CVE-2026-56155 is an important-severity elevation of privilege vulnerability in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control. An authorized attacker could use it to elevate privileges locally.

The vulnerability lies in an access control list on the Distributed Key Manager (DKM) container in Active Directory. If the ACL is too permissive, an authorized local attacker can read the DKM material and decrypt the private keys that protect token-signing and token-encryption certificates.

Affected systems include Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025, and their Server Core installation variants.

• Windows Server 2012 / 2012 R2 – (Affected)
• Windows Server 2016 – (Affected)
• Windows Server 2019 – (Affected)
• Windows Server 2022 – (Affected)
• Windows Server Core installations – (Affected)
• Microsoft Entra ID (cloud) – (Protected via cloud servicing)

Any organisation running on-premises AD FS for federated identity, SSO, or hybrid Azure AD environments is at risk.

This flaw in Active Directory Federation Services stems from insufficiently granular access control. An attacker who already has local, authorized access - perhaps through stolen credentials or a compromised low-privilege account - can use this bug to escalate their rights on the system.

• Step 1- Initial Access The attacker obtains a foothold on the network through one of the following methods: · Stolen or phished low-privilege domain credentials · Exploitation of another vulnerability to gain initial access · Compromised internal workstation or service account
• Step 2 - Targeting the DKM Container The vulnerability lies in an access control list on the Distributed Key Manager container in Active Directory. If the ACL is too permissive, an authorized local attacker can read the DKM material and decrypt the private keys that protect token-signing and token-encryption certificates.
• Step 3 - Token Signing Key Extraction With access to the DKM container, the attacker extracts the AD FS token-signing certificate private key. This key is the cryptographic foundation of all trust relationships established by the AD FS farm
• Step 4 - Golden SAML Token Forgery Using the extracted token-signing private key, the attacker can forge valid SAML authentication tokens for any user in the federated environment - including administrators
•  
•  
•  

CERTVU recommends the following:

Primary - Apply July 2026 Security Update Immediately

Install the July 14, 2026 Patch Tuesday cumulative update for your Windows Server version. Administrators should review Microsoft's CVE-2026-56155 guidance and KB5121391 rather than treating the standard Windows cumulative update as the entire remediation plan.