CERT-In’s Microsoft Alert Leaves AD FS in Audit Mode

CERT-In published high-severity advisory CIAD-2026-0035 on July 17, 2026, covering Windows, Office, Azure, SQL Server and Copilot. The Indian Computer Emergency Response Team told administrators to install Microsoft’s July 14 security updates after live attacks had already used two of the flaws.

Home-office names rode the alert. The exploited bug that still needs a human decision is on Active Directory Federation Services, where the July patch only logs bad permissions until October 13, 2026.

CERT-In’s July Note Reached Past Word and Excel

On July 17 the agency posted a high-severity note on Microsoft products and pointed readers at Microsoft’s July 2026 release notes. The target list is individuals plus the IT staff who keep those products current. Risk, in CERT-In’s own wording, includes remote code execution, unstable systems and leaked data, with ransomware and crashes named in the impact line.

Office is on that list. So is almost every other Microsoft family that shipped a fix that Tuesday, which is the same July Patch Tuesday catalog that closed two exploited zero-days in identity and SharePoint.

SOFTWARE CERT-IN MARKED AFFECTED

• Core platforms: Microsoft Windows, Microsoft Office, Azure, SQL Server, Microsoft Dynamics and Developer Tools.
• Server stack: Server Software, System Center, Apps, Device software, Open Source Software and Extended Security Updates for legacy products.
• The “Other” bucket: Microsoft Copilot, the GitHub Copilot Plugin for JetBrains IDEs, Minecraft Bedrock Dedicated Server and Age of Empires II: Definitive Edition.

CrowdStrike’s July tally counted 622 Microsoft CVEs in that release, with 62 rated Critical. Windows took 413 of them, Extended Security Updates 335, and Office 95. Elevation of privilege led the mix at 255 flaws (41%), ahead of 166 remote-code bugs (27%) and 109 information-disclosure bugs (18%).

CERT-In did not reprint that scoreboard. It named three CVEs in the body, said those three were being exploited in the wild, and sent everyone else to Microsoft’s update guide. A second Microsoft-products note, CIAD-2026-0038, followed on August 12. CIAD-2026-0037, posted August 7, separately warned about password spraying and token theft against Microsoft 365. The July wrap was one month in a series, not a one-off Word scare.

Audit Mode Leaves Token Keys Where They Were

CVE-2026-56155 is an elevation-of-privilege flaw in Active Directory Federation Services, scored 7.8 (CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and tagged CWE-1220, insufficient granularity of access control. CERT-In’s text is plain: an authenticated attacker can raise privileges on the affected host. Microsoft rates it Important, not Critical, and describes a low-privileged local attacker who needs no extra click.

The weak point is the Distributed Key Manager container in Active Directory, where AD FS keeps the symmetric keys that protect token-signing and token-encryption certificate private keys. If that container’s access list is too open, someone who can read the material can decrypt the signing keys. Those keys underwrite sign-in for Microsoft 365, Entra ID and every app that trusts the farm, so a 7.8 local bug on one server is a tenant-wide problem once the keys move.

If the container’s ACL is overly permissive, an attacker with read access to the DKM key material can decrypt the token-signing private keys.

Microsoft, KB5121391 DKM ACL hardening note

The July 14 Windows update, tracked with KB5121391 and related packages, put that check into Audit mode. Detection runs one minute after the AD FS service starts and every 24 hours after that. It writes Event ID 1132 when the ACL does not match the secure state, 1133 when it does, and 1134 when the check itself fails. Microsoft’s DKM container ACL hardening steps say no changes are made automatically in this phase. Fixed builds include 14393.9339 for Server 2016, 17763.9020 for Server 2019, 20348.5386 for Server 2022 and 26100.33158 for Server 2025. Installing them is necessary. It is not the same as closing the ACL.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on July 14, 2026, and set a July 28 deadline for U.S. federal systems. That deadline has passed. Indian shops were never on that clock, and many will have treated the CERT-In note as a Windows Update ticket. The original DKM ACL is still the original DKM ACL unless someone set a registry value.

October 13 Rewrites the DKM Permissions

On Windows Server 2016 and later, administrators can opt in now by setting HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ADFS\RemediateDkmAcl to DWORD 1 on any one AD FS server in the farm. The DKM object lives in the directory, so one server’s remediation hardens the ACL for the whole farm. After that, wait up to 24 hours or restart the AD FS service. Event ID 1135 records success and stores the previous ACL in SDDL form, which Microsoft wants saved because event logs roll. Event 1136 means the attempt failed.

The hardened state is narrow. Domain Admins, Enterprise Admins and SYSTEM keep Full Control. The AD FS service account keeps Read, Write, Create Child, Write Owner and Delete Tree. Inheritance is turned off, inherited ACEs are dropped, and every other explicit Allow ACE is removed.

