What is the CVSS score of CVE-2026-56155?

CVE-2026-56155 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Active Directory Federation Services are affected by CVE-2026-56155?

Active Directory Federation Services (AD FS) deployments on Windows Server 2012-2025 contain a local privilege escalation vulnerability that allows authenticated users to elevate their permissions…. A patch is available.

Is there a public PoC exploit available for CVE-2026-56155?

Yes, a public proof-of-concept exploit is available for CVE-2026-56155. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-56155?

Within 24 hours, inventory all AD FS deployments across Windows Server 2012-2025 environments and assess current access control configurations. Within 7 days, apply the patch available per vendor advisory to all identified AD FS instances, prioritizing production domain controllers and hybrid identity infrastructure. Within 30 days, complete validation testing to confirm patch deployment across the environment and monitor Active Directory logs for privilege escalation attempts.

Active Directory Federation Services CVE-2026-56155

EUVD-2026-44042 HIGH

Insufficient Granularity of Access Control (CWE-1220)

2026-07-14 microsoft

GHSA-p436-qch3-9m59

Information Disclosure Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires an existing low-privilege local session on the AD FS host (AV:L, PR:L) with no user interaction, and successful escalation yields full high impact on the same system.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 18:20 CISA

Analysis Generated

Jul 14, 2026 - 17:55 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 7.8

DescriptionCVE.org

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-privileged user on the host gain higher privileges due to insufficient granularity of access control (CWE-1220). Affected deployments span AD FS on Windows Server 2012 through Windows Server 2025, and the flaw carries a CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority-driven rather than exploitation-driven risk.

Technical ContextAI

AD FS is Microsoft's on-premises identity federation and single sign-on service that issues security tokens (SAML/WS-Federation/OAuth) to broker authentication between organizations and relying-party applications, typically running on domain-joined Windows Server hosts. The root cause is CWE-1220, Insufficient Granularity of Access Control, meaning a permission boundary within AD FS is enforced too coarsely, so an authorized principal can reach or manipulate resources or operations that should be restricted to a higher trust level. Per the CPE data the vulnerable code ships across Microsoft Windows Server 2012, 2012 R2, 2016, 2019 (including Server Core installations) and the tags extend coverage to Windows Server 2022 and 2025, plus Windows 10 Version 1607/1809 client builds, indicating the affected component is part of the AD FS role available across these Windows platforms.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56155 to all AD FS servers across the affected Windows Server builds via the Microsoft Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155 (no exact fix build number was provided in the input, so pull the KB matching each server's OS version from that page). Because exploitation requires a local low-privileged foothold, meaningful compensating controls until patching completes are: restrict interactive and remote logon rights on AD FS servers to a minimal set of tier-0 identity administrators (trade-off: tighter operational access may slow routine maintenance), treat AD FS hosts as tier-0 assets and remove any non-administrative or service accounts that do not need local logon, and increase monitoring of local logon events and privilege-use auditing on these hosts to detect escalation attempts (trade-off: added log volume). Avoid co-hosting other roles or general-purpose services on AD FS servers to reduce the pool of low-privileged principals able to attempt local exploitation.