{"id":"microsoft-adfs-privilege-escalation-jul-2026","category":"patch","status":"closed","title":"Microsoft AD FS privilege escalation CVE-2026-56155 exploited; October updates enable automatic repair","tldr":"An exploited flaw affects Microsoft's AD FS business sign-in infrastructure. Ask IT to install October 2026 or later Windows security updates on every AD FS server and verify that unsafe permissions were repaired.","summary":"CVE-2026-56155 affects Microsoft's Active Directory Federation Services (AD FS), used for business sign-ins. An attacker with existing access can gain higher local privileges. Microsoft explains that overly broad permissions can expose keys protecting AD FS signing certificates. CISA confirmed exploitation on 14 July 2026. July updates introduced optional permission repair; October updates enabled it by default. Fixes are available, but disabled or failed repair leaves unsafe permissions unresolved. As of 3 November, the reviewed sources do not identify the attackers, victims or scale of exploitation.","action":"Ask your organisation's IT provider to install Windows security updates dated 13 October 2026 or later on every AD FS server, leave automatic repair enabled, and check AD FS Admin events 1133 or 1135 for success. Families do not need to change settings on personal devices.","product":"Microsoft Active Directory Federation Services (AD FS)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-56155"],"tags":["microsoft","ad-fs","windows-server","privilege-escalation","actively-exploited"],"affected":["Windows 10 Version 1607: builds from 10.0.14393.0 before 10.0.14393.9339 (32-bit and x64)","Windows 10 Version 1809: builds from 10.0.17763.0 before 10.0.17763.9020 (32-bit and x64)","Windows Server 2012, including Server Core: builds from 6.2.9200.0 before 6.2.9200.26226","Windows Server 2012 R2, including Server Core: builds from 6.3.9600.0 before 6.3.9600.23291","Windows Server 2016, including Server Core: builds from 10.0.14393.0 before 10.0.14393.9339","Windows Server 2019, including Server Core: builds from 10.0.17763.0 before 10.0.17763.9020","Windows Server 2022: builds from 10.0.20348.0 before 10.0.20348.5386","Windows Server 2025, including Server Core: builds from 10.0.26100.0 before 10.0.26100.33158"],"fixed":["Microsoft's current remediation requirement: Windows security updates released on or after 13 October 2026 on every AD FS server, with successful DKM container permission repair.","Windows Server 2012 and Windows Server 2012 R2 require Extended Security Updates (ESU)."],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening (KB5121391)","url":"https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening","by":"Microsoft","date":"2026-10-13"},{"kind":"advisory","title":"CVE-2026-56155: Microsoft CVE record with CISA exploitation information","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56155","by":"Microsoft and CISA","date":"2026-10-08"},{"kind":"advisory","title":"CVE-2026-56155","url":"https://nki.gov.hu/figyelmeztetesek/serulekenysegek/cve-2026-56155/","by":"Hungarian National Cyber Security Centre","date":"2026-07-15"},{"kind":"news","title":"Microsoft just released its biggest Patch Tuesday ever, with a mammoth 622 fixes including three dangerous zero-days","url":"https://www.techradar.com/pro/security/microsoft-just-released-its-biggest-patch-tuesday-ever-with-a-mammoth-622-fixes-including-three-dangerous-zero-days","by":"TechRadar","date":"2026-07-15"},{"kind":"advisory","title":"CVE-2026-56155 — Vulnerability Details","url":"https://opencve.alliance.unm.edu/cve/CVE-2026-56155","by":"OpenCVE","date":"2026-07-14"}],"started":"2026-07-14","closed":"2026-10-13","created":"2026-11-03T22:21:39.690Z","updated":"2026-11-03T22:21:39.690Z","cve_notes":[{"cve":"CVE-2026-56155","name":"Access-control flaw in Microsoft AD FS","what":"Insufficiently restrictive access controls in AD FS allow an attacker who already has low-privilege local access to gain higher privileges.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-13","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"October's Windows security updates enabled automatic permission repair by default. Microsoft instructed administrators to update every AD FS server and check that repair succeeded; older installations can require additional permission changes.","url":"https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening","by":"Microsoft","patch":"patched"},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56155","by":"Microsoft and CISA","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Microsoft's July Windows security updates introduced detection of unsafe key-container permissions and an optional repair mechanism. Administrators had to enable the repair.","url":"https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening","by":"Microsoft","patch":"partial"},{"at":"2026-07-14","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Microsoft disclosed CVE-2026-56155, an AD FS access-control flaw allowing an attacker with existing access to raise their privileges locally. Microsoft rated it high, with a CVSS score of 7.8.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-56155","by":"Microsoft","patch":null}],"url":"https://hard.fyi/live/microsoft-adfs-privilege-escalation-jul-2026/","json":"https://hard.fyi/api/live?id=microsoft-adfs-privilege-escalation-jul-2026"}