Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

TACTICThreat Analysis & Cyber Threat Intelligence Center
System themeFrançais

Back to the watch

CVE-2026-56155

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

UrgentCVSS 7.8 v3.1Exploited

Why this priority

?

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

  • Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

Affected products

VendorProductVersions
MicrosoftActive Directory Federation ServicesAll versions
MicrosoftWindows 10 Version 1607
  • from 10.0.14393.0 to 10.0.14393.9339 excluded
MicrosoftWindows 10 Version 1809
  • from 10.0.17763.0 to 10.0.17763.9020 excluded
MicrosoftWindows Server 2012 (Server Core installation)
  • from 6.2.9200.0 to 6.2.9200.26226 excluded
MicrosoftWindows Server 2012 R2 (Server Core installation)
  • from 6.3.9600.0 to 6.3.9600.23291 excluded
MicrosoftWindows Server 2012 R2
  • from 6.3.9600.0 to 6.3.9600.23291 excluded
MicrosoftWindows Server 2012
  • from 6.2.9200.0 to 6.2.9200.26226 excluded
MicrosoftWindows Server 2016 (Server Core installation)
  • from 10.0.14393.0 to 10.0.14393.9339 excluded
MicrosoftWindows Server 2016
  • from 10.0.14393.0 to 10.0.14393.9339 excluded
MicrosoftWindows Server 2019 (Server Core installation)
  • from 10.0.17763.0 to 10.0.17763.9020 excluded
MicrosoftWindows Server 2019
  • from 10.0.17763.0 to 10.0.17763.9020 excluded
MicrosoftWindows Server 2022
  • from 10.0.20348.0 to 10.0.20348.5386 excluded
MicrosoftWindows Server 2025 (Server Core installation)
  • from 10.0.26100.0 to 10.0.26100.33158 excluded
MicrosoftWindows Server 2025
  • from 10.0.26100.0 to 10.0.26100.33158 excluded

Revision history

  1. Revision 3

  2. Revision 2

    Update : Affected versions changed

  3. Revision 1

    New record

Qualification

CVSS severity
?

Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary

7.8 HIGH CVSS v3.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
KEV catalog
?

CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary

Listed
Exploitation
Confirmed
EPSS probability
?

Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary

Unknown
Confidence
?

Quality of the sources behind the record. It is not a risk score. See the glossary

High

Priority rules, version 1

CISA KEV catalog

Added on
14 July 2026
Federal due date
28 July 2026
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use
Unknown

Record

Published on
14 July 2026
Weaknesses (CWE)
CWE-1220

Sources

References

CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability · Avanguard TACTIC