Unattributed · vulnerability in CISA KEV, exploitation confirmed by the cataloguehigh
The layer that holds identity: the privilege flaw in AD FS
Microsoft Active Directory Federation Services — the component that provides single sign-on between an organisation and external services — has an insufficient-granularity access-control flaw: CVE-2026-56155. It lets an already-authenticated attacker elevate privileges locally. The NVD score is 7.8, so it is not the "one click and you are in" kind of flaw; but CISA added it to the Known Exploited Vulnerabilities catalogue, and it sits on the server that decides who is who. It is worth explaining why it matters even at 7.8.
Where "who you are" is decided
Active Directory Federation Services is not a product the end user sees. It is the cog that, behind the scenes, lets a person authenticate once inside their organisation and be recognised by external applications and services without entering credentials again. It issues the tokens other services trust to accept. At many enterprises and many public administrations it is the layer single sign-on rests on: the place where, technically, "who you are" is decided.
CVE-2026-56155 is, in Microsoft's description as carried by NVD, an insufficient granularity of access control that allows an authorised attacker to elevate privileges locally. In plain terms: someone who already has a foot inside the system — a limited-permission account, a session obtained by other means — can use it to move up. It does not open the front door; it widens the powers of whoever has already stepped through.
Why a "local 7.8" deserves attention
There is an understandable temptation, reading "requires local access" and "authorised attacker", to file the matter away. It is the same reasoning that pushes to the back of the patch queue everything not exploitable from the internet with a click. But two things the score alone does not capture matter here.
The first is position. A privilege escalation on some ordinary server is a local problem; a privilege escalation on the server that issues identity tokens is a problem that propagates. Whoever comes to control AD FS does not control an application: they control the trust every application places in those tokens. It is the difference between stealing a key and becoming the locksmith.
The second is that we are not reasoning about a hypothesis. Being added to the CISA KEV catalogue means the vulnerability is actively exploited by someone, somewhere. Privilege-escalation flaws are rarely the first step of an attack; they are the second, the one that turns modest access into control. That this one is already in use says someone is employing it in exactly that role.
- 01Initial access already obtainedlimited credentials, phishing, another exploit
- 02CVE-2026-56155 used locallycoarse-grained access control enables the climb
- 03Elevated privileges on AD FSaction on the component that governs identity
What to do, and what we do not know
The action is clear: apply the Microsoft update referenced in the MSRC entry, giving AD FS the priority an identity component deserves, not that of a departmental server. The CISA deadline — 28 July — is a good reference even for those not formally bound by it.
The uncertainties should be stated. The MITRE ATT&CK identifiers given (T1068, T1078) are a reasoned mapping onto the type of vulnerability, not IDs published in the Microsoft advisory; we present them as a reading. It is not public, at this time, who is exploiting the flaw or against which targets: the CISA catalogue records exploitation, it does not attribute it. And the real exposure perimeter depends on how many organisations still run AD FS on-premises rather than having moved federation to cloud services — a figure that varies greatly by sector and that no source here quantifies reliably. What is certain is where the flaw sits. And on the identity layer, "only 7.8" is not an excuse to wait.
