CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability . Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

• CISA KEV-listed (remediation due 2026-07-28)
• EPSS 0.3% (27.4% percentile)
• CVSS 7.8 high

Related briefings

• Microsoft fixes 622 flaws in July, two already under active attack 2026-07-14

Browse the CVE database

Read the full analysis on IntelFusions