CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

What it is

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

What to do

Schedule the vendor fix into this week’s change window, prioritising internet-facing and business-critical systems. Confirm the fix is applied everywhere, not just where it was easy.

Priority

This week: Schedule into this week’s change window.

Severity (CVSS)

7.8 high

CISA assessment (SSVC)

actively exploited; needs manual effort per target; total control of the affected system

Exploit probability (EPSS, 30 days)

0.3%, higher than 26% of all CVEs

Added to CISA KEV

14 July 2026

CISA fix-by date

28 July 2026 (US federal agencies; a sensible deadline for everyone)

Ransomware use

Not known

Weakness

CWE-1220

References

• NIST NVD entry
• CISA KEV entry
• msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155

Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.