Privilege Escalation Risk in Microsoft AD FS (CVE-2026-56155)

Historical catalog analysis: CISA added this entry on July 14, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-56155 is a security flaw in Microsoft Active Directory Federation Services (AD FS) characterized by insufficient granularity of access control (CWE-1220). This vulnerability allows an attacker who is already authorized within the system to elevate their privileges locally. Because AD FS is often used to manage single sign-on and identity federation across various healthcare applications, a local privilege escalation could potentially grant unauthorized administrative access to systems managing electronic protected health information (ePHI).

Exposure and applicability

This vulnerability applies to organizations utilizing Microsoft AD FS for identity management. In a healthcare context, this often includes large provider networks or health plans that federate identities between on-premises directories and cloud-based clinical tools. The risk is particularly relevant for security leaders managing the HIPAA Security Rule’s requirements for access control and the principle of least privilege. While CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog as of July 14, 2026, it is noted that the vulnerability requires an authorized attacker to initiate the escalation.

Remediation priorities

Based on our analysis, healthcare organizations should prioritize the following actions to reduce risk:

1. Apply Vendor Mitigations: The primary defense is to implement the mitigations provided by Microsoft. This addresses the root cause of the insufficient access control granularity.
2. Evaluate Internet Exposure: Security teams should identify if AD FS assets are exposed to the internet, as this could increase the surface area for potential attackers to gain the initial authorized access required to exploit the flaw.
3. Review Administrative Access: In alignment with HIPAA risk management, organizations should audit current local administrative privileges on AD FS servers to ensure only essential personnel have high-level access, thereby limiting the potential impact of a privilege escalation attempt.

How to validate remediation

To verify that exposure has been reduced, organizations can employ the following methods:
* Version and Patch Verification: Confirm through system audits that the specific vendor mitigations for CVE-2026-56155 have been successfully deployed across all AD FS instances.
* Exposure Audit: Use network scanning or firewall configuration reviews to document whether AD FS endpoints are restricted to authorized networks or remain exposed to the public internet.
* Privilege Review: Conduct a review of local group memberships on affected servers to ensure no unauthorized accounts possess elevated permissions that would facilitate this specific escalation path.

Limits and open questions

It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA has set a remediation deadline of July 28, 2026, for federal agencies, this date is not a legal mandate for private healthcare providers, though it serves as a benchmark for risk urgency. Applying mitigations could reduce the likelihood of exploitation but does not eliminate all risks associated with identity federation or initial unauthorized access.

Source and editorial note

CVE-2026-56155: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability · Source date: July 14, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: July 17, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 03, 2026 at 03:37 UTC.

Request a healthcare security assessment