AD FS elevation of privilege exploited in the wild (CVE-2026-56155)

high severity · exploited in the wild · published 2026-07-14

An attacker with low-privilege access can escalate to SYSTEM or domain administrator on the AD FS server and forge authentication tokens for any user. This vulnerability is actively exploited in the wild.

Fixed in: 10.0.26100.33158

CVE: CVE-2026-56155

Source: Microsoft (MSRC)

Get the fix

Fixlane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the Fixlane MCP server and call get_fix_prompt with incident id 1582 and your operating system.