Loading vulnerability…
Local Privilege Escalation in Microsoft AD FS DKM Access Controls
CVE-2026-56155 is an insufficient-granularity-of-access-control vulnerability in Microsoft Active Directory Federation Services (AD FS). Overly permissive access control lists on the Distributed Key Manager (DKM) container can allow an authenticated, low-privileged local attacker to elevate privileges to administrator on an affected AD FS system. DKM stores symmetric keys used to encrypt token-signing and token-encryption certificates. The vulnerability requires no user interaction and has been actively exploited.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants administrator-level privileges on an affected AD FS server, compromising system confidentiality, integrity, and availability. Compromise of this identity infrastructure could enable identity forgery and facilitate access to other systems and applications that trust the federation service. These broader consequences depend on the deployment and associated trust relationships.
If you can’t patch tonight, do this now.
Use the AD FS DKM security checks to identify overly permissive container ACLs and enable the available permission-hardening remediation. With the July 2026 auditing functionality, checks run at AD FS service startup and every 24 hours; Event ID 1132 identifies insecure DKM-related conditions requiring attention. Audit mode alone does not prevent exploitation. Restricting local access to AD FS servers reduces opportunities for attackers to obtain the required foothold but does not replace permission remediation and security updates.
Patch, then assume compromise.
Apply the applicable Microsoft AD FS security updates and ensure insecure DKM container permissions are remediated. The July 14, 2026 updates introduced DKM ACL auditing and optional permission remediation. October 2026 cumulative updates automatically remediate insecure DKM container ACLs by default: KB5126868 for Windows Server 2016, KB5126651 for Windows Server 2019, KB5126655 for Windows Server 2022, and KB5126646 for Windows Server 2025. Leave automatic remediation enabled; setting RemediateDkmAcl to 0 disables it. Verify that insecure DKM permissions have been corrected rather than relying on audit-only deployment.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
127 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.