Active Directory Federation Services CVE-2026-56155

Exploitation requires the attacker to already be a low-privileged authenticated principal with local access to a host running the AD FS role (CVSS AV:L, PR:L, UI:N), so this is not remotely reachable and cannot be triggered by an anonymous network attacker. The limiting factors are: a pre-existing local foothold/valid low-privilege credentials on the AD FS server, the AD FS role being installed and in use on the affected Windows Server version, and no user interaction needed once local access is held. It does not depend on a special non-default AD FS configuration in the available data, but it is gated entirely by the requirement for prior local authenticated access.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H) describes a locally-exploitable, low-complexity flaw requiring a low-privilege authenticated foothold and no user interaction, yielding full impact within the same security scope - consistent with a classic privilege-escalation primitive rather than a remote entry point. No EPSS score was provided and the CVE is not in CISA KEV, and no POC is referenced, so all three exploitation-likelihood signals point away from imminent mass exploitation; the danger is realized only after an attacker already has code execution/login on the AD FS server. Note a data conflict worth verifying: the tags label this 'Information Disclosure' while the description and the C:H/I:H/A:H vector describe local privilege elevation - the impact classification is inconsistent between sources, so confirm the precise impact against Microsoft's advisory. Because AD FS is a high-value identity component, a successful escalation here is serious despite the local vector, but absent public exploit code this is a prioritize-and-patch item, not an emergency.

An attacker who has already obtained a low-privileged authenticated session on an AD FS server - for example a compromised service account or a foothold from another local flaw - invokes the affected AD FS functionality whose access control is enforced too coarsely and thereby elevates to higher privileges on the identity server. Given AV:L/AC:L, the technique is reliable and requires no user interaction, but there is no public exploit identified at time of analysis, so an adversary would need to develop the primitive themselves.