Microsoft has disclosed CVE-2026-56155, an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS), as part of its July 2026 Patch Tuesday release. The flaw carries a CVSS v3.1 base score of 7.8 and was reported as exploited in the wild before a patch was available, making it a zero-day. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on July 14, 2026, and set a federal remediation deadline of July 28, 2026. The vulnerability was credited to Microsoft's Detection and Response Team (DART), the company's incident-response unit, which typically identifies such issues while investigating live intrusions.
The vulnerability is classified as CWE-1220, insufficient granularity of access control. It resides in the permissions applied to the Distributed Key Management (DKM) container that AD FS uses in Active Directory to store the symmetric keys protecting token-signing and token-encryption certificate private keys. When the DKM container's access control list (ACL) is overly permissive, an authorized attacker with low-privileged local access to an AD FS host can read the protected key material and elevate privileges to administrator, without user interaction and with low attack complexity.
Although exploitation requires an existing foothold on an AD FS server, the potential impact is severe because AD FS is core identity infrastructure. An attacker able to recover the token-signing private key can forge authentication tokens that appear cryptographically valid to any relying application across the federated estate, a technique commonly referred to as Golden SAML. The Zero Day Initiative has noted that pairing this vulnerability with a remote code execution flaw creates a viable chain for ransomware delivery, in which code execution on a networked host is followed by a pivot to AD FS, escalation to administrator, and forged-token access across federated services.
CVE-2026-56155, with a CVSS v3.1 base score of 7.8 and vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, is an elevation-of-privilege vulnerability in Active Directory Federation Services arising from insufficient granularity of access control (CWE-1220) on the Distributed Key Management container. NIST has not yet published a CVSS v4.0 score for this vulnerability. Affected AD FS deployments run on Windows Server 2012 and 2012 R2 (with Extended Security Updates), Windows Server 2016, 2019, 2022, version 23H2, and 2025. Microsoft addressed the issue in its July 14, 2026 security updates, with fixed builds including 14393.9339 for Server 2016, 17763.9020 for Server 2019, 20348.5386 for Server 2022, and 26100.33158 for Server 2025 (delivered via KB5121391 and related packages). The update introduces an audit mode that detects insecure DKM container ACL configurations and records Event ID 1132 in the AD FS Admin event log, but it does not automatically tighten permissions; Microsoft plans to move Windows Server 2016 and later systems into enforcement mode with the October 13, 2026 security update. Microsoft has confirmed exploitation in the wild, and the vulnerability is listed in the CISA KEV catalog.
The operational risk centers on the trust that AD FS establishes across an organization's applications and services. Because the DKM container protects the private keys behind token-signing and token-encryption certificates, an attacker who exploits this flaw can potentially forge authentication tokens for the entire federated environment. Forged-token attacks are difficult to detect because they bypass the normal authentication flow entirely: no password is entered, no multi-factor challenge is issued, and AD FS produces no record of issuing the token, while the relying application still records a successful sign-in. This detection blind spot means an intrusion can persist well beyond the initial compromise, and it raises the question of whether the signing certificate itself can still be considered trustworthy once exposure is suspected.
The compliance dimension is significant given the vulnerability's KEV status. For U.S. federal agencies, a KEV listing carries a binding remediation deadline — July 28, 2026 in this case — and, under federal directives, can also trigger an obligation to determine whether the affected asset was already compromised rather than merely to apply the patch. Organizations in regulated sectors, including energy, healthcare, and financial services, should treat the active-exploitation designation and DART attribution as grounds for a formal compromise assessment. Failure to remediate a known-exploited vulnerability affecting identity infrastructure can carry regulatory, contractual, and reputational consequences, particularly where federated authentication protects access to sensitive or safety-relevant systems.
Organizations operating AD FS should treat this vulnerability as both a patching and a compromise-assessment priority and take the following actions:
Applying the update, correcting the DKM container permissions, and validating that no unauthorized token issuance has occurred together reduce the exposure created by this vulnerability far more effectively than patching alone.
1898 & Co. works alongside organizations to assess and strengthen the identity and authentication infrastructure that underpins access to critical business and operational systems. Our security teams have experience evaluating Active Directory and federation deployments, reviewing access control configurations, and helping clients prioritize remediation of known-exploited vulnerabilities against operational constraints.
For an actively exploited flaw affecting AD FS, our approach combines rapid patch validation with focused compromise assessment. We help clients confirm that updates have been applied across the federation farm, review DKM container permissions and the associated audit events, and hunt for indicators of forged-token activity and unauthorized access to token-signing key material.
Where exposure of signing certificates is suspected, 1898 & Co. supports certificate rotation planning, detection engineering around Golden SAML and federated authentication anomalies, and the design of monitoring that helps reduce the likelihood that similar identity-layer attacks go unnoticed. Our analysts translate vendor guidance into actions that align with each client's environment and regulatory obligations.