On July 28, 2026, the federal deadline passed to remediate CVE-2026-56155 — an actively exploited vulnerability in Microsoft’s Active Directory Federation Services (AD FS) that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on July 14. The flaw is not remarkable for its CVSS score, a middling 7.8. It is remarkable for what it exposes: the private cryptographic keys that AD FS uses to sign and encrypt the tokens organizations rely on to prove who their users are. An attacker who reaches those keys doesn’t need to steal passwords or defeat multi-factor authentication. They can mint trusted identities at will.

What the flaw is

AD FS is the component many enterprises use to federate identity — to let employees sign in once and reach applications, including cloud services, using tokens AD FS issues on their behalf. The security of that entire arrangement rests on a set of private token-signing and token-encryption keys. AD FS stores the material protecting those keys in a Distributed Key Manager (DKM) container inside Active Directory.

CVE-2026-56155 is a failure of access control on that container. Microsoft classifies the root cause as insufficient granularity of access control (CWE-1220): the permissions on the DKM container are broader than they should be, so accounts that were never meant to read the key material can do so. In practical terms, a low-privileged but authorized local attacker — someone who already has a foothold in the domain, such as a compromised standard user account — can elevate their access by reaching key material that should be walled off. Microsoft rates the vulnerability Important and warns of high impact to confidentiality, integrity, and availability.

The reason a “local privilege escalation” bug rises to the level of an emergency is the nature of what gets escalated to. Token-signing keys are the trust anchor of a federated environment. With them, an attacker can forge authentication tokens that downstream applications and cloud platforms will accept as genuine — a class of attack security researchers have long called a “Golden SAML.” That means access to email, file storage, and administrative consoles without ever triggering a normal login or an MFA prompt, because from the application’s perspective the forged token is indistinguishable from a legitimate one.

Why patching alone isn’t enough

Microsoft shipped the first stage of its fix in the July 14, 2026 Windows security updates, and CISA’s KEV listing set the federal civilian remediation deadline for today. But this is a case where installing the patch is necessary and not sufficient. The July update hardens the access-control model, yet it does not automatically correct an already-insecure DKM configuration. Organizations that apply the update but leave the existing permissions in place may remain exposed, and Microsoft has signaled further enforcement to come later in the year.

The affected footprint is broad. Vulnerable AD FS deployments span Windows Server 2012 and 2012 R2 (with Extended Security Updates), 2016, 2019, 2022, version 23H2, and 2025 — effectively any organization still running on-premises AD FS. And there is a second, harder problem: if an attacker exploited this flaw before you patched and extracted your token-signing keys, patching does not evict them. Stolen signing keys remain valid until they are rotated. Remediation therefore has to assume possible prior compromise, not just close the door going forward.

The bigger pattern: identity infrastructure is the target

CVE-2026-56155 fits a trend that has been building all year: attackers are going after the identity layer itself rather than individual accounts. Federation servers, certificate authorities, and directory services are high-value because compromising them undermines every authentication decision that depends on them. The same period saw active exploitation of Active Directory Certificate Services misconfigurations, a closely related attack surface The CyberSignal covered in its analysis of the CertiGhost AD CS exploit. When the machinery that issues trust is the target, defenses built around end-user credentials — even strong MFA — can be bypassed entirely.

Understanding why requires understanding how federated identity works: AD FS maps a user’s attributes into signed assertions that relying parties trust, a mechanism explained in Everykey’s primer on federated identity and attribute mapping. The token is only trustworthy if the keys behind it are secret. CVE-2026-56155 breaks that assumption at the root. It’s a reminder that a mature identity program has to protect not just the front door where users authenticate, but the back-end infrastructure that vouches for them.

What to do now

The immediate steps are clear. Apply the July 14, 2026 updates across all AD FS servers if you have not already. Then follow Microsoft’s guidance to tighten the DKM container ACLs, because the patch does not fix an existing loose configuration on its own. Treat both as required, not either-or.

Beyond that, assume the possibility of prior exploitation. Rotate AD FS token-signing and token-encryption certificates, ideally twice to fully invalidate any keys an attacker may hold, and review authentication logs and token issuance for anomalies that could indicate forged tokens — sign-ins with no corresponding endpoint activity, or tokens issued outside normal patterns. Restrict and monitor which accounts can access the DKM container going forward, and reduce the number of highly privileged accounts that could reach it in the first place.

Longer term, CVE-2026-56155 is another argument for reducing reliance on aging on-premises federation and for treating identity infrastructure as tier-zero — the most sensitive assets in the environment, protected accordingly. The attackers exploiting this flaw understand that whoever controls the keys controls the identities. Defenders need to internalize the same fact before the deadline, not after the forged tokens start showing up.

**Sources and further reading: **

• Microsoft’s CVE-2026-56155 guidance (KB5121391);
• CISA KEV catalog addition, July 14, 2026;
• Cyber Security News on the active exploitation.