Federal Agencies Have Until Tomorrow to Patch an Actively Exploited AD FS Zero-Day

CVE-2026-56155, an elevation-of-privilege flaw in Active Directory Federation Services, is being actively exploited in the wild — and CISA’s Known Exploited Vulnerabilities deadline for federal agencies to patch it hits tomorrow, July 28. If you’re running AD FS and haven’t applied July’s Patch Tuesday update yet, this is the one to prioritize today.

The bug carries a CVSS score of 7.8 and stems from insufficient granularity of access control in AD FS. It lets an authenticated attacker who already has a foothold on the network escalate to administrative privileges. Microsoft’s own Detection and Response Team (DART) discovered it during incident response work — meaning it was found because it was already being used in real attacks, not in a lab. Microsoft classifies exploitation as “Detected,” its highest-confidence label for in-the-wild abuse.

It’s not a remote, unauthenticated compromise on its own — an attacker needs existing access to chain this with another exploit first. That’s exactly the profile that makes it dangerous in practice: it’s the privilege-escalation step in a multi-stage intrusion, the move that turns a single compromised account into full administrative control over your federation service, and by extension every application trusting it for authentication.

Nine other AD FS vulnerabilities were patched in the same July 2026 Patch Tuesday cycle, all rated “Important.” CVE-2026-56164, a related SharePoint Server elevation-of-privilege flaw with a missing-authentication root cause, was also confirmed exploited in the wild in the same release — CISA’s deadline for that one was July 17, so if you missed it, you’re already overdue.

What to do: apply Microsoft’s July 2026 cumulative security update to every server running AD FS. If you can’t patch immediately, audit AD FS admin group membership and recent privilege changes for signs of compromise — DART found this one during live incident response, which means detection tooling already exists for the behavior it enables. For SharePoint, Microsoft’s interim mitigation is enabling Antimalware Scan Interface (AMSI) with Request Body Scan mode set to Full. Federal agencies are required to comply by CISA’s KEV deadlines; everyone else should treat July 28 as the deadline too.

Sources

Related reading