Active Directory Federation Services (AD FS) Spoofing Vulnerability

An attacker could impersonate legitimate users or services in your AD FS environment, potentially gaining unauthorized access to systems and applications that rely on AD FS for authentication. This could compromise access control across your infrastructure.

This affects IT departments managing Windows Server AD FS infrastructure. Organizations using Windows Server 2016, 2019, 2022, or 2025 with AD FS enabled for identity management and federated access are most at risk. This is particularly critical if your water authority or utility uses AD FS to authenticate operators and engineers accessing SCADA systems or remote access solutions.

An attacker on the network sends spoofed authentication requests to AD FS without valid credentials. By exploiting the vulnerability, the attacker can bypass identity verification and impersonate legitimate users or federated services to gain access to protected resources.