to retire AD FS entirely: Microsoft's AD FS decommission guide recommends migrating authentication to "Microsoft Entra ID," which it says provides "a simple cloud-based sign-in experience to all your resources and apps with strong authentication and real-time, risk-based adaptive access policies," explicitly as a way of "reducing operational costs of managing and maintaining an AD FS environment and increasing IT efficiency" — Microsoft treats AD FS as a legacy component it wants customers off of, not just patched (Microsoft Learn: AD FS decommission guide).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.00346 (28.165th percentile) — a modest EPSS figure despite confirmed KEV status, consistent with a local-privilege-escalation bug (rather than a remote, pre-authentication one) that requires an attacker to already hold a foothold on the AD FS server (FIRST EPSS).

Because this is a local elevation-of-privilege flaw with confirmed active exploitation, any organization still running AD FS should apply Microsoft's security update for CVE-2026-56155 immediately and treat AD FS servers as a priority target for lateral-movement monitoring, alongside longer-term migration to Microsoft Entra ID.

• Insufficient granularity of access control in AD FS lets an authorized attacker elevate privileges locally. — NVD
• NVD has no Primary CVSS score; the only metric is Microsoft's CNA Secondary CVSS v3.1 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. — NVD
• Added to the CISA KEV catalog on 2026-07-14 (publication date), due date 2026-07-28, with CISA's internal SSVC assessment recording exploitation status as active. — CISA KEV
• Microsoft's AD FS decommission guide recommends migrating authentication to Microsoft Entra ID to reduce operational costs and increase security, treating AD FS as a legacy component rather than a long-term platform. — Microsoft Learn: AD FS decommission guide
• EPSS score is 0.00346 (28.165th percentile) as of 2026-10-29. — FIRST EPSS