Active Directory Federation Services (AD FS) Spoofing Vulnerability
Plan PatchCVSS 7.4CVE-2026-83511Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
Weak authentication validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to forge security tokens over the network. An attacker could generate fraudulent tokens that appear legitimate to applications and systems relying on AD FS, enabling them to impersonate valid users and bypass authentication controls.
What this means
What could happen
An attacker could forge authentication tokens in AD FS, allowing them to impersonate legitimate users and gain unauthorized access to systems and applications that rely on AD FS for identity verification. This could compromise access to critical infrastructure management interfaces, SCADA systems, or operational technology networks that use centralized authentication.
Who's at risk
Organizations that run Windows Server 2016, 2019, 2022, or 2025 with Active Directory Federation Services (AD FS) for identity management and single sign-on. This includes utilities and municipalities using AD FS to manage access to industrial control systems, SCADA interfaces, engineering workstations, or other networked OT devices that integrate with centralized authentication.
How it could be exploited
An attacker on your network sends specially crafted requests to the AD FS service to exploit weak authentication validation. The attacker generates fraudulent security tokens that appear legitimate to downstream systems, allowing them to bypass authentication checks and access resources without valid credentials.
Prerequisites
- Network access to AD FS endpoints (typically port 443)
- AD FS must be deployed and in use for identity services
- Attacker must be able to reach the AD FS server from their network position
remotely exploitableaffects authentication systemscould enable unauthorized access to critical systems
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/1WORKAROUNDRestrict network access to AD FS servers to only authorized administrative networks and known service consumers using firewall rules
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 security update (or later) to all affected Windows Server and Windows 10 systems running AD FS
HARDENINGEnable AD FS audit logging to detect suspicious token generation or authentication requests
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/238385ad-82b1-4892-8a4e-f55b23718872Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.