CVE-2026-56155

Think of ADFS like the “passport officer” that helps authenticate users for your business apps. This flaw lets someone who already has limited access on the machine use weak permission checks to become much more powerful than they should be. Since it’s been observed being exploited in the wild, a successful attacker could take over the server and disrupt your sign-in environment.

This matters if your business runs Active Directory Federation Services (ADFS) on the specified Windows versions (Windows 10 and several Windows Server releases). If an attacker can get a local foothold with low-level permissions on that machine, the weakness can be used to raise privileges. Treat it as a real risk when ADFS is in use and the attacker can reach the target host locally with sufficient access; remote reachability in a default configuration is not yet known from the provided findings.

RED: attackers are already exploiting this flaw in the wild, and it is listed in CISA’s KEV with a near-term remediation deadline. Because the weakness is about local privilege escalation and has confirmed real-world activity, delays directly increase the odds of compromise on systems running ADFS.