Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

HOCH 7.8EXPLOITED (CISA KEV)CVE-2026-56155 · Published 14/07/2026 · updated 15/07/2026

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability . Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 14/07/2026. Patch affected systems as an emergency.

Kurz gesagt

CVE-2026-56155 ist eine Schwachstelle (HOCH (CVSS 7.8)).
Wird aktiv ausgenutzt: CISA hat sie am 14/07/2026 in den KEV-Katalog aufgenommen.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.35%, höher als bei 28.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
Active Directory Federation Services Microsoft	Versions not published yet (product named by CISA KEV)

Description

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155 · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2026-56155

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free