THE HARDENING CALENDAR

1. July 14, 2026: Microsoft ships the July security updates and starts DKM ACL Audit mode; CISA lists CVE-2026-56155 as known exploited.
2. July 17, 2026: CERT-In issues CIAD-2026-0035 and names the AD FS flaw among three CVEs it says are exploited in the wild.
3. July 28, 2026: CISA’s federal remediation deadline for CVE-2026-56155 passes.
4. July 30, 2026: Microsoft posts a 90-day reminder that Enforcement mode begins with the October Windows update.
5. October 13, 2026: On Server 2016 and later, insecure DKM ACLs are remediated by default unless RemediateDkmAcl is set to 0.

Opting out of October still leaves detection running, so 1132 keeps firing. Microsoft says that choice should be limited to a known compatibility need paired with a manual hardening plan, because the container stays vulnerable. Identity teams that patched Windows in July and never opened the AD FS Admin log will meet that rewrite with no test window left.

Copilot Scored 9.6 on the Same List

CERT-In put Microsoft Copilot in the same “Other” bucket as a Minecraft dedicated server and Age of Empires II. The Copilot item is not a curiosity. CVE-2026-48561 is a Critical remote-code flaw in Copilot Chat (Microsoft Edge), scored 9.6, caused by command injection (CWE-77). Microsoft’s record for the Copilot Chat command injection bug says an attacker can host a site that makes Edge for Android send crafted prompts to Copilot when the user visits. There is no confirmation step and no origin check, so the prompts can run without the user noticing.

That path needs a visit, which is why Microsoft rates exploitation less likely and has not reported it in the wild. It is still the loudest CVSS number in the set CERT-In folded into one High note. Phone users running Copilot through Edge are the people who have to take that update. They are a different queue from the AD FS farm.

THE CVES CERT-IN PUT ON THE PAGE

Office’s 95 July patches include critical remote-code bugs in Word, Excel and PowerPoint, which is why consumer headlines stayed on those apps. Those client updates follow the usual Microsoft 365 and Click-to-Run channels. They do not touch the DKM container.

SharePoint’s Unauthenticated Pair

CERT-In’s other two named CVEs both hit on-premises SharePoint. CVE-2026-56164 is a missing-authentication flaw (CWE-306) that lets an unauthenticated attacker raise privileges over the network. CrowdStrike logged it as Moderate at 5.3, and Microsoft marked it exploited in the wild. CVE-2026-58644 is deserialization of untrusted data; CERT-In says an unauthenticated attacker can send crafted requests and run code on the server.

Microsoft’s July notes treated two bugs as exploited zero-days: the AD FS privilege lift and the SharePoint missing-authentication issue. CERT-In’s sentence added 58644 to that exploited set. Microsoft has not published a public exploit write-up or named a threat actor for any of the three. Analyses of the July release credit Microsoft’s Detection and Response Team with finding CVE-2026-56155 during a live intrusion, which is why the KEV listing landed on Patch Tuesday rather than weeks later.

WHERE CERT-IN AND MICROSOFT DIVERGE

• Exploited count: Microsoft’s July release marked two zero-days as exploited in the wild, CVE-2026-56155 and CVE-2026-56164.
• CERT-In’s note: CIAD-2026-0035 tells users that CVE-2026-56155, CVE-2026-56164 and CVE-2026-58644 are being exploited in the wild and to patch at once.
• Actor and method: Neither Microsoft nor CERT-In has identified the operators or published a public exploit for the AD FS DKM path.

SharePoint farms that are reachable from the internet are a separate emergency from federation. They were already on CISA’s list in mid-July. An Indian administrator who closed SharePoint and Office in the same change window can still have a wide-open DKM ACL on AD FS, because that fix was never in the CU’s default behavior.

Server 2012 Farms Get No Automatic Fix

Extended Security Updates for Windows Server 2012 and 2012 R2 are on CERT-In’s affected-software line for a reason. Those AD FS hosts get Audit mode after the July update, and they get the same Event 1132 warning. They do not get October’s automatic rewrite. Microsoft’s path is manual: on any one server in the farm, grant the AD FS service account WriteOwner and WriteDacl on the DKM container, then set RemediateDkmAcl to 1. Skip the extra ACEs and the remediation attempt fails.

WHAT STILL HAS TO HAPPEN ON EACH FARM

• Every AD FS host: Install the July 14, 2026 security update or a later Windows update, then restart or cycle the AD FS service so the audit task is live.
• Server 2016 and later: If Event 1132 appears, set RemediateDkmAcl to 1 on one server, or wait for the October 13, 2026 update to do it unless a tested opt-out exists.
• Server 2012 and 2012 R2: Grant WriteOwner and WriteDacl first, then opt in with the same registry value; October will not finish this for you.
• After 1135: Save the previous SDDL from the event message before the log wraps, and review token-signing certificates if the farm may already have been read.

Office users who took the July Click-to-Run build have already done the part of CIAD-2026-0035 that matched the Word and Excel headlines. Copilot on Android still needs its own store update for CVE-2026-48561. The leftover work is in the AD FS Admin log. Event ID 1132 on an Indian federation server means the July CERT-In note was applied as a patch job, and the keys that sign the tenant are still behind the old ACL, with the October 13 rewrite as the next forced change.