NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Microsoft AD FS privilege escalation CVE-2026-56155 exploited; October updates enable automatic repair

An exploited flaw affects Microsoft's AD FS business sign-in infrastructure. Ask IT to install October 2026 or later Windows security updates on every AD FS server and verify that unsafe permissions were repaired.

What to do

Ask your organisation's IT provider to install Windows security updates dated 13 October 2026 or later on every AD FS server, leave automatic repair enabled, and check AD FS Admin events 1133 or 1135 for success. Families do not need to change settings on personal devices.

What’s happening

CVE-2026-56155 affects Microsoft's Active Directory Federation Services (AD FS), used for business sign-ins. An attacker with existing access can gain higher local privileges. Microsoft explains that overly broad permissions can expose keys protecting AD FS signing certificates. CISA confirmed exploitation on 14 July 2026. July updates introduced optional permission repair; October updates enabled it by default. Fixes are available, but disabled or failed repair leaves unsafe permissions unresolved. As of 3 November, the reviewed sources do not identify the attackers, victims or scale of exploitation.

What
Flaw
Affects
Microsoft Active Directory Federation Services (AD FS)
Affected
Windows 10 Version 1607: builds from 10.0.14393.0 before 10.0.14393.9339 (32-bit and x64)
Windows 10 Version 1809: builds from 10.0.17763.0 before 10.0.17763.9020 (32-bit and x64)
Windows Server 2012, including Server Core: builds from 6.2.9200.0 before 6.2.9200.26226
Windows Server 2012 R2, including Server Core: builds from 6.3.9600.0 before 6.3.9600.23291
Windows Server 2016, including Server Core: builds from 10.0.14393.0 before 10.0.14393.9339
Windows Server 2019, including Server Core: builds from 10.0.17763.0 before 10.0.17763.9020
Windows Server 2022: builds from 10.0.20348.0 before 10.0.20348.5386
Windows Server 2025, including Server Core: builds from 10.0.26100.0 before 10.0.26100.33158
Fixed in
Microsoft's current remediation requirement: Windows security updates released on or after 13 October 2026 on every AD FS server, with successful DKM container permission repair.
Windows Server 2012 and Windows Server 2012 R2 require Extended Security Updates (ESU).
CVE
CVE-2026-56155
Since
14 July 2026
Closed
13 Oct 2026

Timeline

  1. New fixFixed

    October's Windows security updates enabled automatic permission repair by default. Microsoft instructed administrators to update every AD FS server and check that repair succeeded; older installations can require additional permission changes.

  2. CISA added

    CISA added the flaw to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.

  3. New fixPartly fixed

    Microsoft's July Windows security updates introduced detection of unsafe key-container permissions and an optional repair mechanism. Administrators had to enable the repair.

  4. Made public

    Microsoft disclosed CVE-2026-56155, an AD FS access-control flaw allowing an attacker with existing access to raise their privileges locally. Microsoft rated it high, with a CVSS score of 7.8.

Sources

  1. CVE-2026-56155: AD FS Distributed Key Manager container ACL hardening (KB5121391)Microsoft · 13 Oct 2026
  2. CVE-2026-56155: Microsoft CVE record with CISA exploitation informationMicrosoft and CISA · 8 Oct 2026
  3. CVE-2026-56155Hungarian National Cyber Security Centre · 15 July 2026
  4. Microsoft just released its biggest Patch Tuesday ever, with a mammoth 622 fixes including three dangerous zero-daysTechRadar · 15 July 2026
  5. CVE-2026-56155 — Vulnerability DetailsOpenCVE · 14 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS