Is Your Organization at Risk? Microsoft Confirms Active Exploitation of a 0-Day Vulnerability in Active Directory Federation Services (AD FS)

As part of its July 2026 Patch Tuesday security updates, Microsoft has addressed a 0-day vulnerability in Active Directory Federation Services (AD FS), tracked as CVE-2026-56155. The most concerning aspect is that Microsoft has officially confirmed that this vulnerability is being actively exploited in real-world cyberattacks.

If successfully exploited, the vulnerability could allow an attacker with basic user-level access to the system to elevate their privileges to administrator level. As a result, it is considered a serious threat to corporate networks and identity infrastructure.

What Is AD FS and Why Is It Important?

Active Directory Federation Services (AD FS) is Microsoft’s centralized authentication and federated identity service that enables users to access multiple corporate services through Single Sign-On (SSO) using a single authentication.

AD FS is commonly integrated with:

  • Microsoft Active Directory;
  • Microsoft 365 and other cloud services;
  • Corporate web applications;
  • VPN and remote access systems;
  • Business platforms supporting federated authentication.

Because AD FS servers generate authentication tokens and validate user identities, they represent one of the most critical components of an organization’s identity infrastructure.

What Is the Vulnerability?

CVE-2026-56155 is caused by a flaw in the Access Control mechanism.

More specifically, insufficient permission validation within AD FS allows a user with limited privileges to perform operations beyond their intended authorization under certain conditions.

The vulnerability is classified as:

  • CWE-1220 – Insufficient Granularity of Access Control

Microsoft has rated the vulnerability as Important, assigning it a CVSS score of 7.8.

How Can It Be Exploited?

To exploit this vulnerability, an attacker must:

  • be authenticated to the system;
  • possess at least standard local user privileges.

If exploitation is successful, the attacker may be able to:

  • obtain administrator privileges;
  • modify security settings;
  • access authentication tokens;
  • alter federation configurations;
  • disable security mechanisms;
  • use the compromised server as a pivot point to attack other parts of the corporate network.

This could ultimately compromise the trustworthiness of the organization’s entire identity infrastructure.

Why Is This Vulnerability Particularly Dangerous?

AD FS servers process user authentication requests and generate security tokens that provide access to enterprise services.

If an attacker gains administrative control over an AD FS server, they may be able to:

  • impersonate legitimate users;
  • manipulate authentication mechanisms;
  • create new administrator accounts;
  • gain unauthorized access to corporate applications;
  • launch follow-on attacks against the Active Directory infrastructure.

For these reasons, AD FS servers have long been considered one of the most valuable targets for Advanced Persistent Threat (APT) groups and other sophisticated cybercriminals.

Active Exploitation Confirmed

Microsoft has classified this issue as a 0-day vulnerability and has officially confirmed that it is being actively exploited in real-world attacks.

The company also confirmed that exploit code exists. However, to provide defenders with additional time to deploy security updates, Microsoft has not publicly disclosed the technical details of the vulnerability.

The vulnerability was discovered by Jeremy Kingston and Scott Clark of Microsoft’s Detection and Response Team (DART).

Affected Systems

Microsoft has released security updates for the following platforms:

  • Windows Server 2012;
  • Windows Server 2012 R2;
  • Windows Server 2016;
  • Windows Server 2019;
  • Windows Server 2022;
  • Windows Server 2025;
  • Server Core installations;
  • Certain versions of Windows 10.

Organizations are strongly encouraged to install the July 2026 security updates as soon as possible.

Mitigation Recommendations

Microsoft and cybersecurity experts recommend that organizations take the following actions:

  • immediately install all July 2026 security updates on AD FS servers;
  • verify the system version and build number after applying the updates;
  • audit all changes made to local administrator groups;
  • monitor AD FS servers for unusual processes and services;
  • review federation configurations for unexpected modifications;
  • regularly analyze authentication logs;
  • enforce the Principle of Least Privilege when assigning administrative permissions;
  • require Multi-Factor Authentication (MFA) for privileged accounts;
  • continuously monitor AD FS servers using SIEM and EDR solutions.

Although CVE-2026-56155 cannot be exploited remotely, Microsoft’s confirmation that it is already being used in real-world attacks highlights the severity of this security issue. Since AD FS servers form the core of an organization’s identity and authentication infrastructure, a successful compromise could have far-reaching consequences across the entire enterprise network.

Vulnerabilities that enable attackers to obtain administrative privileges can allow them to manipulate authentication processes, modify security policies, and establish a foothold for compromising other critical corporate resources. Therefore, all organizations using AD FS should deploy Microsoft’s security updates without delay, strictly control privileged accounts, and continuously monitor their authentication infrastructure.

Today, identity systems serve as the digital gateway to every organization. Ensuring the security of that gateway remains one of the most essential requirements for protecting the entire information infrastructure.