CVE-2026-56155
Confirmed PUBLISHEDActive Directory Federation Services Elevation of Privilege Vulnerability
11 hours faster than CISA KEV
Recommended Action
Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
At a Glance
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- CVE Published
- Jul 14, 2026
- Exploitation Reported
- Jul 14, 2026
- CVSS
- 7.8 High
- EPSS
- —
Affected Versions
| Vendor | Product | Version | Status |
|---|---|---|---|
| Microsoft |
Windows 10 Version 1607
|
10.0.14393.0 to < 10.0.14393.9339 |
Affected |
| Microsoft |
Windows 10 Version 1809
|
10.0.17763.0 to < 10.0.17763.9020 |
Affected |
| Microsoft |
Windows Server 2012
|
6.2.9200.0 to < 6.2.9200.26226 |
Affected |
| Microsoft |
Windows Server 2012 (Server Core installation)
|
6.2.9200.0 to < 6.2.9200.26226 |
Affected |
| Microsoft |
Windows Server 2012 R2
|
6.3.9600.0 to < 6.3.9600.23291 |
Affected |
| Microsoft |
Windows Server 2012 R2 (Server Core installation)
|
6.3.9600.0 to < 6.3.9600.23291 |
Affected |
| Microsoft |
Windows Server 2016
|
10.0.14393.0 to < 10.0.14393.9339 |
Affected |
| Microsoft |
Windows Server 2016 (Server Core installation)
|
10.0.14393.0 to < 10.0.14393.9339 |
Affected |
| Microsoft |
Windows Server 2019
|
10.0.17763.0 to < 10.0.17763.9020 |
Affected |
| Microsoft |
Windows Server 2019 (Server Core installation)
|
10.0.17763.0 to < 10.0.17763.9020 |
Affected |
| Microsoft |
Windows Server 2022
|
10.0.20348.0 to < 10.0.20348.5386 |
Affected |
| Microsoft |
Windows Server 2025
|
10.0.26100.0 to < 10.0.26100.33158 |
Affected |
| Microsoft |
Windows Server 2025 (Server Core installation)
|
10.0.26100.0 to < 10.0.26100.33158 |
Affected |
CVE References
- Active Directory Federation Services Elevation of Privilege Vulnerability msrc.microsoft.com · Vendor Advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155
Recommended Actions
- Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
- Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.
Known Exploited Vulnerability Sources
Catalogues that list this CVE as a known exploited vulnerability.
Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| Microsoft CVRF First | 2026-07-14 07:00 UTC |
| CISA | 2026-07-14 17:38 UTC |
| CVE | 2026-07-14 19:02 UTC |
| Tenable Blog | 2026-07-14 19:20 UTC |
No detection artifacts or sensor request patterns are available for this CVE yet.
Check back as sensor telemetry and scanner integrations are updated.
Virtual Patch
Compensating WAF rules to help reduce exposure to this CVE. Rule content and deployable vendor exports are available with KEVIntel Enterprise.
KEVIntel does not currently have a virtual patch for this CVE. When available, KEVIntel virtual patches ship as deployable ModSecurity, Cloudflare, and AWS WAF rules.
Enterprise feature. Virtual patch rule content and deployable vendor exports (ModSecurity, Cloudflare, AWS WAF) are available to KEVIntel Enterprise users.
CVSS Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Exploitation Status
Exploited in the wild
Recorded 2026-07-14 07:00:00 UTC · Microsoft CVRF
Weaknesses (CWE)
-
Insufficient Granularity of Access Control
Recent Mentions
Tenable Blog · Jul 14, 2026
56Critical510Important3Moderate0LowMicrosoft addresses 569 CVEs in the largest Patch Tuesday release yet. This month’s release includes three zero-days, two of which were exploited in the wild.Microsoft patched 569 CVEs in its July 2026 Patch Tuesday release, with 56 rated critical, 510 rated as important, and 3 rated as moderate. This marks the largest Patch Tuesday release ever, crushing the previous record of 198 CVEs in June. Last week, Microsoft announced that its multi-model agentic scanning harness (MDASH) is being used to identify vulnerabilities faster and noted that “customers will see a higher volume of security updates included in each security release.”This month’s update includes patches for:.NET.NET Core.NET FrameworkASP.NET CoreActive Directory Certificate Services (AD CS)Active Directory Domain ServicesActive Directory Federation Services (AD FS)Azure Active DirectoryAzure CycleCloudAzure Monitor AgentAzure Spring AppsCode Integrity DLL (ci.dll)Composite Image File System DriverContent Delivery ManagerDesktop Window ManagerExtensible Storage Engine (ESENT)GitHub Copilot and Visual StudioGitHub Copilot and Visual Studio CodeGithub CopilotHTTP/2Microsoft 365 Copilot for iOSMicrosoft Bing App for IOSMicrosoft CopilotMicrosoft DefenderMicrosoft Defender for EndpointMicrosoft Dynamics NAVMicrosoft Edge for AndroidMicrosoft Exchange ServerMicrosoft Fabric Data WarehouseMicrosoft Graphics ComponentMicrosoft Input Method Editor (IME)Microsoft Install ServiceMicrosoft NAT Helper Components (ipnathlp.dll)Microsoft OfficeMicrosoft Office ExcelMicrosoft Office OneNoteMicrosoft Office PowerPointMicrosoft Office SharePointMicrosoft Office WordMicrosoft Printer DriversMicrosoft SurfaceMicrosoft WindowsMicrosoft Windows App StoreMicrosoft Windows Codecs LibraryMicrosoft Windows Media FoundationMicrosoft Windows Search ComponentMicrosoft Windows SpeechMicrosoft XMLMicrosoft XML Core ServicesMinecraft Bedrock Dedicated ServerOutlook CopilotPower BIQuality Windows...
Timeline
Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.
-
19:20 UTC about 2 hours ago19:20 UTC · about 2 hours ago
KEV confirmed by Tenable Blog
Exploitation attested by an external source
-
19:02 UTC about 2 hours ago19:02 UTC · about 2 hours ago
KEV confirmed by CVE
Exploitation attested by an external source
-
17:38 UTC about 3 hours ago17:38 UTC · about 3 hours ago
Added to CISA KEV
Listed in the CISA Known Exploited Vulnerabilities catalog
-
17:05 UTC about 4 hours ago17:05 UTC · about 4 hours ago
CVE published
Vulnerability disclosed publicly
-
07:00 UTC about 14 hours ago07:00 UTC · about 14 hours ago
Added to KEVIntel KEV Feed
High-confidence, third-party attested exploitation
-
13:53 UTC 25 days ago13:53 UTC · 25 days ago
CVE ID reserved
Identifier reserved by the CNA
Automate This Intelligence with the Pro API
Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
Pro API Example
GET /api/v2/pro/kevs/CVE-2026-56155
{
"cve_id": "CVE-2026-56155",
"title": "Active Directory Federation Services Elevation of Privilege Vulnerability",
"affected_vendor": "Microsoft",
"affected_product": "Windows 10 Version 1607, Windows 10 Version 1809, Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core installation)",
"affected_versions": [
{ "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
],
"confidence": "Confirmed",
"cvss_score": 7.8,
"epss_score": null,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": false
},
"sensor_telemetry": { "...": "Pro API fields" },
"proof_of_concepts": [ "..." ],
"scanner_integrations": [ "..." ]
}