Cyber Resilience

CVE-2026-56155

Microsoft Windows 10 1607 ≤ 10.0.14393.9339

CISA KEVActive ExploitationEUVD Exploited
Published
14 July 2026
Modified
15 July 2026
KEV Added
14 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.023 82th percentile
Risk Priority 78 floored blend · peak EPSS

Summary

CVE-2026-56155 is a high-severity Insufficient Granularity of Access Control (CWE-1220) vulnerability in Microsoft Windows 10 1607. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 18% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

CWE(s)
CWE-1220
KEV Date Added
14 July 2026

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Direct local privilege escalation via insufficient access control granularity in AD FS.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Local privilege escalation via insufficient access control granularity in AD FS directly matches exploitation for privilege escalation.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-50405Same product: Microsoft Windows 10 1607
CVE-2026-33825Same vendor: Microsoftboth on KEV
CVE-2026-50502Same product: Microsoft Windows 10 1607
CVE-2026-49170Same product: Microsoft Windows 10 1809
CVE-2026-48581Same vendor: Microsoft
CVE-2026-55006Same vendor: Microsoft
CVE-2021-42287Same product: Microsoft Windows Server 2012both on KEV
CVE-2026-35436Same vendor: Microsoft
CVE-2024-43451Same product: Microsoft Windows 10 1607both on KEV
CVE-2024-49138Same product: Microsoft Windows 10 1607both on KEV

Affected Assets

microsoft
windows 10 1607
≤ 10.0.14393.9339 · ≤ 10.0.14393.9339
microsoft
windows 10 1809
≤ 10.0.17763.9020 · ≤ 10.0.17763.9020
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.9339
microsoft
windows server 2019
≤ 10.0.17763.9020
microsoft
windows server 2022
≤ 10.0.20348.5386
microsoft
windows server 2025
≤ 10.0.26100.33158

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-16 Security and Privacy Attributes
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V16.4.2
  • V8.4.2
  • V11.7.1
  • V13.2.4

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces granular access decisions in AD FS; the CVE is a failure of this enforcement allowing unauthorized elevation.

AC-6 Least Privilege good match
prevent

Requires assignment and enforcement of the minimum privileges needed, directly countering the insufficient granularity that permits local elevation.

AC-16 Security and Privacy Attributes partial match
prevent

Uses security attributes to achieve finer-grained access control decisions, mitigating the root weakness in AD FS privilege checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-01 mostly match
prevents

PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.

PR.PS-06 partial match
prevents

PR.PS-06's general SDLC practices can surface granularity issues during design/review (partial prevention) but do not specifically target access-control policy breadth, so they remove only part of CWE-1220's risk.

DE.AE-06 none match
is degraded by

CWE-1220 permits unauthorized access to sensitive assets but neither prevents nor impairs the delivery of adverse-event information to authorized recipients.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.3 Information access restriction mostly match
degrades

Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.

A.5.15 Access control partial match
prevents

Establishes the overarching access-control policy whose granularity directly determines whether the weakness exists.

A.5.18 Access rights partial match
prevents

Defines the assignment and review of access rights; insufficient granularity in those rights is the root of CWE-1220.

A.8.2 Privileged access rights partial match
prevents

Specifies management of privileged access rights, where overly broad privileges are a common manifestation of the weakness.

A.8.18 Use of privileged utility programs none match
none

Limits use of privileged utilities; overly coarse access rules can still allow unauthorized utility access.

References