Executive Threat Intelligence: The Critical Pivot from On-Premises to Azure Cloud

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog following active in-the-wild exploitation campaigns targeting hybrid enterprise identity environments. The vulnerability, rated CVSS 9.8 by NIST and Microsoft MSRC, represents an insufficient granularity of access control flaw in Microsoft Active Directory Federation Services (ADFS) that enables authenticated attackers with low-level corporate domain accounts to forge arbitrary SAML token claims.

ADFS serves as the authoritative single sign-on (SSO) and federation bridge connecting on-premises Active Directory forests with Microsoft Azure (Microsoft Entra ID), Microsoft 365, AWS IAM Identity Center, and thousands of third-party enterprise SaaS applications. By manipulating the claims issuance pipeline, threat actors can bypass Conditional Access and Multi-Factor Authentication (MFA) policies entirely, assuming administrative roles in cloud tenancies.

Vulnerability Mechanics & SAML Claim Manipulation (CWE-285)

The defect exists in how the ADFS Claim Processing Engine parses and canonicalizes custom incoming claim transformation rules during the generation of WS-Federation and SAML 2.0 security tokens:

In standard hybrid trust relationships, the ADFS server acts as the Identity Provider (IdP), issuing signed SAML assertions containing user claims (such as http://schemas.microsoft.com/ws/2008/06/identity/claims/role and ImmutableID). A logic flaw in the ADFS token issuance pipeline allows an attacker who submits a specially crafted request through the federation endpoint (/adfs/ls/) to inject secondary authorization claims into the token generation pipeline without triggering schema validation: 

<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_4a71..." Version="2.0">
  <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_8f92...">
    <saml:Subject>
      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">regular.user@enterprise.com</saml:NameID>
    </saml:Subject>
    <saml:AttributeStatement>
      <!-- Injected Malicious Claim via CVE-2026-56155 -->
      <saml:Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/role">
        <saml:AttributeValue>Company Administrator</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
        <saml:AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>
  </saml:Assertion>
</samlp:Response>

Because the forged assertion is signed by the legitimate ADFS farm token-signing certificate, Relying Party Trusts (such as Microsoft Entra ID) accept the token as completely valid. The recipient cloud service reads the injected Company Administrator claim and multipleauthn method reference, granting the attacker instant Global Administrator access in Microsoft 365 and Azure subscriptions without ever prompting for an MFA push or hardware security key.

Threat Actor Methodology & Stealth Persistence

Incident responders analyzing enterprise intrusions have documented a systematic attack path utilized by nation-state actors:

  • Initial Beachhead: Threat actors compromise an unprivileged corporate workstation or endpoint via spear-phishing or initial access broker credential markets.
  • Federation Discovery: The adversary queries Active Directory LDAP objects for the Service Principal Name (SPN) http/adfs.domain.com to locate primary federation farm nodes.
  • SAML Forgery & Cloud Elevation: Utilizing CVE-2026-56155, the attacker mints forged federation tokens elevating their unprivileged user identity directly to Azure AD / Entra ID Global Administrator.
  • Persistence via Service Principals: Inside Azure, the adversary registers rogue OAuth applications with RoleManagement.ReadWrite.Directory and Application.ReadWrite.All permissions, allowing persistent API access that survives password resets.

Affected Windows Server Releases & Security Updates

All Windows Server systems operating the Active Directory Federation Services role must install the following cumulative security updates:

Operating System Platform ADFS Server Role Remediation Knowledge Base (KB) Severity
Windows Server 2016 ADFS 4.0 Farm KB5043063 (Cumulative Update) Critical (CVSS 9.8)
Windows Server 2019 ADFS 2019 Farm KB5043065 (Cumulative Update) Critical (CVSS 9.8)
Windows Server 2022 ADFS 2022 Farm KB5043068 (Cumulative Update) Critical (CVSS 9.8)
Windows Server 2025 ADFS 2025 Farm KB5043072 (Cumulative Update) Critical (CVSS 9.8)

Defensive Playbook & Incident Response Checklist

Organizations operating hybrid cloud identity architecture should execute the following response actions:

1. Patch Installation & Verification

Install the cumulative security patch across all primary and secondary ADFS farm nodes, followed by the Web Application Proxy (WAP) perimeter servers: 

# Query hotfix status via PowerShell
Get-HotFix -Id KB5043068, KB5043065, KB5043063

# Verify ADFS subsystem service state
Get-Service adfssrv | Select-Object Name, Status, StartType

2. Audit Relying Party Trust Claim Issuance Rules

Inspect all configured Relying Party Trusts in the ADFS farm to detect unauthorized claim transformation rules or unexpected pass-through permissions: 

# Export all Claim Rules for the Microsoft Office 365 / Entra ID Trust
(Get-AdfsRelyingPartyTrust -Name "Microsoft Office 365 Identity Platform").IssuanceTransformRules | Out-File C:ADFS_ClaimRules_Audit.txt

# Search for suspicious role issuance injections
Select-String -Path C:ADFS_ClaimRules_Audit.txt -Pattern "Company Administrator", "Directory Role"

3. Rotate Token-Signing Certificates & Review Entra ID Sign-In Logs

If exploitation or unauthorized administrative elevation is suspected, immediately initiate an emergency rotation of the ADFS token-signing certificates and synchronize new federated metadata with Microsoft Entra ID: 

# Force immediate generation of new token signing certificate
Update-AdfsCertificate -CertificateType Token-Signing -Urgent

# Synchronize updated metadata with Microsoft Entra ID via AzureAD / Microsoft.Graph PowerShell
Update-MgDomainFederationConfiguration -DomainId enterprise.com