Microsoft Active Directory FS Privilege Escalation Flaw Exploited in Active Attacks

Microsoft has disclosed an actively exploited elevation-of-privilege vulnerability in Active Directory Federation Services (AD FS), tracked as CVE-2026-56155. The flaw was released on July 14, 2026, as part of Microsoft’s largest Patch Tuesday on record, covering 622 CVEs, and carries a CVSS 3.1 base score of 7.8 with a temporal score of 7.2. The root cause is classified under CWE-1220: Insufficient Granularity of Access Control, meaning AD FS fails to enforce…