CVE-2026-56155: The Actively Exploited AD FS Flaw That Hands Over Your Identity Keys
On July 28, 2026, the federal deadline passed to remediate CVE-2026-56155 — an actively exploited vulnerability in Microsoft’s Active Directory Federation Services (AD FS) that CISA added to its Known Exploited Vulnerabilities (KEV) catalog on July 14. The flaw is not remarkable for its CVSS score, a middling 7.8. It is remarkable for what it exposes: the private cryptographic keys that AD FS uses to sign and encrypt the tokens organizations rely on to prove who their users are. An attacker who reaches those keys doesn’t need to steal passwords or defeat multi-factor authentication. They can mint trusted identities at will.
What the flaw is
AD FS is the component many enterprises use to federate identity — to let employees sign in once and reach applications, including cloud services, using tokens AD FS issues on their behalf. The security of that entire arrangement rests on a set of private token-signing...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
