AD FS CVE-2026-56155 Forges Federation Tokens. Identity Is Not the Data Boundary.
CISA added CVE-2026-56155 to the Known Exploited Vulnerabilities catalog on July 14, 2026, with a Federal Civilian Executive Branch remediation deadline of July 28, 2026. The vulnerability lives in Active Directory Federation Services (AD FS), the Microsoft service that issues and signs the authentication tokens every federated application trusts. Microsoft disclosed it in the July 2026 Patch Tuesday release as a zero-day, exploited in the wild before a patch existed. The CVSS v3.1 base score is 7.8. The classification is CWE-1220, insufficient granularity of access control.
The score understates the reach. CWE-1220 sounds like a permissions housekeeping issue. In AD FS it is not. The flaw sits in the access control applied to the Distributed Key Management (DKM) container, the Active Directory object that holds the key material AD FS uses to sign tokens. An authenticated local attacker with low privileges reaches administrator on the AD FS host, and administrator on an AD FS host is not the end of the attack. It is the beginning of a different one. The signing keys are the prize, and the prize replays.
What the vulnerability actually grants
Patch the host and the escalation path closes. The architectural question the disclosure raises is what an attacker holds the moment escalation succeeds, and whether the answer should be different the next time a federation server ships a vulnerable release.
AD FS is a security token service. When a user authenticates, AD FS issues a signed assertion, and every relying party configured to trust that AD FS instance accepts the assertion as proof of identity. The trust is cryptographic. The relying party validates the signature against the AD FS token-signing certificate and asks no further questions. That design is the point of federation. One authentication event produces a token that unlocks a portfolio of applications without re-prompting the user.
CVE-2026-56155 gives an attacker the private material behind that signature. Reaching the DKM container means reaching the token-signing keys. With those keys, the attacker mints assertions for any user, at any privilege, for any relying party in the federation. No credential is required for the impersonated account. No second factor is prompted, because the forged token already asserts that authentication happened. The attacker does not break into an application. The attacker becomes whichever principal the application trusts most.
The exposure is not confined to a legacy edge. Microsoft lists affected AD FS deployments across Windows Server 2016, 2019, 2022, version 23H2, and 2025, along with 2012 and 2012 R2 under Extended Security Updates. AD FS remains the federation broker in front of production application portfolios across those estates, which is what turns a local privilege escalation into a federation-wide identity compromise.
This is the mechanism security researchers named Golden SAML after the SolarWinds intrusion, and the same mechanism at the center of the Storm-0558 token-forgery activity against cloud identity in 2023. The vector changes. The pivot does not. Compromise the entity that signs identity, and every downstream system inherits the compromise while its own logs record nothing but valid, well-formed, correctly signed access.
The federation token carries trust, not control
A federation token answers one question: who is this. It does not answer the questions that decide whether a specific data object should open. A forged token asserts an identity, and identity is exactly the attribute that a token-forgery attack fabricates for free. Any control that consumes the token as sufficient proof inherits the forgery.
Most enterprise architectures consume it as sufficient proof. The pattern is consistent. Authenticate at the identity provider, receive a token, present the token at the application, and the application grants access to the data behind it. The authorization decision collapses into the authentication event. Once the token validates, the data is reachable. The storage layer, the file share, the database, and the object store all treat a validated session as an authorized one. They were never built to distinguish a real assertion from a forged one, because both arrive carrying the same valid signature.
That collapse is the exposure. The mid-year 2026 breach pattern traced the same shape across the year: the identity layer holds, the attacker forges or steals a token, and the data layer offers no independent resistance because it delegated its access decision to the identity plane. CVE-2026-56155 is that pattern delivered as a single CVE. It does not steal one user's token. It manufactures the ability to be anyone.
NIST already documented this exact attack
The federal identity community did not wait for this CVE to name the problem. In December 2025, NIST and CISA released the initial draft of NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse. The report's motivating scenario is the one CVE-2026-56155 now operationalizes: adversaries generated forged SAML assertions to bypass multifactor authentication by compromising administrator accounts with privileged access to Active Directory Federation Services and exposing the signing certificates.
NIST IR 8587 makes a structural recommendation that matters here. Tokens and assertions must carry explicit audience fields, and access control mechanisms must reject tokens with incorrect or missing audience restrictions. Audience binding narrows the blast radius of a forged token by scoping it to a named relying party rather than the whole federation. It is necessary work, and federal agencies should do it. It is also enforcement inside the token system, which is the same system CVE-2026-56155 compromises. An attacker holding the signing keys can populate a correct audience field as easily as a correct subject. Hardening the assertion raises the cost of the forgery. It does not change what a valid forged assertion reaches once it clears the identity plane.
