CVE-2026-56155KEV · OVERDUECWE-1220

Active Directory Federation Services Elevation of Privilege Vulnerability

High · published July 14, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 27.0th percentile for exploit probability.

88
days past CISA
deadline
CVSS v3.1
7.8
EPSS
0%
Percentile
27.0
In the wild
Confirmed
What it is

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00346 · 27.0th percentile
Weakness
CWE-1220 · Insufficient Granularity of Access Control
Published
2026-07-14T17:05Z
KEV added
2026-07-14 · due 2026-07-28
EPSS history
Timeline
  • 14 JUL 17:05Z
    Active Directory Federation Services Elevation of Privilege Vulnerability
    cvelistv5
  • 14 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 28
    kev