CVE-2026-56155: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-56155 Overview

CVE-2026-56155 is a privilege escalation vulnerability in Microsoft Active Directory Federation Services (AD FS). Insufficient granularity of access control [CWE-1220] allows an authorized local attacker to elevate privileges on affected Windows systems. The flaw impacts multiple supported Windows Server releases and select Windows 10 builds that host AD FS roles.

CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. Organizations running AD FS as a federation and single sign-on component for enterprise identity should treat this as an urgent patching priority.

Critical Impact
An authenticated local attacker can elevate privileges on an AD FS host, gaining high impact on confidentiality, integrity, and availability of federated identity infrastructure.

Affected Products

Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025
Microsoft Windows 10 version 1607 (x86, x64)
Microsoft Windows 10 version 1809 (x86, x64)

Discovery Timeline

2026-07-14 - CVE-2026-56155 published to NVD
2026-07-15 - Last updated in NVD database
CISA KEV - Listed as a Known Exploited Vulnerability

Technical Details for CVE-2026-56155

Vulnerability Analysis

The vulnerability resides in the access control logic of Active Directory Federation Services. AD FS enforces authorization decisions with insufficient granularity, allowing an authorized user with local access to perform actions reserved for higher-privileged roles. The attacker must already hold valid credentials on the target host, but no user interaction is required to trigger the flaw.

Successful exploitation results in full compromise of the AD FS process context. Because AD FS issues security tokens for federated applications, an attacker who elevates privileges on the AD FS server can manipulate token signing, claims issuance, and trust relationships. This creates a pivot point into cloud services and downstream applications that rely on AD FS-issued tokens.

Root Cause

The root cause is classified under [CWE-1220] Insufficient Granularity of Access Control. AD FS authorization checks do not adequately distinguish between operations that should require elevated rights and those permitted to lower-privileged principals. As a result, actions with security-sensitive side effects are reachable from a less-privileged context on the same host.

Attack Vector

The attack vector is local. An attacker must authenticate to the AD FS server, either interactively or through a remote management channel that yields a local session. Once authenticated, the attacker invokes AD FS operations that the coarse-grained access control fails to restrict, resulting in privilege escalation to a context capable of modifying federation configuration or accessing token-signing material.

See the Microsoft CVE-2026-56155 Update Guide for technical details published by the vendor.

Detection Methods for CVE-2026-56155

Indicators of Compromise

Unexpected modifications to AD FS configuration, relying party trusts, or claims rules on federation servers.
New or altered token-signing or token-decrypting certificates in the AD FS configuration store.
Local logon events on AD FS servers from accounts that do not normally administer the role.
Anomalous access to the AD FS service account context or the adfssrv service.

Detection Strategies

Monitor the AD FS Admin and Security event logs for configuration change events and privilege use by non-administrative accounts.
Correlate Windows Security event IDs 4672, 4673, and 4688 on AD FS hosts with process activity touching AD FS binaries and the WID or SQL configuration database.
Baseline AD FS PowerShell cmdlet usage (Set-AdfsProperties, Add-AdfsRelyingPartyTrust, Set-AdfsCertificate) and alert on invocations by unexpected principals.

Monitoring Recommendations

Enable verbose AD FS auditing and forward logs to a central SIEM or data lake for retention and correlation.
Track sign-in telemetry from federated relying parties for anomalies that could indicate forged tokens.
Review local group membership on AD FS servers on a scheduled basis to detect unauthorized privilege changes.

How to Mitigate CVE-2026-56155

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-56155 to all AD FS servers and affected Windows 10 and Windows Server builds without delay.
Prioritize patching given the CISA KEV listing, which confirms active exploitation.
Rotate AD FS token-signing and token-decrypting certificates if compromise is suspected.
Restrict and audit local and remote logon rights on AD FS servers to a minimal set of administrators.

Patch Information

Microsoft has published guidance and update packages through the Microsoft CVE-2026-56155 Update Guide. Additional context is available in the CISA Known Exploited Vulnerabilities Catalog. Deploy the patch corresponding to each affected Windows build listed in the vendor advisory.

Workarounds

Enforce tiered administration so that AD FS servers are treated as Tier 0 assets, accessible only from Privileged Access Workstations.
Remove interactive and Remote Desktop logon rights from non-administrative users on AD FS hosts until patching completes.
Isolate AD FS servers on a management network segment and restrict inbound access to required federation endpoints only.

bash

# Configuration example: restrict interactive logon on AD FS hosts via Group Policy
# Computer Configuration > Windows Settings > Security Settings > Local Policies
#   > User Rights Assignment
#     - Allow log on locally: Administrators, ADFS-Admins
#     - Deny log on locally: Domain Users
#     - Allow log on through Remote Desktop Services: ADFS-Admins
#     - Deny log on through Remote Desktop Services: Domain Users