BCY-ADV-2026-018
HIGH — CVSS 7.8 — ZERO-DAY
Microsoft Active Directory Federation Services — Privilege Escalation Zero-Day
CVE-2026-56155 · Local Low-Priv → Administrator · Discovered During Active Intrusion by DART
CVE-2026-56155
CVSS 7.8
CISA KEV
Zero-Day
Privilege Escalation
Active Directory
AD FS
DKM
Identity Infrastructure
Actively Exploited
Prepared by Warren Barr · Barr Cyber LLC · barr-cyber.com · July 2026
What This Is
CVE-2026-56155 is a privilege escalation zero-day in Microsoft Active Directory Federation Services (AD FS) that allows a low-privileged local user to gain administrator capabilities on the AD FS server. It was discovered and reported by Jeremy Kingston and Scott Clark of the Microsoft Detection and Response Team (DART) — Microsoft's own incident response function. That attribution is significant: DART does not publish theoretical research. The flaw was found while responding to a real intrusion. Patched in July 2026 Patch Tuesday. Added to CISA's KEV catalog July 14, 2026.
AD FS is the identity broker in many enterprise Microsoft environments. It issues and validates security tokens for SAML, OAuth, and WS-Federation authentication. Compromise of an AD FS server puts every application that trusts it at risk — internal applications, cloud workloads, and any service using federated identity. An administrator on the AD FS server can forge tokens, read encrypted certificate credentials, and impersonate any user in the federation.
This flaw requires local access — but that is not a meaningful restriction in the context of a breach. Attackers with any foothold on an AD FS server (via phishing, supply chain, or adjacent RCE) can use this to escalate to administrator on identity infrastructure. AD FS servers should be treated as Tier-0 assets: patch priority equal to domain controllers.
CVE Details
CVE: CVE-2026-56155
CVSS v3.1: 7.8 HIGH
CWE: CWE-1220 (Insufficient Granularity of Access Control)
CISA KEV: Yes — added July 14, 2026. Federal deadline July 17, 2026 (BOD 26-04)
Affected: Windows Server with Active Directory Federation Services role installed
Patch: July 2026 Patch Tuesday cumulative update (KB5121391 and related) — requires additional manual hardening steps, not just the standard cumulative update
Authentication required: Yes — local low-privileged user
Discovery: Microsoft DART (Jeremy Kingston and Scott Clark) — found during active incident response
How It Works
The vulnerability is rooted in insufficient access control on the Active Directory Distributed Key Manager (DKM) container. AD FS uses the DKM container in Active Directory to store encrypted certificate material used to sign and decrypt federation tokens. Specifically, the DKM container holds the private key material AD FS uses to sign SAML tokens, OAuth tokens, and other identity assertions.
The access control list on the DKM container does not apply sufficient granularity to limit which users on the AD FS server can access it. A low-privileged user with local access to the AD FS server can read the DKM container through the AD FS server's existing, elevated Active Directory access — and from that access, can extract the certificate material used for token signing. With token signing material, the attacker can issue arbitrary tokens impersonating any user in the federation, including domain administrators and privileged service accounts.
Microsoft's own guidance for this CVE explicitly states that the remediation involves reviewing and correcting the access control list on the DKM container. The July cumulative update alone is not sufficient — administrators must also review KB5121391 and manually harden the DKM container ACL.
Why This Matters Even With Local Access Required
The "local access required" vector restriction often leads organizations to under-prioritize privilege escalation bugs. That is the wrong call for AD FS specifically. Several realistic paths give an attacker local access to an AD FS server without direct administrator credentials:
— A phishing attack that compromises a user account with RDP or VPN access to the server segment
— RCE through a web application on the same server or same segment
— Supply chain compromise of software running on AD FS (monitoring agents, backup software, etc.)
— The SharePoint CVEs in BCY-ADV-2026-017, which often share network infrastructure with AD FS in Microsoft environments
— Any adjacent code execution in the domain that achieves local user context on the federation server
The discovery context reinforces this: DART found it during a live intrusion. An attacker already in the environment was using it to escalate on identity infrastructure.
Detection
Check patch status:
# On the AD FS server, check for July 2026 cumulative update
Get-HotFix | Where-Object { $_.HotFixID -match "KB512139" } | Select-Object -Property *
# Must show KB5121391 or later July 2026 update for your Windows Server version
# Additional: check Windows Update history for July 14, 2026 or later updates
Get-WindowsUpdateLog # generates log to Desktop
Audit the DKM container ACL (the core of the remediation):
# Find the DKM container in Active Directory
# AD FS stores its DKM container under:
# CN=ADFS,CN=Microsoft,CN=Program Data,DC=yourdomain,DC=com
# (exact path varies — check AD FS configuration for DkmEncryptionKey value)
# PowerShell — check who has read access to the DKM container:
$dkmPath = (Get-AdfsProperties).DkmEncryptionKey
$acl = Get-Acl "AD:$dkmPath"
$acl.Access | Format-Table IdentityReference, ActiveDirectoryRights, AccessControlType -AutoSize
# Look for: any identity beyond ADFS service account + Domain Admins
# having Read access to the DKM container is the vulnerability indicator
Audit AD FS server login history for unexpected access:
# Review Security event log on the AD FS server for:
# Event 4624 (logon) — look for unexpected user accounts
# Event 4672 (special privileges assigned) — EoP indicator
# Event 4648 (explicit credential logon) — lateral movement
Get-WinEvent -LogName Security -FilterXPath `
"*[System[(EventID=4624 or EventID=4672) and TimeCreated[timediff(@SystemTime) <= 2592000000]]]" |
Where-Object { $_.Message -notmatch "NT AUTHORITY\\SYSTEM|DWM-|UMFD-" } |
Select-Object TimeCreated, Id, Message | Format-List
Check for unexpected SAML token issuance in AD FS event log:
# AD FS Auditing — Event 1202 (token issued)
# Look for tokens issued for high-privilege accounts from unexpected sources
Get-WinEvent -LogName "AD FS/Admin" | Where-Object {
$_.Id -eq 1202
} | Select-Object TimeCreated, Message | Format-List
IOCs
CVE CVE-2026-56155
Root cause Insufficient ACL on AD FS DKM container in Active Directory
Attack result Low-priv local → read DKM cert material → forge federation tokens → any user
Discovery Microsoft DART (incident response) — Jeremy Kingston, Scott Clark
CISA KEV Added July 14, 2026. Deadline July 17, 2026.
Key risk Token forgery for any identity in the federation (all federated apps)
Patch note Standard cumulative update NOT sufficient — KB5121391 + manual ACL fix required
Related Often co-exploited alongside SharePoint CVEs (BCY-ADV-2026-017)
Remediation
Sources & References
BCY-ADV-2026-018 · Published July 2026 · Barr Cyber LLC · Kalispell, MT
More like this, when it happens
Advisories only. No newsletter, no marketing, unsubscribe in one click.
Barr Cyber — Identity Infrastructure & Endpoint Hardening
AD FS servers are frequently misconfigured, under-monitored, and treated as normal file servers rather than Tier-0 identity infrastructure. If your federation environment has not been reviewed, or if you need help assessing whether this CVE has been exploited in your environment, contact Barr Cyber.
Get in Touch →
