Active Directory Federation Services (AD FS) Spoofing Vulnerability
MonitorCVSS 6.5CVE-2026-103576Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
An open redirect vulnerability in Active Directory Federation Services (AD FS) allows an attacker to redirect users to untrusted sites through URL manipulation. This vulnerability can be exploited over the network without authentication but requires user interaction (clicking a malicious link). The vulnerability affects Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 versions 1607 and 1809.
What this means
What could happen
An attacker could craft a malicious link that redirects AD FS users to a phishing or spoofed authentication site, potentially compromising credentials or facilitating social engineering attacks against your IT staff or operators who rely on AD FS for authentication.
Who's at risk
IT administrators and operators who rely on AD FS for domain authentication should prioritize this patch. Organizations running Windows Server 2016, 2019, 2022, or 2025 as AD FS servers, or Windows 10 systems running AD FS components, are affected. Any user who accesses applications or services that delegate authentication to AD FS is at risk if a malicious link is clicked.
How it could be exploited
An attacker sends a crafted AD FS URL to a user (via email or link) that redirects to an attacker-controlled website. When the user clicks the link, they are redirected to the malicious site, which can impersonate the legitimate AD FS login page or other trusted service. The attacker can harvest credentials or execute a phishing attack if the user believes they are interacting with a legitimate service.
Prerequisites
- Network access to the AD FS server
- Valid or guessable AD FS URL that can be modified with the redirect parameter
- User interaction required—a victim must click the malicious link
remotely exploitablelow complexityuser interaction requiredcredential harvesting risk
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/6
Do now
0/1HARDENINGEducate users and staff to verify the URL in the browser address bar before entering credentials during AD FS authentication
Schedule — requires maintenance window
0/5Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 systems running AD FS to the latest 2026-Oct security update
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/08448f24-5cc7-4dc9-b6ae-c3055e2c91f1Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.