CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Active Directory Federation Services Elevation of Privilege Vulnerability
Other sources
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
— Microsoft
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.9339Patch KB5099535 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.23291Patch KB5099444 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.26226Patch KB5099445 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.33158Patch KB5099536 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.5386Patch KB5099540 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.9020Patch KB5099538 - Compensating control
Discontinue use of Microsoft Active Directory Federation Services (AD FS) if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56155?
CVE-2026-56155 has a high severity rating of 7.8.
How do I fix CVE-2026-56155?
To fix CVE-2026-56155, apply mitigations in accordance with vendor instructions and follow CISA’s guidance.
What does CVE-2026-56155 exploit?
CVE-2026-56155 exploits insufficient granularity of access control in Active Directory Federation Services.
Can CVE-2026-56155 lead to privilege escalation?
Yes, CVE-2026-56155 allows an authorized attacker to elevate privileges locally.
Which software is affected by CVE-2026-56155?
CVE-2026-56155 affects several Microsoft Windows Server and Windows 10 versions including Windows Server 2012 and 2019.