Question 1

What is CVE-2026-56155 — Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ?

Accepted Answer

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.

Question 2

What is the authoritative source for CVE-2026-56155?

Accepted Answer

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability  (CVE-2026-56155) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVSS	7.8 ()
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS	0.35% probability of exploitation · percentile 25.9% · 2026-10-05T12:00:23Z
Last modified	2026-07-15

CVE-2026-56155Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Description

Scoring

CISA KEV entry