Microsoft has addressed CVE-2026-56155, an actively exploited elevation of privilege (EoP) vulnerability affecting Active Directory Federation Services (AD FS). The flaw is caused by insufficient granularity in access control (CWE-1220), allowing an authenticated local attacker with low privileges to escalate to administrator-level access. Microsoft has rated the vulnerability as Important with a CVSS v3.1 score of high and confirmed that it is being exploited in the wild, making it a high-priority security concern for organizations using AD FS.

Although exploitation requires local authenticated access, the impact is severe because AD FS is a critical identity component that provides single sign-on (SSO) and federated authentication for enterprise environments. By exploiting this vulnerability, an attacker can obtain administrative privileges on an AD FS server, potentially compromising authentication services, accessing sensitive security materials, modifying federation settings, disabling security controls, and using the compromised server as a pivot point for further lateral movement across the network.

Microsoft released security updates for affected platforms, including Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, as well as applicable Server Core deployments and supported Windows 10 versions sharing the affected components. Organizations should prioritize deploying the July 2026 security updates on all AD FS servers, especially those integrated with Active Directory or supporting critical business applications. Administrators should also verify successful installation by confirming updated build numbers after patching.

Beyond patching, organizations should strengthen monitoring and access controls to detect potential exploitation or post-compromise activity. Security teams are advised to review changes to the local Administrators group, monitor unusual process executions on AD FS servers, and investigate unexpected modifications to federation configurations and authentication events. Since exploitation depends on local authenticated access, enforcing the principle of least privilege, limiting unnecessary local administrator rights, and closely monitoring privileged account activity can significantly reduce the risk of successful attacks until all systems are fully remediated.