CVE-2026-56155

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Federation Services (affected versions not specified)

Description An access control weakness exists in the service and admin surfaces of Microsoft Active Directory Federation Services (AD FS) due to insufficient granularity in authorization checks. This improper design allows overly broad permissions to be applied or enforced. An authorized attacker with local access can abuse these permissive controls to perform actions beyond their intended role, leading to privilege escalation. Successful exploitation can compromise AD FS operations and downstream identity trust, impacting the confidentiality, integrity, and availability of federated authentication flows.

Recommendations Apply the latest cumulative updates immediately.