Active Directory Federation Services (AD FS) Denial of Service Vulnerability
Plan PatchCVSS 7.5CVE-2026-85319Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
What this means
What could happen
Could disrupt device operations or cause loss of view/control
Who's at risk
Organizations in critical infrastructure using Microsoft equipment
How it could be exploited
Attacker on the corporate network or internet could reach this device without any credentials. The attack is straightforward with no special conditions
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/1
Long-term hardening
0/1Exploitation assessment: Exploitation Unlikely. Apply the 2026-Oct security update.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a643a86b-5944-43cb-8e8e-5955d63f1016Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.