CVE-2026-56155: Microsoft Active Directory Federation Services — Local Privilege Escalation

Background

Microsoft Active Directory Federation Services (ADFS) is the trust anchor for federated authentication in many enterprise Windows environments. It issues SAML tokens that authenticate users to relying party applications — SaaS platforms, partner portals, and internal web applications. ADFS servers are among the highest-value targets in enterprise Microsoft environments because control of the signing keys enables persistent authentication as any user to any federated application.

CVE-2026-56155 is a local privilege escalation vulnerability in ADFS. A locally authenticated attacker with low privileges on a Windows Server running the ADFS role can exploit insufficient access control granularity (CWE-1220) to escalate to SYSTEM or administrative privilege on that host. The CVSS 3.1 base score is 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). CISA added this to the Known Exploited Vulnerabilities catalog on July 14, 2026, with a July 28 remediation deadline.

Technical Mechanism

CWE-1220 (Insufficient Granularity of Access Control) occurs when access controls are defined at too coarse a level — for example, distinguishing only between “authenticated” and “unauthenticated” rather than enforcing least-privilege restrictions on which operations each user class may perform.

In the ADFS context, certain filesystem paths, service configuration interfaces, or inter-process communication channels used by the ADFS service carry weaker access controls than warranted. A locally authenticated user with standard or limited permissions can interact with these ADFS service components in ways that lead to privilege escalation. The specific exploitation mechanism likely involves one or more of:

• Service endpoint abuse: ADFS exposes named pipes, COM interfaces, or WCF endpoints for internal service communication. Insufficient ACLs on these endpoints allow a low-privileged local process to impersonate or inject into the ADFS service.
• File or registry permission misconfiguration: ADFS stores configuration data and sensitive material in locations whose ACLs grant write access to non-privileged users, enabling modification of service behavior.
• Token signing key exposure: Weaknesses in protection of token signing certificate private keys that allow a low-privileged local user to read private key material, enabling offline token forgery.

ADFS runs as a service with elevated privileges, typically under Network Service or a dedicated service account with domain-level access. It maintains private key material for token signing certificates, user session data, and federation trust configurations — all of which become accessible once privilege escalation is achieved.

Real-World Exploitation Evidence

CISA added CVE-2026-56155 to the Known Exploited Vulnerabilities catalog on July 14, 2026 with a two-week deadline of July 28. The longer deadline compared to the simultaneous SonicWall and SharePoint listings (three days) suggests exploitation is occurring at lower volume or with greater pre-condition requirements. Confirmed active exploitation means threat actors have operationalized this vulnerability within a multi-stage attack chain.

The local attack vector (AV:L) requires prior access to the ADFS host, making this a second-stage exploit. In observed attack patterns for this class of vulnerability, threat actors typically chain it as follows:

1. Initial access: Compromise a low-privileged account on a system with the ADFS role via phishing, credential stuffing, or exploitation of a separate remote vulnerability
2. Local privilege escalation via CVE-2026-56155: Escalate to SYSTEM or administrative privilege on the ADFS host
3. Token signing key theft: Extract ADFS token signing certificate private keys from the Windows Certificate Store or ADFS configuration database
4. Golden SAML: Forge SAML tokens offline to authenticate as any user to any relying party application
5. Persistence: Forged tokens remain valid regardless of password resets or account lockouts until the signing certificate is rotated and trusts updated

Impact Assessment

• Local privilege escalation to SYSTEM on the ADFS host from any valid local login
• Token signing key theft enabling offline SAML token forgery (Golden SAML attack)
• Authentication as any user to any application that trusts the compromised ADFS deployment
• Persistent access that survives password resets, account lockouts, and user account deletion
• Potential credential interception for authentication events processed through ADFS
• Wide blast radius: a single ADFS deployment may federate authentication for dozens of SaaS services, partner organizations, and internal applications

Affected Versions

Older Windows Server versions (2012 R2, 2016) with the ADFS role: consult the MSRC advisory for the definitive version matrix.

Remediation Steps

1. Apply the Microsoft patch via the July 2026 Patch Tuesday cumulative update for Windows Server. Deploy through Windows Update, WSUS, SCCM, or the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155.

2. Rotate ADFS token signing and token decryption certificates after patching. If exploitation has already occurred, stolen signing keys remain valid until rotated regardless of the patch:

# Rotate ADFS token signing certificate
Add-AdfsCertificate -CertificateType Token-Signing
Set-AdfsCertificate -CertificateType Token-Signing -Thumbprint <new_thumbprint> -IsPrimary

3. Restrict local logon to ADFS servers to domain administrators only via Group Policy:

Computer Configuration > Windows Settings > Security Settings > 
Local Policies > User Rights Assignment > Allow log on locally

4. Audit ADFS event logs for unexpected token issuance events and service interactions since the KEV listing date.

5. Enable Windows Defender Credential Guard on ADFS hosts where supported.

6. Deploy Privileged Access Workstations (PAWs) for ADFS server administration and restrict RDP to known jump-host IPs only.

7. Review and revoke all ADFS relying party trust relationships that are no longer current, and verify remaining trusts against current legitimate applications.

Detection Guidance

ADFS Event Log Monitoring

ADFS generates audit events under the AD FS audit source in the Windows Event Log:

• Event ID 1200: Token issuance — monitor for tokens issued outside business hours or for privileged accounts from unexpected endpoints
• Event ID 1202/1203: Claims processing anomalies indicating unexpected token content
• Security Event ID 4648: Explicit credential use by the ADFS service account performing unexpected actions
• Security Event ID 4672: Special privileges assigned to accounts that should not hold elevated privileges

Privilege Escalation Indicators

• Process creation events showing low-privileged processes spawning children with elevated tokens
• New security principal added to the local Administrators group on the ADFS host
• Changes to ADFS service configuration outside maintenance windows
• Access to ADFS token signing certificate private key material from processes other than the ADFS service

Microsoft Sentinel / KQL

// Detect ADFS token signing key access anomalies
SecurityEvent
| where Computer contains "adfs" or Computer contains "sts"
| where EventID in (4656, 4663)
| where ObjectName contains "ADFS" or ObjectName contains "token signing"
| where SubjectUserName !contains "ADFS" and SubjectUserName !endswith "$"
| project TimeGenerated, Computer, SubjectUserName, ObjectName, ProcessName
| order by TimeGenerated desc

Indicators of Compromise

• Unexpected processes accessing ADFS service named pipes or endpoints
• SAML tokens issued for high-privilege accounts without corresponding authentication events in IdP logs
• New local administrator accounts on ADFS hosts with no change management record
• ADFS signing certificate exported or accessed by non-service accounts

Timeline

References

• NVD — CVE-2026-56155
• CISA KEV Catalog
• MSRC Advisory — CVE-2026-56155
• Microsoft ADFS Security Guidance