CVE-2026-56155

high

Description

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

From the Tenable Blog

July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs

July 2026 Patch Tuesday: Largest Patch Tuesday 569 CVEs

Published: 2026-07-14

Microsoft patched 569 CVEs in July 2026, the largest Patch Tuesday release in its history. 56 critical CVEs patched including three zero-day vulnerabilities.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56155

https://www.infosecurity-magazine.com/news/microsoft-570-cves-patch-tuesday/

https://therecord.media/microsoft-vulnerabilities-patch-tuesday-release

https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html

https://securityaffairs.com/195383/security/u-s-cisa-adds-sonicwall-and-microsoft-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://hackread.com/microsoft-july-2026-patch-tuesday-fixes-zero-days/

https://www.theregister.com/security/2026/07/14/patchpocalypse-now-microsoft-tops-last-months-record-with-622-patch-tuesday-cves/5271434

https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/

https://www.darkreading.com/vulnerabilities-threats/records-broken-patch-tuesday-raises-triage-stakes

https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog

https://thehackernews.com/2026/07/microsoft-patches-record-622-flaws.html

https://securityaffairs.com/195347/security/patch-tuesday-security-updates-for-july-2026-the-largest-update-ever-621-cves-in-one-month.html

https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/

https://cyberscoop.com/microsoft-patch-tuesday-july-2026/

https://www.tenable.com/blog/microsofts-july-2026-patch-tuesday-addresses-569-cves-cve-2026-56155-cve-2026-56164

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-56155

Details

Source: Mitre, NVD

Published: 2026-07-14

Updated: 2026-07-15

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00379