CISA KEV: CVE-2026-56155 — Microsoft Active Directory Federation Services actively exploited

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability . Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics T