Actively exploited privilege escalation in AD FS

Microsoft addresses an elevation-of-privilege vulnerability in Active Directory Federation Services with the Windows security updates released on July 14, 2026. CVE-2026-56155 concerns overly broad permissions on the Distributed Key Manager (DKM) container in Active Directory. AD FS stores key material there to protect the private token-signing and token-encryption keys.

An authorized attacker with local access can use the faulty permission structure to gain administrator privileges. Microsoft rates the vulnerability at CVSS 7.8 and confirms active exploitation. Patch status alone is therefore not enough: existing DKM ACLs must be checked and hardened when they differ from the secure baseline.

What the July update exposes

After installation, the DKM ACL check runs about one minute after the AD FS service starts and every 24 hours thereafter. The relevant log is AD FS/Admin:

  • Event 1132 warns that the DKM ACL differs from the secure baseline.
  • Event 1133 confirms that the ACL is healthy.
  • Event 1134 reports a detection error, such as an LDAP connectivity problem.

The July release operates in audit mode and does not change the ACL automatically. The absence of Event 1132 is meaningful only when Event 1133 is present and no Event 1134 errors remain unresolved.

Controlled hardening for the farm

  1. Update every AD FS node and record patch and restart status for each farm.
  2. Collect Events 1132 through 1134 centrally and map the reported container DN to the correct farm.
  3. Resolve unexpected ACEs: service accounts, backup software, and historic delegations need a named owner.
  4. Test remediation on Windows Server 2016 and later: set HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl as a DWORD to 1, schedule a controlled service restart, and verify Event 1135. Preserve the previous SDDL included in that event immediately. Event 1136 indicates failed remediation.
  5. Test token issuance and trusts before carrying the change to additional farms.

Windows Server 2012 and 2012 R2 require additional permissions for the AD FS service account before remediation and remain a separate manual path later in the rollout.

Prepare for October enforcement

Starting with the October 2026 updates, remediation becomes the default on Windows Server 2016 and later. The secure baseline disables inheritance and removes unapproved Allow ACEs; only Domain Admins, Enterprise Admins, SYSTEM, and the AD FS service account retain the required access. Untested custom permissions can then cause service disruption.

The immediate check: install the July updates on every AD FS server, review Events 1132 through 1134, and remediate identified DKM ACL deviations in a controlled change now.