← All Advisories

CVE-2026-56155: Microsoft Active Directory

Status: KEV  |  Advisory ID: CVE-2026-56155

Key Details

CVECVE-2026-56155
Affected productsMicrosoft Active Directory Federation Services
Exploitation statusListed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation.
Classified asCWE-1220 (Insufficient Granularity of Access Control)
KEV listingAdded to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-07-14.
Federal remediation deadline2026-07-28 (CISA KEV, Binding Operational Directive).

What to Know

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-56155