Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
MonitorCVSS 5.9CVE-2026-70005Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
Weak authentication in Active Directory Federation Services (AD FS) on Windows Server 2019, 2022, and 2025 allows an unauthorized attacker to bypass a security feature over a network. This affects all versions of these operating systems, both full and Server Core installations. Microsoft has released fixes in October 2026 security updates.
What this means
What could happen
An attacker could bypass AD FS security features to gain unauthorized authentication to systems or services relying on federated identity, potentially compromising access controls across your network infrastructure.
Who's at risk
Organizations operating Windows Server 2019, 2022, or 2025 with Active Directory Federation Services (AD FS) enabled should prioritize this update. AD FS is commonly used in enterprises with hybrid cloud setups, single sign-on (SSO) implementations, and multi-forest Active Directory environments.
How it could be exploited
An attacker with network access to AD FS endpoints could craft requests that exploit weak authentication logic to bypass security checks, allowing unauthorized access without valid credentials.
Prerequisites
- Network access to AD FS endpoints (port 443 HTTPS typically)
- AD FS service running on affected Windows Server version
remotely exploitableno authentication requiredaffects identity and access controllow EPSS score
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (6)
6 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/2
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXApply October 2026 security updates to all Windows Server 2019, 2022, and 2025 systems running AD FS
All products
HARDENINGVerify AD FS authentication logs for suspicious authentication bypass attempts or unusual access patterns
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/6a0bbd30-989d-4e0d-acf6-7ee480e6f640Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.