Actively Exploited Privilege Escalation in Microsoft Active Directory Federation Services
Security Advisory Brief
Microsoft has disclosed CVE-2026-56155, an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS), as part of its July 2026 Patch Tuesday release. The flaw carries a CVSS v3.1 base score of 7.8 and was reported as exploited in the wild before a patch was available, making it a zero-day. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026, and set a federal remediation deadline of July 28, 2026. The vulnerability was credited to Microsoft's Detection and Response Team (DART), the company's incident-response unit, which typically identifies such issues while investigating live intrusions.
The vulnerability is classified as CWE-1220, insufficient granularity of access control. It resides in the permissions applied to the Distributed Key Management (DKM) container that AD FS uses in Active Directory to store the symmetric keys protecting token-signing and token-encryption certificate private keys. When the DKM container's access control list (ACL) is overly permissive, an authorized attacker with low-privileged local access to an AD FS host can read the protected key material and elevate privileges to administrator, without user interaction and with low attack complexity.
Although exploitation requires an existing foothold on an AD FS server, the potential impact is severe because AD FS is core identity infrastructure. An attacker able to recover the token-signing private key can forge authentication tokens that appear cryptographically valid to any relying application across the federated estate, a technique commonly referred to as Golden SAML. The Zero Day Initiative has noted that pairing this vulnerability with a remote code execution flaw creates a viable chain for ransomware delivery, in which code execution on a networked host is followed by a pivot to AD FS, escalation to administrator, and forged-token access across federated services.
Threats and Vulnerabilities
CVE-2026-56155, with a CVSS v3.1 base score of 7.8 and vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, is an elevation-of-privilege vulnerability in Active Directory Federation Services arising from insufficient granularity of access control (CWE-1220) on the Distributed Key Management container. NIST has not yet published a CVSS v4.0 score for this vulnerability. Affected AD FS deployments run on Windows Server 2012 and 2012 R2 (with Extended Security Updates), Windows Server 2016, 2019, 2022, version 23H2, and 2025. Microsoft addressed the issue in its July 14, 2026 security updates, with fixed builds including 14393.9339 for Server 2016, 17763.9020 for Server 2019, 20348.5386 for Server 2022, and 26100.33158 for Server 2025 (delivered via KB5121391 and related packages). The update introduces an audit mode that detects insecure DKM container ACL configurations and records Event ID 1132 in the AD FS Admin event log, but it does not automatically tighten permissions; Microsoft plans to move Windows Server 2016 and later systems into enforcement mode with the October 13, 2026 security update. Microsoft has confirmed exploitation in the wild, and the vulnerability is listed in the CISA KEV catalog.
Client Impact
The operational risk centers on the trust that AD FS establishes across an organization's applications and services. Because the DKM container protects the private keys behind token-signing and token-encryption certificates, an attacker who exploits this flaw can potentially forge authentication tokens for the entire federated environment. Forged-token attacks are difficult to detect because they bypass the normal authentication flow entirely: no password is entered, no multi-factor challenge is issued, and AD FS produces no record of issuing the token, while the relying application still records a successful sign-in. This detection blind spot means an intrusion can persist well beyond the initial compromise, and it raises the question of whether the signing certificate itself can still be considered trustworthy once exposure is suspected.
The compliance dimension is significant given the vulnerability's KEV status. For U.S. federal agencies, a KEV listing carries a binding remediation deadline — July 28, 2026 in this case — and, under federal directives, can also trigger an obligation to determine whether the affected asset was already compromised rather than merely to apply the patch. Organizations in regulated sectors, including energy, healthcare, and financial services, should treat the active-exploitation designation and DART attribution as grounds for a formal compromise assessment. Failure to remediate a known-exploited vulnerability affecting identity infrastructure can carry regulatory, contractual, and reputational consequences, particularly where federated authentication protects access to sensitive or safety-relevant systems.
Mitigations
Organizations operating AD FS should treat this vulnerability as both a patching and a compromise-assessment priority and take the following actions:
- Apply the July 14, 2026 security update (KB5121391 and related packages) to every AD FS server in the farm without delay, and restart or cycle the AD FS service during a controlled maintenance window so the new audit logic is active.
- Opt into DKM ACL remediation immediately by setting the RemediateDkmAcl registry key rather than waiting for the automatic enforcement scheduled for the October 13, 2026 security update.
- Review AD FS Admin event log entries 1132 through 1136 across all federation servers after patching to identify and correct insecure DKM container ACL configurations.
- Conduct a compromise assessment covering historical access to the DKM container, unexpected changes to AD FS service accounts, token-signing and token-encryption certificate activity, local administrator group membership, and privileged access on federation servers.
- If compromise cannot be ruled out, treat the token-signing and token-encryption certificates as potentially exposed and plan for their rotation, and restrict local and administrative access to AD FS hosts to the smallest possible set of accounts.
Applying the update, correcting the DKM container permissions, and validating that no unauthorized token issuance has occurred together reduce the exposure created by this vulnerability far more effectively than patching alone.
1898 & Co. Response
1898 & Co. works alongside organizations to assess and strengthen the identity and authentication infrastructure that underpins access to critical business and operational systems. Our security teams have experience evaluating Active Directory and federation deployments, reviewing access control configurations, and helping clients prioritize remediation of known-exploited vulnerabilities against operational constraints.
For an actively exploited flaw affecting AD FS, our approach combines rapid patch validation with focused compromise assessment. We help clients confirm that updates have been applied across the federation farm, review DKM container permissions and the associated audit events, and hunt for indicators of forged-token activity and unauthorized access to token-signing key material.
Where exposure of signing certificates is suspected, 1898 & Co. supports certificate rotation planning, detection engineering around Golden SAML and federated authentication anomalies, and the design of monitoring that helps reduce the likelihood that similar identity-layer attacks go unnoticed. Our analysts translate vendor guidance into actions that align with each client's environment and regulatory obligations.