Microsoft Active Directory FS Privilege Escalation Flaw Exploited in Active Attacks

Microsoft disclosed CVE-2026-56155, an actively exploited AD FS elevation-of-privilege vulnerability caused by insufficient DKM ACL granularity; exploitation yields administrator-level access and enables token forgery and lateral movement across federated environments. Microsoft released an audit mode to detect insecure DKM ACLs, an optional immediate remediation registry key, and will auto-remediate unconfigured systems after October 13, 2026.