CISA Flags Exploited Privilege Escalation Flaw in Microsoft AD FS
Active Exploitation · 3 sources · Updated 4mo ago · First seen Jul 15, 2026
CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog after reports of active exploitation against Microsoft Active Directory Federation Services (AD FS). The flaw is an elevation-of-privilege vulnerability caused by insufficient granularity of access control, mapped to CWE-1220, and allows an authorized attacker to elevate privileges locally on affected systems.
Microsoft rated the issue High with a CVSS v3.1 score of 7.8 and said it affects multiple supported Windows and Windows Server versions running AD FS, with patched builds available. CISA said ransomware use is unknown, directed organizations to apply Microsoft’s mitigations and follow associated forensic triage guidance, and set a 2026-07-28 remediation deadline for federal agencies under BOD 26-04.
