CVE-2026-56155

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jul 15, 2026

Description

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1220

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.9339
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.9020
Microsoft	Windows Server 2012	>= 6.2.9200.0, < 6.2.9200.26226
Microsoft	Windows Server 2012 (Server Core installation)	>= 6.2.9200.0, < 6.2.9200.26226
Microsoft	Windows Server 2012 R2	>= 6.3.9600.0, < 6.3.9600.23291
Microsoft	Windows Server 2012 R2 (Server Core installation)	>= 6.3.9600.0, < 6.3.9600.23291
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.9339
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.9339
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.9020
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.9020
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.5386
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.33158
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.33158

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155US Government Resource

Timeline

Published: Jul 14, 2026
Last modified: Jul 15, 2026
Added to CISA KEV: Jul 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-561567.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-561575.4Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.CVE-2026-561599.8Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.CVE-2026-56167.3A security vulnerability has been detected in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeec CVE-2026-561609.9Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.CVE-2026-561619.6Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.CVE-2026-5616210.0Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.CVE-2026-5616310.0Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges ove CVE-2026-561649.8Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a net CVE-2026-561659.8Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.CVE-2026-561678.8Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.CVE-2026-561686.5Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a network.