Executive brief
A vulnerability in Microsoft's Active Directory Federation Services (AD FS) allows an unauthorized person to crash the service remotely. AD FS is a critical component used to manage single sign-on and user authentication across different applications. If exploited, this could prevent legitimate users from logging into corporate systems, causing a significant disruption to business operations.
Technical details
This vulnerability is classified as an infinite loop (CWE-835) within Active Directory Federation Services (AD FS). An unauthenticated attacker can trigger this condition by sending a specially crafted request over the network, causing the service to enter a loop with an unreachable exit condition. This results in high CPU utilization and service unavailability (Denial of Service). The vulnerability affects multiple versions of Windows and Windows Server. Microsoft has released security updates to address this issue; administrators should apply the relevant OS patches to remediate the flaw.
Affected products
- Microsoft Windows 10 Version 1607, 1809, 21H2, 22H2 Multiple versions affected
- Microsoft Windows 11 Version 24H2, 25H2, 26H1 Multiple versions affected
- Microsoft Windows Server 2012 Multiple versions affected
- Microsoft Active Directory Federation Services (AD FS) All versions running on affected Windows OS
Timeline
- 2026-07-14: disclosed: Initial publication of CVE-2026-50647 by Microsoft
- 2026-07-14: advisory: NVD entry created