High severity · published Jul 14, 2026
CVE-2026-56155
Active Directory Federation Services Elevation of Privilege Vulnerability
In wildKEV
7.8
CVSS
0.3%
EPSS
Yes
On KEV
Description
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 14, 2026
Federal remediation dueJul 28, 2026
Ransomware campaign useNot known
Affected products
Which versions
W1
Windows 10 Version 1607 · Microsoft
10.0.14393.0 before 10.0.14393.9339 · source: vendor
W1
Windows 10 Version 1809 · Microsoft
10.0.17763.0 before 10.0.17763.9020 · source: vendor
WS
Windows Server 2012 · Microsoft
6.2.9200.0 before 6.2.9200.26226 · source: vendor, NVD
WS
Windows Server 2012 (Server Core installation) · Microsoft
6.2.9200.0 before 6.2.9200.26226 · source: vendor
WS
Windows Server 2012 R2 · Microsoft
6.3.9600.0 before 6.3.9600.23291 · source: vendor
WS
Windows Server 2012 R2 (Server Core installation) · Microsoft
6.3.9600.0 before 6.3.9600.23291 · source: vendor
WS
Windows Server 2016 · Microsoft
10.0.14393.0 before 10.0.14393.9339 · source: vendor, NVD
WS
Windows Server 2016 (Server Core installation) · Microsoft
10.0.14393.0 before 10.0.14393.9339 · source: vendor
WS
Windows Server 2019 · Microsoft
10.0.17763.0 before 10.0.17763.9020 · source: vendor, NVD
WS
Windows Server 2019 (Server Core installation) · Microsoft
10.0.17763.0 before 10.0.17763.9020 · source: vendor
WS
Windows Server 2022 · Microsoft
10.0.20348.0 before 10.0.20348.5386 · source: vendor, NVD
WS
Windows Server 2025 · Microsoft
10.0.26100.0 before 10.0.26100.33158 · source: vendor, NVD
In the news
VulnerabilityCritical
AI-driven bug hunting fuels record Microsoft Patch Tuesday
Microsoft has released patches for 570+ vulnerabilities on July 2026 Patch Tuesday, including two that are being leveraged by attackers (CVE-2026-56155 and CVE-2026-56164), and one that was previouly disclosed (CVE-2026-50661). The release was once again followed by Nightmare Eclipse publishing a stripped down proof-of-concept exploit for an unpatched Windows elevation of privilege (EoP) vulnerability, which the researcher dubbed LegacyHive. Vulnerabilities of note CVE-2026-56155 is an EoP flaw affecting Active Directory Federation Services (ADFS), and has … More →
The post AI-driven bug hunting fuels record Microsoft Patch Tuesday appeared first on Help Net Security .
Jul 15, 2026·Help Net Security
VulnerabilityHigh
[CISA KEV] CVE-2026-56155: Microsoft Active Directory Federation Services - Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
ADActive Directory Federation ServicesCVE-2026-56155
Jul 14, 2026·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56155
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
More from Windows 10 Version 1607
9.8
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
8.8
CVE-2026-96951
Windows Shell Security Feature Bypass Vulnerability
8.8
CVE-2026-21510
Windows Shell Security Feature Bypass Vulnerability
8.8
CVE-2026-21513
MSHTML Framework Security Feature Bypass Vulnerability
8.8
CVE-2025-33073
Windows SMB Client Elevation of Privilege Vulnerability