The same limit applies to the token-lifetime and delegation controls agencies reach for after an incident. Shortening token validity, requiring proof-of-possession binding, and constraining credential delegation chains all reduce the window and the reach of a stolen or forged assertion. Each is enforcement the identity provider performs on tokens it issues. When the signing keys themselves are the compromised asset, the issuer is minting the tokens that these controls are asked to trust. The controls are worth deploying. They are not the last line, because they run on the same plane as the breach.
The durable answer sits one layer down, at the data object, where the decision to release plaintext is made independently of whether the caller carries a well-formed identity token.
Where a forged token stops
Data-centric zero trust moves the access decision off the identity plane and binds it to the object. Lattix Technologies wraps each data object under a cryptographic envelope, and the key that unwraps it is released only after a policy decision, not after a session validates. A forged federation token can open a session. It does not open the object, because the object requires a separate evaluation the token cannot satisfy on its own.
The evaluation runs through a policy decision point (PDP) and a policy enforcement point (PEP). Every decrypt request is measured against attribute-based access control (ABAC) rules that consider more than the asserted identity: device posture, network origin, geolocation, purpose, and real-time risk signals. Identity is one attribute among several, and it is the attribute a forgery controls. The others are not asserted by the token. The PDP issues a short-lived signed decision, the PEP validates it before any key material is released, and the default is fail-closed. Absent an affirmative, current policy decision, the object stays encrypted.
That model changes what the AD FS compromise yields. A forged token still authenticates. It still opens applications that trust it. When the caller reaches a Lattix-protected object, the forged identity is evaluated against a policy that expects a specific device, a specific origin, a specific purpose, and a risk score consistent with legitimate access. The forged session rarely matches all of them, and the release is denied on the attributes the attacker never held. When the Zero Trust Data Format (ZTDF) carries the policy with the object, the enforcement travels with the data across every relying party, so a token that unlocks one application does not silently unlock the data that flows out of it.
Revocation behaves the same way. When the token-signing keys are known to be compromised, an administrator revokes access to already-distributed objects by invalidating the policy, and the next decrypt attempt fails evaluation. Traditional session trust has no equivalent. Once the token is forged and the session is live, the data behind it is reachable until the session ends. Object-level enforcement withdraws access at the next request rather than the next login.
The audit trail closes the loop. Content-addressed storage with Merkle-tree lineage tracking (CAS-X) records every access decision against every object as tamper-evident provenance. During a token-forgery incident, that record is the difference between knowing which objects a forged principal actually reached and assuming the entire federation is exposed. The identity logs show valid signatures. The object logs show which policies evaluated, which passed, and which failed closed.
What this means for federal identity architecture
CVE-2026-56155 is not an argument against federation. Federation is how large enterprises and agencies make single-authentication access workable, and AD FS will remain in production across Windows Server estates through the extended-support window and beyond. The argument is against terminating the trust chain at the token. NIST SP 800-207 places continuous, per-request authorization at the center of zero trust, and its data pillar is explicit that access to data should be evaluated at each request rather than granted once at the session boundary. NIST SP 800-63C sets the assurance requirements for federation and assertions that IR 8587 now extends. The CISA Zero Trust Maturity Model separates transport-level protection from object-level enforcement in its data pillar for the same reason this CVE exposes: a validated session is not an authorized access.
Agencies patching CVE-2026-56155 before the July 28 deadline are doing necessary work. Rotating the AD FS token-signing keys after a suspected DKM exposure is necessary work. Adding audience restrictions per IR 8587 is necessary work. None of it answers the question the CVE forces: when the entity that signs identity is compromised, what still refuses the forged caller. The answer is enforcement that does not consume the identity token as sufficient proof, evaluated at the object, defaulting to closed.
Lattix maps this posture to NIST SP 800-207, the CISA Zero Trust Maturity Model data pillar, and the token-protection direction in NIST IR 8587, and it enforces it without re-architecting the identity fabric. The platform operates as a data protection layer above storage, wrapping objects at ingest and evaluating policy at every decrypt. Federation keeps issuing tokens. The data stops trusting them on their own.
A forged federation token should reach exactly as far as the attributes behind it, and no further. On July 28, agencies will have closed the escalation path in AD FS. The exposure the CVE illustrated will still be waiting the next time an identity provider ships a vulnerable release. The layer that answers it is the data layer.