Active Directory Federation Services (AD FS) Spoofing Vulnerability
Plan PatchCVSS 9.1CVE-2026-96252Oct 13, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Improper verification of cryptographic signatures in Active Directory Federation Services (AD FS) allows an unauthenticated attacker on the network to forge authentication tokens and spoof legitimate users. The vulnerability affects Windows Server 2016, 2019, 2022, and 2025, as well as Windows 10 Version 1607 and 1809 systems running AD FS. Microsoft has released security updates that correct the signature verification process.
What this means
What could happen
An attacker could forge authentication tokens in AD FS, allowing them to impersonate legitimate users and gain unauthorized access to applications and resources that rely on AD FS for authentication. This could compromise user accounts and enable unauthorized access to sensitive data or operational systems.
Who's at risk
Water authorities and utilities using Active Directory Federation Services (AD FS) for single sign-on authentication to operational applications, web portals, or administrative interfaces. This impacts any organization where AD FS is deployed on Windows Server 2016, 2019, 2022, or 2025, or Windows 10 systems acting as AD FS servers.
How it could be exploited
An attacker on the network sends a crafted request to an AD FS server that exploits the improper signature verification in the authentication token signing process. The server accepts the forged token as valid, and the attacker can then use this token to authenticate to applications as any user without knowing their password.
Prerequisites
- Network access to AD FS server on port 443 (HTTPS)
- AD FS service must be running and configured for token issuance
- Target application must trust tokens from the vulnerable AD FS instance
Remotely exploitableNo authentication required for exploitationLow complexityHigh CVSS score (9.1)Affects authentication systems
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (12)
12 with fix
ProductAffected VersionsFix Status
Remediation & Mitigation
0/7
Schedule — requires maintenance window
0/6Patching may require device reboot — plan for process interruption
Windows Server 2016
HOTFIXUpdate Windows Server 2016 to Build 10.0.14393.9612 or later
Windows Server 2019
HOTFIXUpdate Windows Server 2019 to Build 10.0.17763.9376 or later
Windows Server 2022
HOTFIXUpdate Windows Server 2022 to Build 10.0.20348.5761 or later
Windows Server 2025
HOTFIXUpdate Windows Server 2025 to Build 10.0.26100.33650 or later
All products
HOTFIXUpdate Windows 10 Version 1607 to Build 10.0.14393.9612 or later if running AD FS
HOTFIXUpdate Windows 10 Version 1809 to Build 10.0.17763.9376 or later if running AD FS
Long-term hardening
0/1HARDENINGRestrict network access to AD FS servers to authorized management and client networks only
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/cdb3284a-88f9-48a7-9c05-6a104176f9e6Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.