SMBs: High-Risk ADFS Vulnerability Being Exploited Now

A newly exploited vulnerability in Microsoft Active Directory Federation Services (ADFS) poses a serious threat to SMBs. Here's what you need to know and do this week.

The short version

CVE-2026-56155 is a high-risk ADFS access control flaw being actively exploited.
SMBs using ADFS for identity management are at risk.
Patch now and check if you're affected.
Follow CISA guidance and monitor for suspicious activity.

What is CVE-2026-56155 and why should SMBs care?

CVE-2026-56155 is a vulnerability in Microsoft Active Directory Federation Services (ADFS). ADFS is a service that helps organizations manage user identities and access to internal and external resources. It's commonly used by businesses to allow employees to log in once and access multiple systems (single sign-on).

The flaw lies in how ADFS handles access control. Specifically, it doesn't properly enforce granular access rules, meaning attackers could potentially gain more access than they should have. This could allow them to impersonate users, access sensitive data, or even gain elevated privileges on your systems.

For SMBs, this is a big deal. If your business uses ADFS to manage access to cloud services, internal apps, or other critical systems, this vulnerability could be a backdoor for attackers. And since it's already being exploited in the wild, you can't afford to ignore it.

Is my SMB affected by this vulnerability?

If your business uses Microsoft ADFS as part of your identity and access management (IAM) setup, then yes — you are at risk. This includes businesses that use ADFS to connect on-premises Active Directory with cloud services like Microsoft 365 or third-party SaaS applications.

If you're unsure whether you're using ADFS, check with your IT team or service provider. ADFS is often used behind the scenes in identity management systems and may not be obvious to business owners.

CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, meaning it's a high priority to address now.

What should I do this week to protect my business?

First, apply the Microsoft patch for CVE-2026-56155 immediately. Microsoft has released an update to address the issue, so check your Windows Server and ADFS components for the latest security updates.

Second, review your ADFS configuration to ensure you're using the most secure settings. This includes limiting access to ADFS servers, using multi-factor authentication (MFA) where possible, and ensuring only trusted users have administrative access.

Third, monitor your logs for any unusual activity. Look for signs of unauthorized access, failed login attempts, or unexpected federated authentication requests. If you see anything suspicious, isolate the affected systems and investigate immediately.

Finally, follow CISA's guidance for mitigating the risk of known exploited vulnerabilities. This includes prioritizing patching and reviewing your security posture.

How can I tell if my SMB has already been hit?

If your business has already been hit by an exploit of CVE-2026-56155, you might see signs like unauthorized access to internal systems, unexpected federated authentication requests, or unusual login activity from unknown locations or devices.

Check your ADFS logs for any anomalies, such as logins from unfamiliar IP addresses, repeated failed authentication attempts, or users accessing resources they shouldn't have access to. If you find anything out of the ordinary, it's a red flag.

If you suspect a breach, isolate the affected systems immediately and contact a cybersecurity professional for help. Don't try to fix it on your own — attackers may still be in your network and could cause further damage.

What are the long-term steps to prevent similar issues?

Beyond patching, you should regularly review and update your identity and access management systems. This includes ADFS, as well as other tools you might use for authentication and authorization.

Implement a robust vulnerability management program to stay on top of new threats. This includes regular patching, configuration reviews, and continuous monitoring of your systems for signs of compromise.

Train your staff on security best practices, especially around access control and identity management. The more your team understands the risks, the better they'll be at spotting and responding to threats.

Not sure whether your environment is exposed? That is exactly what our Vulnerability Management service is built to surface. Talk to us.

Frequently asked questions

Do I need to patch if I don’t use ADFS?

If you’re not using Microsoft ADFS or any federated identity services that rely on it, you’re likely not affected. However, if you’re unsure, it’s best to check with your IT team or a cybersecurity professional to confirm.

Is there a timeline for when I must patch?

CISA has set a remediation deadline of July 28, 2026, for federal agencies, but SMBs should patch as soon as possible. Since the vulnerability is already being exploited, waiting increases your risk.

Can I just turn off ADFS instead of patching?

Disabling ADFS may not be a practical option if your business relies on it for identity management. Instead, apply the patch and secure your configuration to reduce risk.

What if I can’t patch immediately?

If you can’t patch right away, implement compensating controls such as network segmentation, MFA, and monitoring for suspicious activity. These can help reduce the risk while you work on a permanent fix.

How can I verify if I’ve been compromised?

Review your ADFS logs for unusual activity, such as unexpected login attempts or access from unfamiliar locations. If you find anything suspicious, isolate the affected systems and consult a cybersecurity expert immediately.

Is this vulnerability linked to ransomware?

As of the latest information, there is no confirmed evidence that this vulnerability is being used in ransomware attacks. However, it is being actively exploited in the wild, so it should be treated as a serious security risk.

Source (public domain): CISA