Executive brief
A vulnerability in Microsoft's Active Directory Federation Services (AD FS) allows an unauthorized person to crash the service remotely. AD FS is a critical component used for single sign-on and identity management across different applications. If exploited, this would prevent users from logging into corporate systems and services, causing a significant disruption to business operations.
Technical details
A stack-based buffer overflow (CWE-121) exists in Microsoft Active Directory Federation Services (AD FS). The vulnerability is reachable over the network without authentication (AV:N/AC:L/PR:N/UI:N). An attacker can exploit this flaw by sending specially crafted requests to the AD FS endpoint, leading to a service crash and denial-of-service (DoS). The issue affects multiple versions of Windows Server and Windows 10. Microsoft has released security updates to address this vulnerability.
Affected products
- Microsoft Active Directory Federation Services (AD FS) Windows Server 2012, 2012 R2, 2016, 2019; Windows 10 1607, 1809
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory