CVE-2026-56155

CVE-2026-56155 is a local privilege escalation in AD FS with a CVSS 7.8 that undersells the actual risk. The 'authorized attacker' qualifier implies a high bar, but in practice it describes the standard post-compromise state: an attacker with local admin on any domain-joined workstation is one lateral movement away from AD FS service accounts. That path is the vulnerability's real significance. The 'insufficient granularity of access control' descriptor points to a structural flaw, not a misconfiguration you can audit away. AD FS was designed with implicit trust assumptions between service accounts and the broader privilege hierarchy that don't hold under real attacker behavior. This is a recurring pattern in Microsoft's identity stack—the third or fourth iteration of similar privilege boundary crossings in recent years. What matters is the blast radius, not the CVSS vector. AD FS compromise doesn't stop at the server—it grants token-generation capability across every SAML and OAuth relying party in your federation. We're talking enterprise-wide impersonation that survives password rotation because it operates on signing key material organizations frequently fail to rotate during incident recovery. The low EPSS score (0.02333) paired with the KEV listing is characteristic of surgical targeting rather than mass exploitation—automated scanning doesn't reach this because the prerequisite makes it unprofitable. The takeaway: treat AD FS as a Tier-1 pivot point regardless of endpoint control maturity. Strong endpoint security actually correlates with attackers pursuing identity infrastructure escalation precisely because it means they've already cleared the initial barrier. Patch it with urgency commensurate with what successful exploitation actually delivers—which is the keys to your entire identity kingdom, not a local privilege bump.

Reviewed through automated stages and approved by a human before publication.