AD FS CVE-2026-56155: Exploited EoP via Weak DKM Key ACLs

What to do

1. Identify every AD FS server (Get-WindowsFeature ADFS-Federation) and record its OS build.
2. Install the October 13, 2026 or later cumulative update on every farm member; it remediates insecure DKM container ACLs by default.
3. Check the AD FS/Admin log for events 1132, 1133, 1135, 1136 and 1137, and fix any remediation failure using KB5121391.
4. Save the previous DKM ACL (SDDL) from the 510 events tied to event 1135 before the log rolls over, and do not opt out with RemediateDkmAcl=0 without a tested reason.
5. If the old ACL let unexpected principals read the container, treat the token-signing and token-decryption keys as exposed and plan a certificate rollover.
6. Plan the move from AD FS to Microsoft Entra ID using Microsoft's decommission guide.

How to check if you are affected or compromised

• An AD FS/Admin event 1132 means the DKM container ACL was not in the expected secure state; 1133 means it was.
• Read the pre-remediation SDDL in the 510 events correlated with event 1135 to see which accounts or groups could read the DKM key material.
• On AD FS servers, review Security event 4732 (member added to a local group) and new services or scheduled tasks since July 2026; Microsoft has published no IOCs.

What happened#

In its July 14, 2026 Patch Tuesday release, Microsoft fixed CVE-2026-56155, an elevation-of-privilege flaw in Active Directory Federation Services (AD FS). The cause is "insufficient granularity of access control" (CWE-1220) that "allows an authorized attacker to elevate privileges locally," and Microsoft says a successful attacker "could gain administrator privileges." Microsoft rates it Important, CVSS 3.1 7.8. It was marked "Exploitation Detected" on release day, meaning exploited but not publicly disclosed beforehand. The release data credits Scott Clark and Jeremy Kingston of Microsoft's Detection and Response Team (DART), its incident response group. CISA added the CVE to the KEV catalog the same day, due July 28. Its KEV notes also point to Microsoft's AD FS decommission guide.

The MSRC entry says little more, but a companion article, KB5121391, explains the issue. AD FS stores the symmetric keys that protect its token-signing and token-encryption certificate private keys in a Distributed Key Manager (DKM) container in Active Directory. If that container's ACL is "overly permissive," an attacker with read access to the DKM key material could decrypt the token-signing private keys. A stolen signing key lets an attacker sign tokens that applications trusting the farm will accept.

Microsoft delivered the fix in two stages. The July update added an audit of the DKM container ACL at service start and every 24 hours, plus an opt-in remediation. Starting with the October 13, 2026 Windows update, AD FS fixes insecure ACLs by default.

Who is affected#

Any AD FS farm on Windows Server 2012, 2012 R2, 2016, 2019, 2022 or 2025 is affected. The CVE record lists these fixed builds: 6.2.9200.26226 (2012, KB5099445), 6.3.9600.23291 (2012 R2, KB5099444), 10.0.14393.9339 (2016, KB5099535), 10.0.17763.9020 (2019, KB5099538), 10.0.20348.5386 (2022, KB5099540) and 10.0.26100.33158 (2025, KB5099536). Windows 10 1607 and 1809 also appear because they receive the same cumulative updates as Server 2016 and 2019, but the risk sits with servers running the AD FS role.

Microsoft says remediation failures are most common on farms originally built on Server 2012 or 2012 R2. Those releases now get updates only through Extended Security Updates, and the KB5099444 notes give October 13, 2026 as the final ESU date.

Do you really need to act?#

If you run AD FS, yes, this week. The CVSS vector shows the attacker needs local access and a low-privileged account first. That is why Microsoft rates it Important rather than Critical, and why CISA marks it not automatable. But the target is tier-0 identity infrastructure, Microsoft's own incident responders found it being exploited, and the prize is the farm's signing keys. The Zero Day Initiative called AD FS "exactly the kind of identity infrastructure attackers love to pivot through." It also noted the bug "can also be paired with an RCE as we often see in ransomware."

The common mistake is assuming July closed the hole. Unless you opted in, the July update flagged weak DKM permissions but left them in place, and only the October update changes them automatically. Servers patched monthly through October still need an event-log check to confirm remediation succeeded. Organizations without AD FS have nothing specific to do.

What to do now#

1. Find AD FS servers with Get-WindowsFeature ADFS-Federation. Record each build with (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR.
2. Install the October 13, 2026 or later cumulative update on every farm member.
3. Run Get-WinEvent -LogName 'AD FS/Admin' | Where-Object Id -in 1132,1133,1135,1136,1137. Event 1133 means the ACL is secure. Event 1136 or 1137 means remediation failed. For 1137, find the container with (Get-AdfsProperties).CertificateSharingContainer, grant the AD FS service account WriteOwner and WriteDacl as KB5121391 describes, then restart the service.
4. Save the previous SDDL from the 510 events tied to event 1135 before the log rolls over. Do not set RemediateDkmAcl to 0 unless something truly depends on the old permissions.
5. If the old ACL granted read access to principals you did not expect, treat the token-signing and token-decryption keys as exposed and plan a certificate rollover.
6. Longer term, follow the decommission guide to move authentication to Microsoft Entra ID.

How to tell if you were hit#

Microsoft has published no indicators of compromise or exploitation details as of Oct 21, 2026. Start with the new events. A 1132 warning means the DKM container was more open than intended. The SDDL in the correlated 510 entries shows which accounts or groups could read it, so ask whether any of them were accounts an attacker could have controlled. On the AD FS servers, review Security event 4732 (member added to a security-enabled local group) and any new services or scheduled tasks since July. If you find signs of compromise, roll the token-signing and token-decryption certificates and reset the AD FS service account credentials. Then review recent sign-ins at your federated applications.

Timeline#

• Jul 14, 2026 — Microsoft releases the fix in July Patch Tuesday, marked as exploited, and publishes KB5121391 with detection and opt-in remediation. CISA adds CVE-2026-56155 to KEV.
• Jul 28, 2026 — CISA's remediation deadline for federal agencies.
• Oct 13, 2026 — Windows updates begin remediating insecure DKM ACLs by default, and Microsoft rewrites KB5121391. This is also the final ESU date for Server 2012 and 2012 R2 given in KB5099444.

Vulnerability records

• CVE-2026-56155 · KEV 2026-07-14 · Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft Support — KB5121391: CVE-2026-56155 AD FS Distributed Key Manager container ACL hardening support.microsoft.com
3. CVE record — CVE-2026-56155 cve.org
4. NVD — CVE-2026-56155 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-56155 cisa.gov
6. Microsoft — July 2026 security updates (CVRF release data, acknowledgments) api.msrc.microsoft.com
7. Microsoft Support — July 14, 2026 KB5099444 (Monthly Rollup, Windows Server 2012 R2 ESU) support.microsoft.com
8. Microsoft Learn — Active Directory Federation Services (AD FS) decommission guide learn.microsoft.com
9. Zero Day Initiative — The July 2026 Security Update Review zerodayinitiative.com