AD FS CVE-2026-56155: DKM ACL Audit and Remediation Checklist

The July 2026 Windows update for CVE-2026-56155 does not automatically harden every Active Directory Federation Services Distributed Key Manager ACL. It installs the new behavior in Audit Mode so administrators can identify affected permissions, test remediation, and opt in before automatic remediation begins.

Understand the rollout phases

Audit Mode identifies permissions that require remediation without changing them automatically. Administrators can set HKLM\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl as a DWORD with value 1 to opt in to remediation after testing. Microsoft’s automatic phase begins October 13, 2026 for Windows Server 2016 and later unless administrators use the documented control. Windows Server 2012 and 2012 R2 have additional prerequisite and support considerations.

Use the documented events

• Events 1132, 1133, and 1134 support audit and readiness review.
• Events 1135 and 1136 report remediation behavior.
• Collect the AD FS Admin log from every federation server.
• Correlate event timing with update installation and service restarts.

Safe remediation sequence

1. Inventory every federation server and operating-system version.
2. Install the July 2026 or a superseding update on all nodes.
3. Back up AD FS and Active Directory recovery information according to the organization’s runbook.
4. Review audit events and dependencies.
5. Test the opt-in in a representative environment.
6. Enable documented remediation in a controlled window.
7. Verify AD FS service, relying-party authentication, event results, and rollback readiness.

Separate vulnerability remediation from incident response

The ACL condition can create a path to sensitive DKM material, but it does not prove the token-signing key was stolen. When evidence suggests unauthorized access, preserve logs, review federation trust and signing certificates, investigate identity activity, and involve qualified responders. Rotate keys only under a tested incident plan when scope warrants it.

Prepare for October

Organizations that cannot complete opt-in remediation before October should document the compatibility blocker, monitoring, owner, deadline, and Microsoft-supported temporary action. Do not silently defer.

For related guidance from ITECS, see ITECS cybersecurity services.

Sources and update trigger

• Microsoft Support — KB5121391 AD FS DKM ACL hardening
• CISA — Known Exploited Vulnerabilities JSON

Review trigger: Recheck Microsoft’s KB before opt-in and before October 13, 2026, and update immediately if rollout dates, events, or prerequisites change.