Active Directory Federation Services (AD FS) Denial of Service Vulnerability
Plan PatchCVSS 7.5CVE-2026-85324Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A memory allocation vulnerability in Active Directory Federation Services (AD FS) allows an unauthorized attacker to cause a denial of service by sending specially crafted requests over the network. The vulnerability exists because AD FS does not properly validate the size of memory allocation requests, permitting an attacker to trigger excessive memory consumption and crash the service.
What this means
What could happen
An attacker on your network can crash AD FS services by sending specially crafted requests, disrupting authentication for applications that rely on federated identity. This could prevent users from accessing critical systems.
Who's at risk
Organizations running AD FS for identity federation and single sign-on should prioritize this. Affects Windows 10 and Windows Server 2016, 2019, 2022, and 2025 systems hosting AD FS.
How it could be exploited
An attacker sends malformed requests with excessive memory allocation values to the AD FS service over the network. The service fails to validate the allocation size, allocates excessive memory, exhausts system resources, and crashes.
Prerequisites
- Network access to AD FS service port (typically 443/HTTPS)
- No authentication required
- AD FS service must be running and reachable from the attacker's network
remotely exploitableno authentication requiredlow complexityhigh severity impact on availability
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/7
Do now
0/1WORKAROUNDRestrict network access to AD FS service to authorized client networks only using firewall rules
Schedule — requires maintenance window
0/6Patching may require device reboot — plan for process interruption
Windows Server 2019
HOTFIXApply Windows Server 2019 security update to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXApply Windows Server 2022 security update to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXApply Windows Server 2025 security update to Build 10.0.26100.33650 or later
Windows Server 2016
HOTFIXApply Windows Server 2016 security update to Build 10.0.14393.9612 or later
All products
HOTFIXApply Windows 10 Version 1809 security update to Build 10.0.17763.9376 or later
HOTFIXApply Windows 10 Version 1607 security update to Build 10.0.14393.9612 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/39ab3bec-69a2-44d7-8bf7-a2668ec4682eGet OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.