CVE-2026-56155: Active Directory Federation Services Privilege Escalation Zero-Day

CVE-2026-56155 is an elevation-of-privilege zero-day in Active Directory Federation Services (AD FS), Microsoft's federated identity service. An already authorized attacker can escalate to elevated privileges locally due to insufficient access-control granularity. Microsoft patched it on 14 July 2026 after active exploitation was confirmed, and CISA added it to the KEV catalog with a federal remediation deadline of 28 July 2026. It compromises extremely high-value identity infrastructure.

This article explains what CVE-2026-56155 is, why AD FS is such a coveted target, what "privilege escalation for authorized attackers" actually means, how it fits the identity-focused attack wave of 2026, and, above all, what you should do now to reduce your risk. We also clarify what is and is not publicly known, because Microsoft typically withholds the deep technical detail of flaws like this.

Key takeaways

• It is an elevation-of-privilege zero-day in AD FS, exploited actively before the patch.
• It is not pre-authentication: the attacker must already hold some access or prior foothold.
• The described root cause is insufficient access-control granularity.
• Microsoft shipped the fix in the 14 July 2026 Patch Tuesday.
• CISA added it to the KEV catalog with a remediation deadline of 28 July 2026.
• Compromising AD FS opens the door to forging authentication tokens and impersonating users in federated apps.

What CVE-2026-56155 is

CVE-2026-56155 is an elevation-of-privilege vulnerability in Active Directory Federation Services. The root cause, per the public description, is insufficient access-control granularity: the mechanism deciding what each actor can do against the service does not discriminate finely enough, so an authorized attacker gains rights beyond those they should have.

The "authorized" nuance is critical and worth keeping in view. This is not a flaw exploitable from the internet by anyone without credentials. To abuse CVE-2026-56155, the attacker must already be authorized on the system; it is not a flaw exploitable anonymously from the internet or without credentials. From there, they gain elevated privileges locally. That places it as a link in an attack chain, not the initial entry point, but it is no less dangerous: privilege escalation is exactly the link that widens the attacker's control within the environment.

It was detected and treated as a zero-day, meaning it was exploited actively before a patch existed. Microsoft fixed it in its 14 July 2026 Patch Tuesday, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of 28 July 2026. If you want a refresher on how vulnerability identifiers work and what each field means, see our guide on what a CVE is.

What is not publicly known

Microsoft typically withholds the deep technical detail of flaws like this, and for good reason: publishing the internal mechanism while many organizations have not yet patched would enable mass exploitation. So in this analysis we stick to what Microsoft and CISA have confirmed (that it is actively exploited and that it is an elevation-of-privilege zero-day) and we avoid speculating about the exact internal vector, a specific CVSS, or exploitation steps. Any serious analysis must clearly separate verified fact from hypothesis.

What AD FS is and why it is such a valuable target

Active Directory Federation Services is Microsoft's federated identity service. Its job is to enable single sign-on (SSO): a user authenticates once and, from then on, accesses multiple federated applications without re-entering credentials. To achieve that, AD FS issues authentication tokens (for example SAML or OIDC) that consuming applications accept as proof the user is who they claim to be.

In practice, AD FS acts as a trust authority. Applications like Microsoft 365 and countless third-party services trust the tokens AD FS signs. That trust is what makes it an extremely high-value asset: whoever controls the token issuer effectively controls the entire organization's identity toward the applications that trust it.

AD FS lives inside the Active Directory ecosystem, the foundation of on-premises identity for most organizations. Understanding how that environment is structured by privilege tiers helps you gauge the risk: our guide on the Active Directory pentesting tier model explains why identity services must be treated as Tier 0, the most critical level. And if you want the conceptual framework for identity and access management, review what IAM is.

Identity as the perimeter

For years the perimeter was the network. Today, with cloud applications and distributed work, the real perimeter is identity. An attacker who manages to act as a legitimate user, or better yet as the token issuer itself, does not need to break any firewall: they simply walk through the front door with credentials the applications accept without question. That is why identity is the trending attack vector in 2026, and why a flaw in AD FS is so serious.

Why it matters: from EoP to token forgery

Privilege escalation in AD FS is not an isolated problem; it is a multiplier. If an attacker gains elevated privileges over the federation service, the scenario that most worries identity teams comes into play: the ability to forge authentication tokens.

This class of attack is generically known as Golden SAML. The idea, at a high level, is that whoever controls the token issuer's material and privileges can forge valid tokens for any user, without needing to know their password or clear their second factor. With a forged token, the attacker accesses federated applications (for example M365 and third-party apps) impersonating any identity, including an administrator's.

The consequences are severe:

• Full impersonation: access to federated applications as any user, with no real credentials.
• Persistence that is hard to eradicate: forged tokens can survive password changes, because they do not depend on the password.
• MFA evasion: if the token already represents an authenticated session, the second factor never re-engages. This pattern overlaps with other session-theft techniques such as AiTM (adversary-in-the-middle) phishing that hijacks sessions and bypasses MFA.
• Stealthy lateral movement: by using legitimate identities, malicious activity blends into normal traffic.

Privilege escalation is a pattern that repeats across every identity plane, not just AD FS. To see the same concept in the public cloud, read our analysis of AWS IAM privilege escalation: the provider changes, but the logic of abusing loosely scoped permissions is identical.

