LIVE FEED
Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiperHardening a Personal Linux Server in an AfternoonMicrosoft 365 outage disrupts Outlook, Teams, and Copilot worldwideCheck Point patches zero-day root escalation flaw exploited against customersHackers Compromise 4,800 GitHub Accounts to Steal Cloud CredentialsHow to Put a Self-Hosted Service Behind SSO and Intrusion Blocking in an AfternoonBaker Tilly notifies clients of data breach at third-party provider
HIGH Actively exploited CWE-1220

CVE-2026-56155

Active Directory Federation Services Elevation of Privilege Vulnerability

Microsoft·Active Directory Federation Services

7.8/ 10
CVSS 3.1
High severity
0.35%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 29% of all CVEs
Listed
CISA KEV catalog
Added
Jul 14, 2026
Fix due
Jul 28, 2026
Ransomware
Not known
Timeline
Published
Jul 14, 2026
Updated
Nov 1, 2026
First covered
Jul 14, 2026
Latest story
4 months ago

Summary

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

CWE-1220Insufficient Granularity of Access Control

Attack profile

Attack vectorLocal
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected products

  • Microsoft Windows 10 Version 160710.0.14393.0 to before 10.0.14393.9339
  • Microsoft Windows 10 Version 180910.0.17763.0 to before 10.0.17763.9020
  • Microsoft Windows Server 20126.2.9200.0 to before 6.2.9200.26226
  • Microsoft Windows Server 2012 (Server Core installation)6.2.9200.0 to before 6.2.9200.26226
  • Microsoft Windows Server 2012 R26.3.9600.0 to before 6.3.9600.23291
  • Microsoft Windows Server 2012 R2 (Server Core installation)6.3.9600.0 to before 6.3.9600.23291
  • Microsoft Windows Server 201610.0.14393.0 to before 10.0.14393.9339
  • Microsoft Windows Server 2016 (Server Core installation)10.0.14393.0 to before 10.0.14393.9339

References

CVE.org recordcve.org NVD entrynvd.nist.gov CISA KEV listingcisa.gov Active Directory Federation Services Elevation of Privilege Vulnerabilitymsrc.microsoft.com
Daily at 7:00 AM Eastern

The 0700 Brief

Every new security and AI story, summarised in one email. Confirm by email, unsubscribe in one click.

43 readers have subscribed