CVE-2026-56155 ADFS Elevation of Privilege: The Actively Exploited Flaw Sysadmins Still Haven't Patched

CVE-2026-56155 ADFS elevation of privilege is an actively exploited vulnerability in Active Directory Federation Services (AD FS) that Microsoft patched in its July 14, 2026 security updates — after attackers were already using it. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal civilian remediation deadline of July 28, 2026. Two weeks past that deadline, per public reporting, exploitation is still active in environments that have not applied the update or opted into the follow-up hardening it introduces.

This article stays close to what Microsoft's own advisory and support documentation, NVD, CISA, and independent security outlets have published. It does not reproduce exploit code or invent technical detail beyond what these sources describe.

For a look at how ACL misconfigurations already turn into full domain compromise without any CVE involved, see ACL Abuse and DCSync: The Silent Paths to Domain Admin. CVE-2026-56155 is a different mechanism from the AD CS enrollment flaw covered in Certighost CVE-2026-54121 AD CS: Low-Privileged Users Can Impersonate a Domain Controller — that bug abuses certificate enrollment; this one abuses the ACL protecting AD FS's own key-protection container. For how privileged rights creep back into an environment even after a CVE like this is patched, see Privileged Access Drift Active Directory: How Admin Rights Creep Back After Audits.

CVE-2026-56155 ADFS Elevation of Privilege: What It Is

CVE-2026-56155 is rated Important, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and classified under CWE-1220 (Insufficient Granularity of Access Control). Microsoft's advisory describes it as: "Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally."

Public reporting (Tenable, The Hacker News) credits the discovery to Microsoft's own Detection and Response Team (DART), found during active incident-response work rather than proactive research — meaning attackers were already using this flaw before Microsoft or the wider community knew about it. It shipped as part of Microsoft's July 14, 2026 Patch Tuesday alongside a second actively exploited zero-day in SharePoint Server (CVE-2026-56164). CISA's KEV entry lists the affected product simply as "Active Directory Federation Services" and requires agencies to "apply mitigations in accordance with vendor instructions."

Affected AD FS roles run on Windows Server 2012 and 2012 R2 (with Extended Security Updates), Windows Server 2016, 2019, 2022, and 2025.

How the Vulnerability Works

AD FS uses a Distributed Key Manager (DKM) container, an object stored in Active Directory, to hold the symmetric keys that protect the private keys behind AD FS's token-signing and token-encryption certificates. Every server in an AD FS farm reads this container to share the same signing material. Per Microsoft's support documentation for the fix (KB5121391), the container's Access Control List was too permissive: principals beyond the intended set could read or modify the DKM object, and an attacker with that access could work toward decrypting the protected token-signing key material and escalating to administrator.

Microsoft's hardened baseline restricts DKM container access to four principals only:

Remediation disables ACL inheritance on the container and discards every inherited access-control entry, removing any Allow permission outside that baseline.

Detection

Public write-ups covering the incident-response discovery do not describe an AD FS-specific exploitation signature beyond this audit event. For broader AD FS/domain controller log coverage, see Active Directory Monitoring: Security Event IDs That Matter. Treat the absence of 1132 warnings, combined with confirmed KB5121391 installation and RemediateDkmAcl enabled, as the concrete evidence of a hardened container rather than inferring compromise from event volume alone.

Remediation

1. Patch every AD FS server first. Install your OS's July 14, 2026 (or later) cumulative security update fleet-wide — the KB varies by OS: KB5099445 (Windows Server 2012), KB5099444 (2012 R2), KB5099535 (2016), KB5099538 (2019), KB5099540 (2022), KB5099536 (2025). KB5121391 is Microsoft's explainer article for this ACL hardening behavior, not itself an installable update. Installing the cumulative update alone only enables audit mode — it does not change any ACL yet.
2. Opt in to remediation now rather than waiting for enforcement:
   • Windows Server 2016 and later: set HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl to 1.
   • Windows Server 2012 / 2012 R2 (ESU): first grant the AD FS service account WriteOwner and WriteDacl permissions on the DKM container, then set the same registry value.
3. Track the enforcement date. Automatic remediation begins October 13, 2026 for Windows Server 2016 and later that have not opted in manually; Windows Server 2012 and 2012 R2 always require manual remediation, even after that date.
4. Validate. After remediation, confirm the DKM container's ACL matches Microsoft's baseline (table above) and confirm token signing, relying-party SSO, and federation metadata still work normally.

# Confirm your OS's July 2026+ cumulative update is installed before trusting audit-mode silence
# Use the KB matching your OS from step 1 above, e.g. KB5099538 for Windows Server 2019
Get-HotFix -Id KB5099538 -ErrorAction SilentlyContinue

🚨 Danger: setting RemediateDkmAcl to 0 opts out of the hardening entirely. Microsoft's own guidance states the container "remains vulnerable" in that state — use it only to stage a controlled rollout, never as a long-term posture.

CISA's federal civilian remediation deadline for this CVE was July 28, 2026 — already past. Any AD FS estate still unpatched or still on default (audit-only) settings today is running past both the vendor's and the U.S. government's own remediation timeline.

How EtcSec Detects This

No check in the EtcSec catalogue targets the AD FS DKM container's ACL specifically yet — this is a genuine gap the CVE exposed, not one covered by existing detections. It sits close to capabilities the catalogue does already check for: ACL GenericAll, ACL WriteDACL, and ACL WriteOwner all flag the same class of overly broad object-level permissions that made this container exploitable, and Privileged Access Review Required flags environments where nobody is periodically re-checking who holds rights like these. None of them substitute for confirming KB5121391 and RemediateDkmAcl status directly — that patch-and-registry check is the concrete action to take today, ahead of any tooling-based detection.

Primary References

• NVD: CVE-2026-56155
• Microsoft Security Response Center: CVE-2026-56155 advisory
• Microsoft Support: KB5121391 — CVE-2026-56155 AD FS DKM container ACL hardening
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-56155
• Tenable: Microsoft's July 2026 Patch Tuesday Addresses 569 CVEs (CVE-2026-56155, CVE-2026-56164)
• The Hacker News: Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack
• Cyberpress: Microsoft Active Directory FS Privilege Escalation Flaw Exploited in Active Attacks