How CVE-2026-56155 fits into an attack chain

Because CVE-2026-56155 requires an already authorized attacker, the natural way to think about it is as an intermediate link. A plausible chain, described conceptually and without actionable steps, would connect an initial access (for example, credentials stolen through phishing or a foothold already obtained in the environment) with this privilege escalation over AD FS, culminating in manipulation of the federation service to forge tokens and persist.

That chaining is exactly why defense cannot rely on a single barrier. If we assume initial access will happen sooner or later, the question is how far the attacker can escalate once inside. An unhardened, unmonitored identity service turns a minor intrusion into a domain compromise.

Mitigation and response

The priority is unambiguous: patch now. Since this is an actively exploited zero-day with a CISA KEV deadline of 28 July 2026, every day without the patch is a real exposure window. This case illustrates why patch cycles matter so much; you can see how we approach others in our recap of the April 2026 Patch Tuesday and its critical vulnerabilities.

Beyond the patch, it is worth reinforcing your identity posture structurally:

1. Harden AD FS

Reduce the service's attack surface. Limit who has administrative access to the AD FS servers, treat those servers as Tier 0 assets (with dedicated, isolated admin workstations), review permission delegation, and remove any authorization broader than strictly necessary. Insufficient access-control granularity is the root cause of this CVE; hardening the access around AD FS mitigates the class of problem, not just this specific instance.

2. Monitor anomalous token issuance

Watch AD FS logs for unusual token issuance: unexpected signatures, anomalous volumes, tokens for out-of-pattern users or applications, or requests from strange locations. That said, a Golden SAML style attack can mint tokens outside AD FS and leave no normal issuance event, so also monitor access to the signing keys and certificates and anomalies in the applications that consume those tokens. Feed these logs into your SIEM and define specific alerts for identity-issuer activity.

3. Apply ITDR over your identity infrastructure

Identity threat detection and response (ITDR) is designed precisely for this scenario: detecting abuse of AD FS, Active Directory, and federation systems, and responding before the attacker consolidates persistence. If the term is new to you, we have a dedicated guide on what ITDR (identity threat detection and response) is.

4. Consider migrating to Entra ID

In the medium term, migrating federation from on-premises AD FS to Entra ID reduces the surface your organization must operate and patch, and shifts part of the security burden to Microsoft's managed platform. It is not an immediate action against this CVE (that is what the patch is for), but it is a strategic decision many organizations are already evaluating.

5. Move toward Zero Trust

The underlying lesson is that no identity and no token should be implicitly trusted. Continuous verification, least privilege, and access segmentation are principles that contain the impact of a compromised issuer. Our guide on what Zero Trust is and how to implement it develops this approach.

Frequently asked questions

Can CVE-2026-56155 be exploited without authentication?

No. It is a privilege escalation that requires the attacker to already be authorized or to hold some prior foothold in the environment. It is not a pre-authentication flaw exploitable by anyone from the internet, but it is a very dangerous link within an attack chain.

How does it relate to Golden SAML?

CVE-2026-56155 is the privilege escalation; Golden SAML is the type of attack that can follow. By compromising AD FS with elevated privileges, an attacker could forge valid authentication tokens and impersonate any user in federated applications. The CVE opens the door; token forgery is what lies on the other side.

Is patching enough?

Patching is essential and urgent, but not sufficient on its own. AD FS is critical identity infrastructure: you should also harden the service, monitor anomalous token issuance, apply ITDR, and review your identity strategy for the medium term, including a possible migration to Entra ID.

Why is there no more public technical detail?

Because Microsoft typically withholds the internal mechanism of flaws like this while organizations patch, so as not to enable mass exploitation. What is publicly confirmed is that it is an actively exploited elevation-of-privilege zero-day; there is no official CVSS or exploitation steps we can cite rigorously.

What deadline do I have to patch according to CISA?

CISA included CVE-2026-56155 in its KEV catalog with a remediation deadline of 28 July 2026 for federal agencies. Although that deadline is formally for the US federal scope, it serves as an urgency benchmark for any organization: if it is in the KEV and actively exploited, it does not allow delay.

How do I detect whether my AD FS has been compromised?

Review AD FS logs for anomalous token issuance, unexpected administrative access to federation servers, and out-of-pattern signing activity. A well-configured ITDR capability makes this detection easier by correlating signals across the identity infrastructure. On any indication, treat the incident as a potential Tier 0 compromise.

Related resources

• What a CVE is
• Active Directory pentesting: the tier model
• What IAM (identity and access management) is
• What ITDR is: identity threat detection and response
• AiTM phishing: session hijacking and MFA bypass
• AWS IAM privilege escalation
• What Zero Trust is: architecture and implementation
• April 2026 Patch Tuesday: critical vulnerabilities

Secra helps you protect your federated identity

At Secra we are an offensive cybersecurity company with our own CVE research program. We have discovered and published real vulnerabilities in NVD and INCIBE-CERT, such as CVE-2025-40652 in CoverManager and CVE-2023-3512 in Setelsa ConacWin CB. That attacker's mindset is what we apply when we audit your identity infrastructure: we look for the escalation and trust-abuse paths before a real adversary does.

If you operate AD FS, Active Directory, or any identity federation system, we can help you validate your exposure, review your hardening, and test your detection capability against scenarios like CVE-2026-56155. Get in contact with our team and let's talk about how to reduce your identity risk.