Microsoft’s July 2026 Patch Tuesday was the largest on record — north of 560 CVEs in a single release, with three zero-days, two of them already exploited in the wild (Tenable’s breakdown, BleepingComputer). In a pile that big it is easy to fixate on the “Critical” label and miss the one that actually matters. This week that one is CVE-2026-56155 — an Active Directory Federation Services elevation-of-privilege bug that Microsoft’s own responders caught being used in live attacks.
What CVE-2026-56155 is
It is an elevation-of-privilege vulnerability in AD FS, caused by insufficient granularity of access control. In plain terms: a low-privileged local attacker can elevate to administrator, with no user interaction and low attack complexity. Microsoft rates it CVSS 7.8 and labels it “Important.” (Cisco Talos and Rapid7 both flag it in their July analysis.)
The detail that should move it up your list: it was exploited in the wild as a zero-day, and it is credited to Microsoft’s Detection and Response Team (DART) — meaning Microsoft found it while investigating real intrusions, not in a lab. When the finder is an incident-response team, the bug already has a body count.
Why “Important, 7.8” undersells it
CVSS scores the mechanics of a vulnerability, not whether it is being used against you today. A 7.8 elevation-of-privilege bug that needs local access looks unremarkable next to a 9.8 remote-code-execution headline. Three things flip that reading here:
- It is already exploited. There is no “will attackers bother?” question left to weigh — they have.
- The target is an identity server. Local-to-admin on an AD FS box is not one endpoint falling over; it is the trust fabric that federates your logins. From there an attacker is close to token-signing keys and the single sign-on relationships that hang off them.
- It chains. Elevation-of-privilege bugs are the second half of an intrusion. Something gets a foothold as a low-privileged user; this turns that foothold into administrative control of a high-value server.
Who is exposed
Anyone still running on-premises AD FS for federation or single sign-on. Plenty of organisations do, often as a legacy component nobody has had time to retire. If that is you, treat this as an identity-infrastructure incident-in-waiting rather than a routine patch line item. If an attacker owns your AD FS servers, they are positioned to abuse the federation trust that your cloud applications rely on — the blast radius reaches well beyond the box itself, into every service that trusts those tokens.
What to do now
- Patch your AD FS servers with the July 2026 update immediately. This is an emergency-change candidate, not next-cycle work. It is one of two bugs this month already being exploited.
- Confirm the fix landed. Check the build and version on every AD FS server — do not assume the update applied cleanly across the whole farm.
- Hunt for prior abuse. Because it was exploited before the patch existed, assume the possibility of pre-patch compromise. Review AD FS administrative activity, unexpected local privilege escalation, and any anomalous access to signing certificates, and follow the major vendors’ detection guidance (CrowdStrike, Malwarebytes).
- Tighten the box itself. AD FS servers are Tier 0. Remove standing local admin, restrict who can log on interactively, and keep the local privilege footprint as small as the role allows — the vulnerability needs a low-privileged local presence to start with.
- Revisit the AD FS exit. Microsoft has been steering organisations off AD FS toward Entra-based authentication for years. If that migration keeps slipping down the backlog, an actively-exploited privilege-escalation bug in the component is the business case to move it back up.
The wider lesson
You cannot patch 560 CVEs at once, so triage has to be smarter than “sort by severity.” The signal that matters most is not the CVSS number or the “Critical” tag — it is exploited in the wild. CVE-2026-56155 is a mid-scored, “Important” bug that belongs at the very top of this month’s queue precisely because attackers were already using it when the patch shipped. Track CISA’s Known Exploited Vulnerabilities catalogue and Microsoft’s exploitability notes, and let real-world exploitation — not the headline number — decide what you fix first.
