CVE-2026-56155: The AD FS Privilege Escalation Bug That Hands Over Your Token-Signing Keys

Active Directory Federation Services quietly became one of the most attractive privilege escalation targets of 2026. CVE-2026-56155 lets an attacker who already has a low-privilege foothold on an AD FS server jump straight to full administrator control, including control over the server’s token-signing infrastructure. If AD FS issues tokens anyone in your organization trusts, that is as serious as it sounds.

What CVE-2026-56155 actually is

The vulnerability is an insufficient granularity of access control issue inside AD FS. Certain internal operations that should require administrator-level rights are reachable by an authenticated, low-privilege account that already has some presence on the box. From there, the attacker escalates to administrator, and administrator on an AD FS server means the ability to forge or manipulate the signed tokens AD FS hands out to every relying application that trusts it.

• CVSS score: 7.8 (Important)
• Attack vector: local, requires an existing authenticated foothold (not remote/unauthenticated)
• Affected systems: AD FS roles on Windows Server 2012/2012 R2 (with ESU), 2016, 2019, 2022, 23H2, and 2025
• Exploitability: functional exploit code exists, and this vulnerability has been tracked under active exploitation

The key detail: this is not a remote, zero-click bug like the Exchange Visio flaw covered separately on this site. It requires an attacker to already be somewhere on the server, as a low-privileged account, service account, or via another foothold. That makes it a textbook “second stage” vulnerability, exactly the kind used after an initial phishing or credential-theft foothold to take over identity infrastructure.

Quick guide: check and patch your AD FS servers

Run this on each AD FS server to see installed updates and confirm the role is present:

Get-WindowsFeature -Name ADFS-Federation
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 15 HotFixID, InstalledOn
Get-AdfsProperties | Select-Object Identifier, HostName

1. Confirm which Windows Server build each AD FS role instance is running on ([System.Environment]::OSVersion.Version or Get-ComputerInfo | Select WindowsProductName, OsVersion).
2. Apply the current cumulative update for that build through Windows Update, WSUS, or your patch management tool. The fix for CVE-2026-56155 ships as part of the standard monthly cumulative update, not a standalone hotfix.
3. After patching, re-run Get-HotFix and confirm the latest cumulative update’s KB number is present and dated after the patch’s release.
4. Separately, review who has local administrator or service-account rights on the AD FS box itself. Since this flaw depends on an existing low-privilege foothold, tightening who can log on to the AD FS server at all shrinks the attack surface even before you patch.

Why this one matters even if you “only” use AD FS for SSO

A compromised AD FS token-signing certificate or configuration doesn’t just affect the AD FS box. Every application that trusts tokens from that AD FS instance, internal portals, partner extranets, cloud app federations, inherits the blast radius. Treat an AD FS server with the same urgency you’d treat a domain controller, because for authentication purposes, it effectively is one.

FAQ

Do I need to be internet-facing to be at risk? No. The vulnerability itself requires local access or an existing foothold, but that foothold can come from phishing, a compromised service account, or lateral movement from elsewhere on the network, it does not require the AD FS server to be directly exposed to the internet.

Is my AD FS server a domain controller? Usually not, AD FS is normally deployed on member servers, but it holds signing keys that are just as sensitive, so it needs equivalent protection.

What if I don’t run AD FS at all? Then this specific CVE doesn’t apply, but it’s still worth confirming the role truly isn’t installed anywhere (Get-WindowsFeature ADFS-Federation on every server) rather than assuming.

Sources: Microsoft Security Response Center advisory for CVE-2026-56155; CISA Known Exploited Vulnerabilities catalog.