AD FS zero-day CVE-2026-56155: Microsoft DART finds DKM ACL bug already exploited

Microsoft's July 14, 2026 Patch Tuesday shipped a fix for CVE-2026-56155, an elevation-of-privilege vulnerability in Active Directory Federation Services discovered by Microsoft's own Detection and Response Team (DART) during a live intrusion. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, with an FCEB remediation deadline of July 28, 2026. Primary vendor reference: Microsoft's KB 5121391 — AD FS Distributed Key Manager container ACL hardening, backed by the MSRC advisory for CVE-2026-56155.

What the bug is

CVSS 3.1 base score 7.8. CWE classification CWE-1220 — insufficient granularity of access control. The AD FS Distributed Key Manager (DKM) container in Active Directory stores the symmetric keys that protect token-signing and token-encryption certificate private keys. Per Microsoft's own summary in KB 5121391:

If the container's ACL is overly permissive, an attacker with read access to the DKM key material can decrypt the token-signing private keys.

Attack vector is local, complexity low, privileges low, no user interaction. A low-privileged principal that already holds a foothold on any domain-joined asset with read access to the DKM container can lift itself to a position from which it forges SAML/OpenID Connect tokens signed by the very key AD FS uses to prove identity to every relying party — SaaS SSO, ADFS-backed VPN, in-house apps, everything.

Affected products

KB 5121391 lists:

• Windows Server 2012 (ESU)
• Windows Server 2012 R2 (ESU)
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 23H2
• Windows Server 2025

Only servers hosting the AD FS role are in scope for the DKM ACL primitive. The fix ships as part of the standard July 14, 2026 cumulative for each Windows Server release; check MSRC's CVE-2026-56155 entry for the KB number that maps to each build.

Exploitation status

Confirmed in the wild. Microsoft credits DART — its incident-response arm, called in when an intrusion is already under way — with discovery. That framing is deliberate. DART attribution means Microsoft's responders encountered CVE-2026-56155 in the field before the vendor caught it in-house, not that a coordinated researcher walked in with a proof-of-concept. Neither MSRC nor CISA has named the intrusion set or published IOCs. Neither has published YARA or Sigma rules as of writing.

CISA's July 14 KEV addition sets the FCEB deadline at July 28, 2026 and, under BOD 26-04, carries a forensic-triage requirement: federal-civilian agencies must determine whether the asset was already compromised, not merely apply the patch. Secondary reporting at Cybersecurity News and Rapid7's Patch Tuesday roundup mirrors the exploitation and DART-discovery framing.

Action checklist

1. Install the July 14 cumulative on every AD FS server today. Patch mode does not remediate the ACL; it only starts audit mode. Read on before you assume the update alone closes the door.

2. Watch AD FS/Admin event log for Event ID 1132. Once installed, AD FS re-checks the DKM container ACL one minute after service start and every 24 hours thereafter. Event 1132 (Warning) means the ACL is still insecure; 1133 (Info) means healthy; 1134 (Error) means detection itself failed (typically LDAP connectivity).

3. Opt into remediation now — do not wait for October. On any single AD FS server in the farm, set the DWORD:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl = 1
   

   Restart the AD FS service to trigger remediation immediately, or wait ≤24h for the next detection cycle. Success logs as Event ID 1135 (with the previous ACL captured in SDDL); failure as 1136.

4. On Windows Server 2012 / 2012 R2, grant the AD FS service account the extra ACEs first — those platforms require the operator to grant WriteOwner and WriteDacl before RemediateDkmAcl=1 will succeed. Microsoft ships the PowerShell to do it in the KB; use it before enabling the registry key or the remediation will fail with Event 1136.

5. After remediation, save Event 1135's previous SDDL to disk. The event captures the old ACL in SDDL form so you can restore it if you hit a compatibility issue — but AD FS/Admin rolls over, and once that event is gone, so is the fallback.

6. Assume forensic triage is required, not optional. DART-discovery + KEV listing under BOD 26-04 means treat every reachable AD FS server as an incident-response subject: pull the token-signing certificate, review issued-token logs against SIEM for anomalous audiences, and plan a rotation of token-signing and token-encryption certificates — the DKM key that gates them is exactly the material an attacker with read access has already exfiltrated.

7. Do not opt out for convenience. Setting RemediateDkmAcl=0 disables remediation and leaves the container vulnerable indefinitely; per KB 5121391 the enforcement date after which remediation runs by default without the registry key is October 13, 2026. On Windows Server 2012 / 2012 R2 the auto-enforcement does not apply — those platforms remain a manual job.

Expected secure state after remediation

Per Microsoft, only the following principals should retain access to the DKM container after remediation, with inheritance disabled and every other explicit Allow ACE removed:

• Domain Admins — Generic All
• Enterprise Admins — Generic All
• SYSTEM — Generic All
• AD FS Service Account — Read, Write, Create Child, Write Owner, Delete Tree

If your DKM container currently grants read to Authenticated Users, Domain Users, or any custom group used for delegated admin, that is the misconfiguration CVE-2026-56155 turns into a full-federation compromise.

Context

This is the second AD FS DKM story in as many years — Microsoft's April 2024 Golden SAML mitigation guidance hardened the token-signing certificate lifecycle after Solorigate attackers used DKM access to forge SAML tokens against Microsoft 365 tenants. CVE-2026-56155 is that same primitive re-emerging as a currently-exploited weakness in the ACL layer, not the crypto.

Two other CVEs in the same July 14 batch also landed in KEV: CVE-2026-56164 in on-premises SharePoint and the two SonicWall SMA 1000 zero-days (covered in our July 15 post). The AD FS bug is the quietest of the four — CVSS 7.8, local vector, no press headline — and the most consequential, because a stolen token-signing certificate does not stop at the network edge. It travels wherever the tenant's SSO does.