Active Directory Federation Services (AD FS) Denial of Service Vulnerability
Plan PatchCVSS 7.5CVE-2026-83645Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Active Directory Federation Services (AD FS) contains a resource allocation vulnerability where an unauthorized attacker can send network requests that cause the service to consume resources without limits, leading to denial of service. The affected systems are Windows 10 (versions 1607, 1809) and Windows Server 2016, 2019, 2022, and 2025.
What this means
What could happen
An attacker can send specially crafted network requests to AD FS without authentication, consuming server resources and making the authentication service unavailable to legitimate users and systems. This disrupts your ability to authenticate staff, domain-joined devices, and integrated applications across the organization.
Who's at risk
Organizations running Windows Server 2016, 2019, 2022, or 2025, or Windows 10 systems with Active Directory Federation Services. This affects any organization using AD FS for user authentication, federated identity management, or single sign-on (SSO) services.
How it could be exploited
An attacker sends malicious requests to the AD FS service over the network (typically port 443). The requests exploit a resource allocation flaw that causes the service to exhaust memory or CPU without limits, degrading or halting AD FS availability. No authentication or special configuration is required.
Prerequisites
- Network access to AD FS service port (typically 443)
- No authentication required
- No special configuration needed
remotely exploitableno authentication requiredlow complexityaffects authentication infrastructurehigh availability impact
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/3
Do now
0/2WORKAROUNDRestrict network access to AD FS services to trusted networks and known client IP ranges using firewall rules
HARDENINGMonitor AD FS service resource utilization (CPU, memory) for abnormal spikes that may indicate exploitation attempts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXApply the October 2026 Windows security update to all affected Windows Server and Windows 10 systems running AD FS
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/7eb4d3d8-722e-45b9-a5d4-3d03cc0d10acGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.