Insufficient granularity of access control in Active Directory Federation Services

CVE-2026-56155 is an insufficient granularity of access control flaw (CWE-1220) in Active Directory Federation Services (AD FS). A user with any authenticated local session on the AD FS server can reach configuration surfaces, private key material, or claim-issuance internals that should be gated to the AD FS service account and administrators only. The immediate exposure is on hosts running the AD FS role on Windows Server; Microsoft's advisory covers current supported branches (Server 2019, 2022, 2025) and the associated Web Application Proxy role where it federates auth.

The vendor's HIGH / 7.8 score is *directionally correct but understated for the class of asset it lands on*. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) treats this like any local EoP, but AD FS is not just any host — it is the token-signing authority for federated identity. Confidentiality on this box means signing keys and claim rules; integrity means the ability to mint tokens for arbitrary users into arbitrary relying parties. The generic vector cannot express that blast radius.

Why this verdict

• Role multiplier — canonical Tier 0: AD FS is the token-signing authority for every federated app in the tenant. Chain outcome on the high-value role is Golden-SAML-equivalent → floor is HIGH, and a case can be made for CRITICAL on any org with heavy SaaS federation.
• Friction: local access to a Tier 0 host is meaningful but not exotic. Helpdesk-tier admin sprawl, shared service accounts, and Tier 0 hygiene gaps mean a determined intruder with an initial foothold routinely reaches AD FS within days — this friction keeps the verdict from being CRITICAL by default but does not pull it below HIGH.
• No public exploit yet, but the downstream primitives are pre-built. ADFSDump and AADInternals already implement the DKM → signing-key → forged-token chain; whichever access-control weakness this CVE exposes only needs to bridge to that existing pipeline.
• Not KEV-listed and no observed in-the-wild use — this is why the reassessed score sits at 8.1 rather than pushing into CRITICAL. Escalate to CRITICAL immediately if KEV listing or telemetry of exploitation appears.

Why not higher?

CRITICAL requires either active exploitation, remote-unauthenticated reachability, or a public PoC against a canonically Tier 0 asset. This CVE has none of those *yet* — it requires an authenticated local session, and no PoC has dropped. If a working exploit appears within the 30-day window, re-rate to CRITICAL immediately.

Why not lower?

MEDIUM is unavailable regardless of friction because the affected component is definitionally Tier 0 identity infrastructure. A generic 'requires internal / local access' argument does NOT break the HIGH floor when the local host in question is the federation trust root — that would be assuming away the entire point of the bug.

1. Restrict AD FS logon rights to a named Tier 0 admin group — Enforce via GPO 'Allow log on locally' + 'Allow log on through Remote Desktop Services' on AD FS servers, listing only PAW-issued Tier 0 admin accounts. Removes step 1 of the chain for 99% of would-be exploit attempts. Deploy within 30 days per the noisgate HIGH mitigation SLA.
2. Enable DKM container object-access auditing — Turn on SACL auditing on CN=ADFS,CN=Microsoft,CN=Program Data,DC=… and alert on any 4662 event from a non-service principal. This is the earliest possible detection point for step 3 (DKM read). Deploy within 30 days.
3. Rotate AD FS token-signing and token-decrypting certificates now — twice — If you suspect any Tier 0 exposure in the past 90 days, rotate signing cert, wait for AutoCertificateRollover to promote the secondary, then rotate again. Invalidates any pre-existing extracted key. Run in parallel with patching, not after.
4. Enforce Conditional Access with device compliance + phishing-resistant MFA on all federated RPs — Even a valid signed SAML token can be denied by Entra ID Conditional Access if the device is non-compliant. Not a full mitigation (attacker can join a compliant device) but meaningfully raises cost. Deploy or verify within 30 days.
5. Consider migrating from AD FS to Entra ID as primary IdP — Microsoft has been signaling AD FS end-of-life for years; every federation CVE strengthens the case. Not a 30-day action, but this CVE should be the trigger to put migration on the FY26 roadmap.

Run on each AD FS server as a local administrator. Checks the installed KB list against the July 2026 Patch Tuesday cumulative update for that OS SKU. Invoke: .\Check-CVE-2026-56155.ps1. Exits 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#requires -RunAsAdministrator
# Check-CVE-2026-56155.ps1
# Verifies July 2026 Patch Tuesday cumulative update is installed on AD FS role hosts.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

# Map OS build -> minimum required KB for CVE-2026-56155 fix
# NOTE: replace placeholder KB IDs with the exact KBs from the MSRC advisory for your SKU
$requiredKBs = @{
    '10.0.17763' = 'KB5040000'  # Server 2019 (placeholder)
    '10.0.20348' = 'KB5040001'  # Server 2022 (placeholder)
    '10.0.26100' = 'KB5040002'  # Server 2025 (placeholder)
}

# 1. Is AD FS role actually installed?
$adfsInstalled = $false
try {
    $svc = Get-Service -Name adfssrv -ErrorAction Stop
    if ($svc) { $adfsInstalled = $true }
} catch {
    Write-Host 'AD FS service (adfssrv) not present on this host. This checker is for AD FS servers only.'
    exit 2
}

if (-not $adfsInstalled) {
    Write-Host 'UNKNOWN: AD FS role not detected.'
    exit 2
}

# 2. Identify OS build
$os = Get-CimInstance Win32_OperatingSystem
$build = "$($os.Version)"
$shortBuild = ($build -split '\.')[0..2] -join '.'

if (-not $requiredKBs.ContainsKey($shortBuild)) {
    Write-Host "UNKNOWN: unrecognized OS build $build — verify against MSRC advisory manually."
    exit 2
}

$targetKB = $requiredKBs[$shortBuild]

# 3. Check installed hotfixes
$installed = Get-HotFix -ErrorAction SilentlyContinue | Where-Object { $_.HotFixID -eq $targetKB }

if ($installed) {
    Write-Host "PATCHED: $targetKB present on build $build."
    exit 0
} else {
    Write-Host "VULNERABLE: $targetKB missing on build $build. Apply July 2026 cumulative update immediately."
    Write-Host 'Additionally: audit Tier 0 logon rights and consider proactive token-signing certificate rotation.'
    exit 1
}

Sources

1. MSRC advisory CVE-2026-56155
2. CWE-1220: Insufficient Granularity of Access Control
3. Microsoft — Securing AD FS servers (Tier 0 guidance)
4. Mandiant — Remediation and Hardening Strategies for Microsoft 365 to Defend Against Golden SAML
5. AADInternals — Nestori Syynimaa
6. Mandiant ADFSDump (GitHub)
7. CISA KEV catalog
8. FIRST EPSS