OTPulse

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Plan PatchCVSS 7.4CVE-2026-96222Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. The vulnerability exists in certificate validation logic that does not properly verify certificates presented to the AD FS service. Affected versions include Windows Server 2016, 2019, 2022, and 2025, as well as multiple versions of .NET Framework across Windows 10 and Windows 11. Microsoft has released patches in the October 2026 security update.

What this means
What could happen
An attacker could spoof AD FS authentication tokens, allowing them to impersonate legitimate users and gain unauthorized access to systems and applications that trust AD FS for authentication.
Who's at risk
Organizations running AD FS for enterprise authentication, including those using it for hybrid identity management, single sign-on, or federated access to cloud applications. This primarily affects IT infrastructure teams managing Windows Server-based identity services, but impacts any facility relying on AD FS for access control to operational systems.
How it could be exploited
An attacker on the network intercepts or crafts a malicious certificate that passes validation in AD FS due to improper certificate checking. They use this to generate forged authentication tokens, which they present to applications that trust AD FS. Applications accept the tokens as legitimate, granting the attacker access as an impersonated user.
Prerequisites
  • Network access to AD FS service
  • Ability to present a crafted certificate to AD FS
  • Target applications must rely on AD FS for authentication
remotely exploitableno authentication requiredaffects identity/authentication systemshigh impact on access control
Exploitability
Unlikely to be exploited — EPSS score 0.6%
Affected products (33)
33 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9376
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9376
Windows Server 2019All versionsBuild 10.0.17763.9376
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9376
Windows Server 2022All versionsBuild 10.0.20348.5761
Remediation & Mitigation
0/6
Schedule — requires maintenance window
0/5

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply Microsoft October 2026 security update to all Windows Server 2016 systems
Windows Server 2019
HOTFIXApply Microsoft October 2026 security update to all Windows Server 2019 systems
Windows Server 2022
HOTFIXApply Microsoft October 2026 security update to all Windows Server 2022 systems
Windows Server 2025
HOTFIXApply Microsoft October 2026 security update to all Windows Server 2025 systems
All products
HOTFIXUpdate .NET Framework to the corrected version on affected Windows systems
Long-term hardening
0/1
HARDENINGRestrict network access to AD FS servers to only authorized client systems and applications
View full vendor advisory
API: /api/v1/advisories/2768ba29-e498-4215-afce-ec7ad263640e

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Active Directory Federation Services (AD FS) Spoofing Vulnerability | CVSS 7.4 - OTPulse