# CVE-2026-103576: Microsoft Active Directory Federation Services open redirect

Source: https://junglewise.ai/threats/cve-2026-103576-url-redirection-to-untrusted-site-open-redirect-in-active  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103576 · Severity: medium · CVSS 6.5 · Published 2026-10-13

Active Directory Federation Services (AD FS) is Microsoft's authentication system that manages user sign-in for corporate networks and cloud services. An open redirect vulnerability allows an attacker to craft a malicious link that redirects users to a fraudulent website, enabling phishing attacks and credential theft. The attacker needs only to send a crafted link over the network; no authentication is required on the victim's side.

Technologies: [Microsoft Active Directory Federation Services](https://junglewise.ai/threats/technologies/active-directory-federation-services). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-103576 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103576 being exploited in the wild.

**How severe is CVE-2026-103576?** Medium severity, with a CVSS score of 6.5, published 13 October 2026.

**Which products and versions are affected?** Microsoft Active Directory Federation Services.

**Is there a fix for CVE-2026-103576?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103576 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-103576?** Check whether you run Microsoft Active Directory Federation Services. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability in AD FS allows unauthenticated attackers to redirect users to attacker-controlled URLs by exploiting improper validation of redirect parameters. The vulnerability is reachable over the network and requires only that a user click a malicious link, making it suitable for phishing campaigns. The flaw enables spoofing attacks where users are deceived into visiting fraudulent authentication pages.

## Affected products

- Microsoft Active Directory Federation Services

## Timeline

- 2026-10-13: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103576](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-103576)

## Related threats

- [Microsoft Active Directory Federation Services information disclosure](https://junglewise.ai/threats/cve-2026-97788-observable-discrepancy-in-active-directory-federation-services-ad)
- [Microsoft Active Directory Federation Services cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-96252-improper-verification-of-cryptographic-signature-in-active)
- [Microsoft Active Directory Federation Services memory allocation denial of service](https://junglewise.ai/threats/cve-2026-85324-memory-allocation-with-excessive-size-value-in-active-directory)
- [Microsoft Active Directory Federation Services resource exhaustion denial of service](https://junglewise.ai/threats/cve-2026-85319-allocation-of-resources-without-limits-or-throttling-in-active)
- [Microsoft Active Directory Federation Services weak authentication](https://junglewise.ai/threats/cve-2026-83674-weak-authentication-in-active-directory-federation-services-ad-fs)