Active Directory Federation Services (AD FS) Spoofing Vulnerability
Plan PatchCVSS 8.1CVE-2026-83674Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary
A weakness in Active Directory Federation Services (AD FS) authentication allows an unauthorized attacker on the network to spoof user or service identities without providing valid credentials. Affected systems include Windows Server 2016, 2019, 2022, 2025 and Windows 10 (versions 1607 and 1809). Microsoft has released fixes in the October 2026 security updates.
What this means
What could happen
An attacker on the network could impersonate a legitimate user or service in your Active Directory Federation Services environment, potentially gaining unauthorized access to cloud applications, on-premises resources, or both.
Who's at risk
Organizations running Active Directory Federation Services for single sign-on (SSO), particularly those integrating with cloud services like Office 365 or using AD FS for hybrid identity. This affects Windows Server 2016, 2019, 2022, 2025 and Windows 10 systems configured as AD FS servers or federation proxies.
How it could be exploited
An attacker with network access to your AD FS servers could craft malicious authentication requests that bypass AD FS's authentication checks due to weak token validation, allowing them to spoof the identity of any user without valid credentials.
Prerequisites
- Network access to AD FS servers or the ability to intercept authentication traffic
- No valid credentials required
remotely exploitableno authentication requiredhigh-complexity exploitationaffects identity and access control
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXApply the October 2026 security update to all Windows Server 2016, Server 2019, Server 2022, Server 2025, and Windows 10 systems running AD FS
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/ccbd5e08-7e36-468e-8174-95b771dfa160Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.