CVE-2026-56155

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-56155 7.8

Microsoft · Active Directory Federation Services · Added 2026-07-14 · Published 2026-07-14

3-Day Required KEV Active Exploitation

Details

VulnerabilityMicrosoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

VendorMicrosoft

ProductActive Directory Federation Services

Date added2026-07-14

Due date2026-07-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-1220

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

NVD: Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-25 21:43 UTC

Wall time0.5s

Searches4

Component defaultunknown

Sources https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening
https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164
https://windowsforum.com/security-alerts.84/cve-2026-56155-fix-ad-fs-dkm-acls-before-october-enforcement.438254/
https://cve.tools/blog/cve-2026-56155-adfs-dkm-acl-eop
https://etcsec.com/blog/cve-2026-56155-adfs-elevation-of-privilege
https://www.hackerposts.org/en/blog/adfs-cve-2026-56155-dkm-dart-zero-day

Hunting hypothesis agent

Hunt for Event 4662 where non-service accounts read DKM container thumbnailPhoto (GUID 8d3bca50) on AD FS servers, then correlate with cloud sign-ins lacking Event 1200 (Golden SAML) and Admin Event 1132 (unremediated ACL).

Research details

ComponentAD FS Distributed Key Manager (DKM) container — overly permissive Access Control List (ACL) in Active Directory allows low-privileged authenticated users to read token-signing private keys

PreconditionsLocal access (low-privileged authenticated user) to a Windows Server running Active Directory Federation Services (AD FS) on affected versions (Windows Server 2012 through 2025). The attacker must have a valid AD account with local access to the AD FS server. The DKM container ACL must not have been hardened (pre-patch default). Successful exploitation grants access to AD FS token-signing keys enabling Golden SAML attacks across Microsoft 365 and federated services. agent

DeliveryLocal (AD authenticated user on the AD FS server or domain-joined system); attacker reads DKM container thumbnailPhoto attribute from Active Directory using overly permissive default ACL, extracts token-signing symmetric key, decrypts the signing certificate offline, and forges Golden SAML tokens for federated authentication bypass across Microsoft 365 and all relying parties.

Public PoCno

Advisoryhttps://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening

Exploit notesNo public PoC exists. Microsoft DART discovered this vulnerability during a live intrusion investigation. The exploit leverages overly permissive default ACLs on the AD FS DKM container in Active Directory — the token-signing master key is stored in the thumbnailPhoto attribute of a contact object under CN=ADFS,CN=Microsoft,CN=Program Data. Any low-privileged authenticated user who can read that attribute can decrypt the token-signing certificate offline and forge Golden SAML tokens (MITRE T1606.002). KB 5121391 (July 14, 2026) begins auditing DKM ACLs; Event 1132 means exposed, 1135 means remediated. Auto-enforcement starts October 13, 2026. CVSS attack complexity: LOW | HIGH severity (CVSS 7.8).

SummaryMicrosoft Active Directory Federation Services (AD FS) on Windows Server 2012 through 2025 contains an insufficient granularity of access control vulnerability (CWE-1220) in the Distributed Key Manager (DKM) container. The DKM container stores symmetric keys that protect AD FS token-signing private keys in Active Directory. An overly permissive default ACL allows any authenticated low-privileged user to read these keys, enabling Golden SAML token forgery across federated services including Microsoft 365. Microsoft DART discovered the flaw during a live intrusion. KB 5121391 (July 2026) begins auditing DKM ACLs with auto-enforcement scheduled for October 13, 2026.

Tia coverage

First reported2026-07-15

First exploit report2026-10-02

Exploit report → KEV80 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

microsoft-july-2026-patch-tuesday-record-622-cves-two-exploited

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.