Microsoft Active Directory Federation Services (AD FS) Privilege Escalation Vulnerability (CVE-2026-56155) Security Advisory

1. Apply Official Security Patches

Refer to the Microsoft MSRC Update Guide and immediately install the latest cumulative security updates for your Windows Server version.

2. Temporary Mitigation & Permission Auditing

If immediate patching is not feasible, restrict permissions on AD FS directories and registry keys.

• Audit and Restrict AD FS Directory Permissions (PowerShell):

# Verify ACLs on the AD FS installation directory
Get-Acl -Path "C:\Windows\ADFS" | Format-List

# Restrict write permissions for non-administrative users (Example: Deny Write for Builtin\Users)
$acl = Get-Acl -Path "C:\Windows\ADFS"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Users", "Write", "Deny")
$acl.AddAccessRule($accessRule)
Set-Acl -Path "C:\Windows\ADFS" -AclObject $acl

• Enforce Least Privilege for AD FS Service Accounts:

Ensure that AD FS services run under Group Managed Service Accounts (gMSA) with the minimum necessary privileges rather than Domain Admin accounts.

CVE-2026-56155 is a Local Privilege Escalation (LPE) vulnerability in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control (CWE-1220).

An attacker who already possesses local authenticated access with low privileges (PR:L) can exploit weak Access Control Lists (ACLs) on AD FS-related service binaries, directories, or registry paths. By manipulating these insecure configurations, the attacker can hijack the execution flow of the high-privileged AD FS service (e.g., via DLL hijacking or service binary replacement) to execute arbitrary code under the SYSTEM context.

This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog with a high EPSS score of 0.94, making immediate remediation critical.