Loading story…
CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog after reports of active exploitation against Microsoft Active Directory Federation Services (AD FS). The flaw is an elevation-of-privilege vulnerability caused by insufficient granularity of access control, mapped to CWE-1220, and allows an authorized attacker to elevate privileges locally on affected systems.
Microsoft rated the issue High with a CVSS v3.1 score of 7.8 and said it affects multiple supported Windows and Windows Server versions running AD FS, with patched builds available. CISA said ransomware use is unknown, directed organizations to apply Microsoft’s mitigations and follow associated forensic triage guidance, and set a 2026-07-28 remediation deadline for federal agencies under BOD 26-04.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-56155 to its Known Exploited Vulnerabilities catalog, indicating the Microsoft AD FS flaw has been exploited in the wild. CISA directed organizations to apply vendor mitigations and set a remediation due date of 2026-07-28.
A new CVE record was published for CVE-2026-56155, an elevation-of-privilege vulnerability in Microsoft Active Directory Federation Services caused by insufficient granularity of access control. The record states patched Microsoft builds are available and rates the issue High severity with CVSS 7.8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2024-43468** to its Known Exploited Vulnerabilities (KEV) catalog after determining the flaw is being **actively exploited in the wild**. The vulnerability is a **critical (CVSS 9.8) SQL injection** in *Microsoft Configuration Manager* (ConfigMgr/SCCM) that can allow an **unauthenticated remote attacker** to achieve **remote code execution** by sending specially crafted requests, enabling command execution on the ConfigMgr server and/or its underlying site database with **high/`SYSTEM`-level impact**. CISA set a remediation deadline of **March 5** for U.S. Federal Civilian Executive Branch agencies under its Binding Operational Directive requirements; public reporting noted Microsoft’s advisory had previously assessed exploitation as “less likely,” and Microsoft had not (as of reporting) publicly detailed the threat actors or scope of exploitation. The issue was originally patched by Microsoft in **October 2024** after being reported by **Synacktiv**, and proof-of-concept exploit code was later published (including by Synacktiv), lowering the barrier to weaponization. Separate CISA KEV updates the same week also drove patching urgency across other widely deployed products (including **SolarWinds Web Help Desk** and multiple **Apple** platforms for a reportedly “extremely sophisticated” targeted attack), reinforcing that organizations should treat KEV additions as a high-confidence signal to accelerate patching and exposure reduction—particularly for internet-reachable management tooling like ConfigMgr that can provide broad administrative control if compromised.
Jun 29, 2026
CISA added **`CVE-2026-45659`** to its Known Exploited Vulnerabilities catalog after confirming active attacks against Microsoft SharePoint Server. The high-severity flaw is a **deserialization of untrusted data** issue that lets an authenticated attacker with only **Site Member** permissions execute arbitrary code on vulnerable, internet-exposed servers, with no user interaction required and low attack complexity. Microsoft said the bug is easy to exploit with repeatable success and released fixes in late May after the CVE was initially omitted from its May 2026 security updates. The vulnerability affects **SharePoint Server Subscription Edition**, **SharePoint Server 2019**, **SharePoint Server 2016**, and **SharePoint Enterprise Server 2016**. CISA ordered Federal Civilian Executive Branch agencies to remediate the issue within days under **BOD 26-04**, while internet scanning data cited by Shadowserver shows more than **10,000** SharePoint servers remain exposed online. Separately, Microsoft disclosed a ransomware investigation involving **Storm-2603** and another threat actor operating in the same compromised environment, where the attackers used persistence, remote access tools, privilege escalation, and defense evasion after initial access was likely obtained through **`CVE-2025-11371`** in Gladinet Triofox.
Jul 12, 2026
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026